MCMDLL LLC d/b/a Doctoloop
Last Updated: November 1, 2026
1. Introduction
MCMDLL LLC, doing business as Doctoloop ("Doctoloop", "we", "our" or "us"), respects your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with and the choices you have.
It applies to information we collect through www.doctoloop.com and its subdomains, the Doctoloop patient portal, doctor portal and society portals, our emails and other electronic communications, and any form, tool or service that links to this Privacy Policy (together, the "Platform").
It does not apply to information collected offline, through websites we do not operate, or directly by a healthcare provider outside the Platform. Providers keep their own privacy practices and, where applicable, their own Notice of Privacy Practices.
2. Who uses the Platform
- Patients: people who search for, match with, book and pay independently licensed healthcare professionals, and keep their health records on the Platform.
- Physicians and other Providers: independently licensed healthcare professionals ("Providers") who publish a profile, manage their practice in the doctor portal and may join one or more private societies.
- Society members: Providers admitted to a Doctoloop private society (for example Well Women, Young Athlete Health Society, The Survivorship Society, The Concierge Society, Mind Care Loop).
- Founding Partners: service providers (for example law firms, billing companies, credentialing, imaging, staffing) listed inside the societies.
3. Doctoloop does not provide medical care
MCMDLL LLC is not a medical group and does not practice medicine. We do not diagnose, treat or provide telemedicine services. Clinical services are provided solely by Providers. Doctoloop provides the technology Providers and patients use to find each other, schedule, communicate, pay and keep records.
4. Information we collect
4.1 Account information (all users)
Name, email address, phone number, password (stored in hashed form), role, communication preferences and correspondence with our team.
4.2 Patient information
- Profile: date of birth, gender, postal address, insurance information, emergency contact.
- Matching preferences: the needs, specialties, visit types, location, language, availability and care preferences you enter to be matched with Providers.
- Appointments: bookings, appointment requests, visit type, time, Provider and payment status.
- Health information: the medical history you or your Providers enter (for example vitals and lifestyle, allergies, medications, conditions, family history, surgeries), documents you upload (for example lab results, imaging, reports), prescriptions and superbills issued by your Providers, visit summaries and Provider notes, and referrals between Providers that concern you.
- Consents: the consents you give or withdraw in your profile.
- Memberships: concierge membership plans you subscribe to with a Provider.
4.3 Provider information
- Application: identity, specialty, credentials, CV, NPI number, state licences and expiry dates, practice details and motivation.
- Public profile: photo, biography, education, training, certifications, publications, leadership roles, awards, peer endorsements, languages, accepted insurance, visit types and prices, availability, and reputation data we compile (for example a Doctoloop reputation score and ratings published on third-party sites such as Google, Healthgrades and Zocdoc).
- Practice data: schedule, time off, booking types and prices, team notification emails, office phone, documents issued to patients, concierge membership plans and payout information handled by Stripe.
- Calendar data: if you connect Google Calendar, see section 7.
4.4 Society and community information
Society membership and role, member directory entries visible to other members, chat messages (direct messages, group chats and public channels), event registrations and tickets, webinar registrations, and webinar recordings made with the speakers' consent.
4.5 Founding Partner information
Company name, contact details, services, the societies applied to, and billing information handled by Stripe.
4.6 Payment information
Payments are processed by Stripe. Doctoloop does not store full card numbers. We receive transaction records, such as amount, date, status and the last digits of the card.
4.7 Information collected automatically
IP address, device and browser type, pages visited, referring URLs, timestamps and similar usage data, collected through cookies and similar technologies (see section 8).
5. How we use information
- Operate the Platform, create and secure accounts.
- Match patients with Providers and display search results.
- Schedule appointments, create video visit links, send confirmations and reminders.
- Store and display health records to the patient and to the Providers who have a care relationship with that patient.
- Process payments, subscriptions and Provider payouts.
- Review Provider applications, verify licences and publish Provider profiles.
- Run the societies: directory, chat, events, webinars and Practice Resources.
- Publish content (articles, webinars, specialist pages) linked to the Providers who contributed to it, with their consent.
- Provide support, send service messages and, where permitted, marketing messages that you can opt out of.
- Protect the Platform, prevent fraud and abuse, and comply with legal obligations.
- Produce aggregated or de-identified statistics.
We do not sell personal information. We do not use health information for advertising.
6. Who can see your information
- Your Providers: a Provider can see a patient's health information only where a care relationship exists on the Platform (a booking, an appointment request, a referral or a document the Provider issued). Every access to health information is recorded in an audit log.
- Referrals: when a Provider refers a patient to another Provider on the Platform, the referral, its reason and any attachment are shared with the receiving Provider.
- Share links: when you share a document, we create a time-limited link. Anyone with the link can open the document until it expires.
- Public profiles: Provider profiles are public once reviewed and published by Doctoloop.
- Society members: the member directory, chat channels and event attendance are visible to members of the same society.
- Service providers: companies that process information for us under contract (see section 9).
- Legal and safety: where required by law, or to protect rights, safety and security.
- Business transfers: in connection with a merger, financing, acquisition or sale of assets, subject to this Privacy Policy.
- With your consent.
7. Google Calendar
Providers may connect a Google Calendar. When connected, Doctoloop reads the events in the selected calendar for the next 30 days, about every 10 minutes, and uses them only to block busy time slots on the Provider's Doctoloop schedule. Cancelled events release the slot. We do not read event content for any other purpose, we do not share calendar data with third parties, and we do not use it for advertising. Doctoloop's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Providers can disconnect at any time from the doctor portal.
8. Cookies, analytics and pixels
We use cookies and similar technologies to keep you signed in, remember preferences and understand how the Platform is used, including Google Analytics and Google Tag Manager. Our public marketing pages may also use advertising pixels, such as the Meta Pixel, to measure campaigns.
Advertising pixels are not used on logged-in patient pages or on any page where health information is entered or displayed, including the medical history, records, appointments and booking pages.
You can control cookies in your browser settings. Blocking some cookies may affect how the Platform works. The Platform does not currently respond to "Do Not Track" signals.
9. Service providers
We use the following categories of service providers, each bound by contract to use information only to provide their service to us:
- Hosting and storage: Amazon Web Services (including S3 file storage), Vercel, Netlify.
- Payments: Stripe, including Stripe Connect for Provider payouts.
- Video visits: Zoom.
- Calendar: Google (Google Calendar API).
- Email: Resend (transactional email) and HubSpot (CRM and marketing email).
- Content management: Sanity.
- Analytics: Google Analytics and Google Tag Manager; Meta (public pages only, see section 8).
- Workspace: Google Workspace.
10. Health information and HIPAA
Doctoloop is not a healthcare provider. When Providers use the Platform to store and exchange their patients' health information, Doctoloop hosts that information on their behalf and acts as their service provider, and as their business associate where HIPAA applies. We apply the safeguards described in section 12 to all health information on the Platform, whether or not HIPAA applies.
11. Children
Accounts may only be created by adults aged 18 or over. A parent or legal guardian may create a profile for their minor child and book appointments on the child's behalf. The parent or guardian is responsible for the information entered about the child. We do not knowingly allow children to create their own accounts. If you believe a child has created an account, contact privacy@doctoloop.com and we will delete it.
12. Security
We protect information with administrative, technical and organizational safeguards, including:
- encryption of files at rest in storage and encryption in transit (HTTPS);
- access to files only through short-lived, signed links;
- passwords stored in hashed form and sessions that expire;
- role-based access for patients, Providers, society members and administrators;
- an audit log of every access to health information;
- card data handled by Stripe, never by Doctoloop servers.
No system is completely secure. If we learn of a security incident affecting your information, we will notify you and the relevant authorities as required by law.
13. Data retention
We keep account information while your account is active. Health information is kept for as long as your account is active and as needed for your Providers to meet their record-keeping obligations, then deleted or de-identified. Payment records are kept as required by tax and accounting law. You can ask us to delete your account at any time (see section 14). Some information may remain in backups for a limited period, or where we must keep it by law.
14. Your choices and rights
- Access and correction: view and update most of your information in your account, or ask us.
- Deletion: ask us to delete your account and information, subject to legal retention obligations and to records your Providers must keep.
- Copy: download your documents from the records page, or ask us for a copy of your information.
- Consents: give or withdraw consents in your profile.
- Marketing: unsubscribe using the link in any marketing email.
- Calendar: Providers can disconnect Google Calendar at any time.
To make a request, email privacy@doctoloop.com. We will verify your identity before acting on it.
15. State privacy and health data laws
Residents of some U.S. states have additional rights, including New York (SHIELD Act), California (CCPA and Shine the Light) and states with consumer health data laws such as Washington, Connecticut and Nevada. These may include the right to know, access, correct or delete personal information, to withdraw consent to the collection or sharing of consumer health data, and to appeal a decision. We honor these rights as the law requires. Contact privacy@doctoloop.com to exercise them.
16. Changes to this Privacy Policy
We may update this Privacy Policy. We will post the new version with a new "Last Updated" date and, for material changes, notify account holders by email or on the Platform.
17. Contact
Email: privacy@doctoloop.com (or maylis@doctoloop.com)
MCMDLL LLC d/b/a Doctoloop
Registered address: 8 The Green, Suite R, Dover, DE 19901, USA
Mailing address: 120 East 85th Street #3E, New York, NY 10028, USA