Privacy policy

Who we are

OIG Exclusion Search is run by Harper (tryharper.app). It is a free search over public exclusion and debarment lists published by HHS OIG, GSA SAM.gov, CMS and state Medicaid agencies. You can use it on this website, through its API, or through an AI assistant connected to its MCP server, such as ChatGPT. None of these require an account.

What we record when you search

For each search we store the text that was searched (lowercased), how many results it returned, the filters used, which surface it came from (website, API or MCP), how long it took, the country and US state the request came from, and the hour it happened. We use this to learn what people look for and which lists they expect us to cover.

We do not store your IP address, a cookie, a session or an account with a search, so a stored search cannot be traced back to who ran it. For searches through the API or an AI assistant, the location we record is that of the service making the call, not yours.

Searches through ChatGPT and other AI assistants

When an assistant uses our MCP server, we receive only what the assistant sends to the tool: a name, an NPI, a state, filters or a record id. We do not receive your conversation, your account details or any identifier for you. Those searches are recorded as described above. Your assistant provider's own privacy policy covers what it does with your conversation.

Network information

To limit abuse, each request's IP address is used as the key of a short counter that expires within about two minutes. Our request logs record the method, path, response status, IP address, user agent and network (country and provider) of each request, and for a search, the length of the searched text but not the text. These logs are written while the request is handled and are not kept in any log storage we operate.

Website analytics

The website uses Umami, a cookieless analytics service, to count page views. Before anything is sent, the address of the page is stripped of its query string and of any record or profile id, so a searched name or a specific person's record is never sent to Umami. We also send a few events: the length of a search and how many results it returned, which list a record came from when one is opened, and which contact link was followed. The search text is never included. The API and the MCP server send nothing to Umami.

Email updates

If you sign up for updates, we store your email address, the kind of update you chose, any filter you saved (such as a state), the record id if you chose to watch one record, any organization or note you added, the page you signed up from, and when. We use it only to send what you asked for. Every message links to an unsubscribe page, and you can ask us to delete your details entirely.

You cannot subscribe to a name. Updates are about lists and published records, not about whether a particular person appears.

What we do not collect

We do not ask for or store Social Security numbers, health information, payment details or passwords, and we do not sell data, serve ads or build profiles of the people who use the search.

The records themselves

The exclusion records are public government data, republished with their source and the date we retrieved them. Pages about a named person are kept out of search engines. If a record is wrong or out of date, the corrections page explains how to tell us, and the terms explain what a match can and cannot establish.

Who processes the data

Cloudflare hosts the site, the API, the MCP server and the database. Umami processes the website analytics described above. We share data with no one else.

How long we keep it

Rate-limit counters expire within minutes. Stored searches and email signups are kept until we delete them; we have not yet set an automatic deletion period, and will update this page when we do. Email signups are deleted on request.

Contact

For any privacy question or to have your email details deleted, write to data@tryharper.app.