Privacy Policy

Last Updated: July 7, 2026

GetExpanded ("us", "we", or "our") operates the GetExpanded website at www.getexpanded.org (the "Service"). This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data. GetExpanded is operated by 13738248 Canada Inc.

We use your data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Medical Disclaimer

IMPORTANT: We are not doctors or medical professionals. GetExpanded is not a medical service provider and does not provide medical advice, diagnosis, or treatment. The information provided on our website is for informational purposes only and is not intended to be a substitute for professional medical advice, diagnosis, or treatment regarding palatal expansion, airway health, jaw development, sleep apnea, or any other medical conditions.

2. Information We Collect

2.1 Account Data

When you create an account on our Service, we collect:

• Email address
• Practice name (for provider accounts)
• Account creation date, sign-in history, and session data

We use passwordless authentication: signing in works with one-time codes sent to your email. We never collect or store a password. Account data is stored securely using Supabase authentication services.

2.2 Provider Submission Data

Submitting provider information requires a verified account. When you submit a provider through our submission form, we collect:

• Provider name and type (orthodontist, surgeon, therapist, sleep doctor)
• Location information (country, state/province, city)
• Website information
• Device types and services offered
• Additional notes about the provider
• Your account email, recorded with the submission for review and follow-up

All submissions are reviewed before being published.

2.3 Provider Dashboard Data

When you use the Provider Dashboard to manage listings, we collect:

• Listing claim requests and verification information
• Provider profile updates and edits
• Premium listing customizations (logo, banner, video, social links, education, certifications, continuing education, FAQ)
• Dashboard activity and usage patterns

2.4 Payment and Subscription Data

When you subscribe to Premium Listings, payment processing is handled by our third-party payment processor, Dodo Payments. We collect and store:

• Customer ID for subscription management
• Subscription status and billing period
• Payment history references

We do not store full credit card numbers, CVV codes, or other sensitive payment details. All payment information is processed and stored securely by Dodo Payments in accordance with PCI-DSS standards. Please refer to Dodo Payments' privacy policy for information about how they handle your payment data.

2.5 Provider Directory Information

Our directory lists providers specializing in palatal expansion (RPE, MSE, MARPE, DOME, SARPE, FME, FMA), airway orthodontics, jaw surgery, myofunctional therapy, and sleep medicine. Listing information may include provider names, locations, websites, services, devices, patient notes, and verification status. This information is collected from public sources and from direct submissions by providers and users. By submitting provider information to our directory, you consent to the public display of that information on our Service.

2.6 Collaboration Bookings

When you request a collaboration (for example, a podcast or video recording session) through our booking system, we collect:

• Your name, verified account email, practice name, and phone number
• Website and social media links you want featured in promotion
• A short biography and 1–3 photos of yourself
• Names and email addresses of any additional guests you add
• Your timezone and requested session time
• Your consent to be added to a WhatsApp coordination group

Booking details are shared with the session host and our team. Calendar invitations are sent through Google Calendar to everyone on the booking. Sessions are recorded using Riverside, a third-party recording platform, subject to its own terms and privacy policy. Photos you upload are stored in a publicly accessible storage location, and your biography, photos, and links may be used to create and publish promotional content for the collaboration (see our Terms of Service). Adding additional guests means you confirm they agree to share their name and email with us for invitations and reminders.

2.7 Provider Outreach

We may contact providers using publicly available business contact information (for example, a practice's public email address) to invite them to claim or update their listing. These invitations are sent through our email tooling (Resend and Hunter). You can opt out of outreach at any time using the unsubscribe link in any outreach email or by contacting us; opted-out addresses are excluded from future campaigns.

2.8 Website Usage Data

We collect information on how the Service is accessed and used, such as browser type, pages visited, time and date of visits, and referring pages. Our traffic is served through Cloudflare, which provides us with coarse location information (country, region, city). We do not store your full IP address with analytics events.

2.9 Provider Listing Analytics

For provider listings, we collect analytics to help providers understand how their listings perform:

• Listing impressions: when a listing appears in search results
• Profile views: when a user visits a provider's profile page
• Website clicks: when a user clicks the provider's website link (Premium)
• Social media clicks: by platform (Premium)
• Traffic sources: how users found the listing (Premium)
• Geographic data: general country/region of visitors (Premium)

Analytics are aggregated and shown to providers who have claimed their listings. Basic analytics (impressions and profile views) are available to all claimed listings; advanced analytics are available to Premium subscribers. Analytics data is retained for up to 24 months.

2.10 Cookies

We use a small number of first-party cookies:

• Authentication cookies (Supabase) to keep you signed in and secure your session
• analytics_session — a 24-hour session identifier used to count unique listing views
• ge_campaign — a 30-day cookie set when you arrive from one of our invitation links, used to apply campaign offers to your claim

We do not use third-party advertising cookies. You can instruct your browser to refuse cookies, but parts of the Service (including sign-in and the Provider Dashboard) will not work without them.

2.11 Community Platform

We operate a Discord community server for users to connect and share experiences. When you join our Discord community, you are subject to Discord's privacy policy and terms of service in addition to our own.

2.12 Email Communication Preferences

When you create an account, you can opt in to marketing and promotional emails. We store your opt-in/out preference and use it to manage which communications we send. You can change your preference at any time in your account settings or via the unsubscribe link in any marketing email.

3. Use of Data

GetExpanded uses the collected data to:

• Provide and maintain the provider directory
• Create and manage your account and authenticate you
• Process and review provider submissions and listing claims
• Process Premium subscription payments and manage billing
• Schedule, coordinate, produce, and promote collaboration sessions
• Contact providers about their listings, including claim invitations
• Verify provider information and maintain directory accuracy
• Improve search, filtering, and overall user experience
• Provide customer support and respond to inquiries
• Detect, prevent, and address technical issues
• Send service-related communications (verification codes, approvals, subscription updates)

3.1 Email Communications

• Transactional emails: sign-in codes, submission and claim decisions, booking confirmations and reminders, subscription notifications
• Notification emails: important updates about your submissions, claims, bookings, and subscriptions
• Marketing emails: platform updates and relevant opportunities, sent only with your opt-in consent

Transactional and notification emails are essential to the Service and cannot be opted out of. Marketing emails are optional, and you can unsubscribe at any time.

3.2 Email Service Provider

We use Resend to deliver our emails. Resend processes your email address and message content on our behalf and complies with email regulations including CAN-SPAM and CASL (Canada's Anti-Spam Legislation). Please refer to Resend's privacy policy for details on how they handle data.

4. Data Storage and Processing

Provider data, user accounts, uploaded photos, and application data are stored in our Supabase database and storage. The website is hosted on cloud infrastructure located in the United States and served through Cloudflare's global network. Provider submissions are processed through our systems and reviewed before publication.

5. Data Retention

• Account data: retained until you delete your account or request deletion
• Provider listings: retained until removed by the provider or GetExpanded
• Collaboration booking data and photos: retained while relevant to the collaboration and its promotion, or until you request deletion
• Payment records: retained as required by applicable tax and accounting laws
• Usage data: retained for up to 24 months for analytics purposes

6. Data Protection and Scraping Prevention

We implement measures to protect our data and prevent unauthorized scraping or harvesting of our provider directory. Automated data collection, scraping, or harvesting of our website content is strictly prohibited without our express written consent.

7. Transfer of Data

Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your jurisdiction, including Canada and the United States, where data protection laws may differ. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer. 13738248 Canada Inc. will take all steps reasonably necessary to ensure your data is treated securely and in accordance with this Privacy Policy.

8. Disclosure of Data

GetExpanded may disclose your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation under Canadian law
• Protect and defend the rights or property of 13738248 Canada Inc.
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

9. Security of Data

We implement appropriate technical and organizational measures, including:

• Encryption of data in transit using HTTPS/TLS
• One-time sign-in codes instead of stored passwords
• Encrypted storage of third-party access tokens
• Role-based access controls and row-level security on our database
• Regular security updates and monitoring

No method of transmission or storage is 100% secure; while we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee absolute security.

10. Your Privacy Rights

Under Canadian privacy legislation, including PIPEDA (Personal Information Protection and Electronic Documents Act), you have the right to:

• Access personal information we hold about you
• Correct inaccurate or incomplete personal information
• Delete your account and associated personal data
• Withdraw consent where we rely on consent to process your information
• Receive your data in a structured, portable format
• Complain to the Privacy Commissioner of Canada if you believe we have violated your privacy rights

To exercise any of these rights, contact us using the information below. We may ask you to verify your identity before responding.

11. Third-Party Services

We use the following third parties to operate the Service:

• Supabase — database, authentication, and file storage
• Cloudflare — content delivery, security, and coarse visitor location
• Hetzner — cloud server hosting
• Dodo Payments — payment processing for Premium subscriptions
• Resend — transactional, notification, and marketing email delivery
• Hunter — provider outreach campaigns
• Google Calendar — calendar invitations for collaboration bookings
• Riverside — recording platform for collaboration sessions
• WhatsApp — coordination groups for collaborations (with your consent)
• Discord — community platform

These third parties have access to your Personal Data only to perform tasks on our behalf and are obligated not to disclose or use it for any other purpose. We encourage you to review their privacy policies.

12. Links to Other Sites

Our Service contains links to provider websites and other sites that are not operated by us. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites, including provider websites listed in our directory. We advise you to review the privacy policy of every site you visit.

13. Children's Privacy

Our Service does not address anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under 18. If you are a parent or guardian and believe your child has provided us with Personal Data, please contact us and we will take steps to remove that information.

14. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will post the new policy on this page and update the "Last Updated" date. For significant changes, we may also notify you by email if you have an account. Changes are effective when posted.

15. Contact Us

If you have any questions about this Privacy Policy, contact us:

• By email: [email protected]
• Through our Discord community server