What this site stores.
The Next Right Step is a public directory and a newsletter. It is not a medical provider, and this page is not a HIPAA notice. We do not claim to be HIPAA compliant.
Newsletter email
The only place that asks for an email is the newsletter form. A signup record holds the email address, which page the form was on, which signup box was used, the time, and the browser user-agent string. When a Vercel Blob token is configured, that record is saved as a private object in Vercel Blob. The same record is also written to the application log so it can be recovered if Blob is unavailable.
When a Beehiiv API key is set, the email is also sent to Beehiiv, with the page path and the signup box, so the newsletter can be delivered. Beehiiv stores subscriber email addresses to send the newsletter. Beehiiv also records whether each email is opened and which links are clicked, so we can see what's useful. The publication id is this site’s publication unless BEEHIIV_PUBLICATION_ID overrides it. Blob keeps a private copy either way. If Blob saved the signup, the form still says it worked when Beehiiv is down or the key is missing. If neither Blob nor Beehiiv accepts the signup, the form says so and nothing new is kept. There is no inquiry form and no phone number field.
Aggregated analytics
Searches, navigator questions, profile clicks, compare clicks, category clicks, helpful votes, and the care quiz write an event with tags only: the kind of event, care-category ids, a county or town chosen from the directory filters, intent tags such as Medicare or discharge, whether a search returned nothing, whether an answer was low confidence, a helpful yes or no, and a result count.
The quiz does not ask for a name, email, or health-record number. Its event stores the recommended category ids, the intent tags, and the county if you picked one. The wording of your answers is not stored.
The question you type into the care navigator is not saved with the analytics event unless storage of those questions is turned on. That storage is off by default. When it is on, the saved question has already had Social Security numbers, medical-record numbers, and dates of birth removed, and only the first 280 characters are kept. The admin CSV export never includes the question text. Events are kept for 90 days unless ANALYTICS_RETENTION_DAYS says otherwise. They live in Vercel Blob when that token exists, in a local file during development, or in memory on Vercel when no token is set. Memory does not last past a new instance. A rate limit keeps a short-lived count of requests per IP in the server process. That count is not written into the analytics file.
Care navigator and AI
If you use the care navigator, the question is handled on this site first. Patterns that look like a Social Security number, a medical-record number, or a date of birth are replaced before anything else happens. The site does not try to detect personal names, so please leave names out.
When a model is enabled, the scrubbed question is sent through the Vercel AI Gateway to draft a paragraph from the directory passages already retrieved. On Vercel that gateway can authenticate without a separate API key. Set AI_DISABLED=1 and the reply is written on this server from the directory and the explainers, with no model call. Either way, the reply is general information, not medical advice and not a coverage decision.
Vercel Web Analytics
Vercel Web Analytics is the tool that counts visits in aggregate. It does not use cookies. It is separate from the tagged events above, and it is not tied to a newsletter email.
What stays on your device
The compare list, the saved hearts, and the text-size choice (A, A+, A++) are saved in your browser’s local storage. They are not sent to us. Staff who sign in to the admin dashboard get a session cookie. Public pages do not set an account cookie.
We do not sell data
We do not sell personal information. The Next Right Step is free for families. No facility, agency, or provider pays to be listed, ranked, or recommended, and we don't receive referral fees. If we ever accept a sponsor, that listing will be clearly labeled “Sponsored,” and this note will be updated. We do not share newsletter addresses with communities.
Asking for deletion
There is no public email address on this site. Use the newsletter page and include the email address you signed up with. We will delete that signup from Vercel Blob and, if it was forwarded, ask Beehiiv to remove it. Copies that already landed in host logs follow the host’s log retention. Analytics events are not tied to an email or an account, so there is no profile to look up. They age out after the retention window.