The company has continued to promote the idea of a nationwide service, with online posts claiming the service “is available in all 50 states.” When asked exactly how large its network is, Massoumi told MIT Technology Review that Dr. B does not have nationwide coverage but has around 600 vaccination partners across 37 states—although the company declined to say who they are, or which states it is active in. And those partnerships do not include national-level agreements with major chains such as CVS or Walgreens, which both said they were not working with Dr. B at a corporate level, though Massoumi says some individual stores are Dr. B providers. Six hundred partners may seem extensive, but it accounts for less than 1% of the more than 80,000 US vaccination sites tracked by the CDC. 

Dr. B’s limited presence may come as a surprise, given its founder’s experience in digital health services. Massoumi previously cofounded Zocdoc, a popular online appointment search and booking site, and served as its CEO. He left Zocdoc in 2015 and went on to start Shadow, an app that helps reunite lost pets with their owners. While Dr. B—which Massoumi says he is funding himself—does not charge either users or partners for its services, it now has at least 56 employees, including a team of 30 organizers, most with a background in politics. In February it expanded even further, acquiring another waitlisting service, Vax Standby.

Despite this heavy investment, however, Dr. B’s footprint is apparently so small that Claire Hannan, the executive director of the Association of Immunization Managers, which represents and coordinates state vaccine campaigns across the entire country, says she was not even aware of Dr. B until she was interviewed for this story. In fact, says Hannan, the entire idea of a digitized waitlisting service is one that overwhelmed vaccination sites would have found hard to adopt.

“Getting providers to use a new reporting system or a new scheduling system, a new IT interface—that’s much more of a challenge than getting them to agree to accept and give the vaccine,” she says.

Private data vs. public health

Dr. B is one of many private efforts that we’ve seen emerge to fill the gaps in America’s health system, from the private covid-19 testing sites that have overtaken strip malls to health-care tech companies entrusted to schedule vaccine appointments. With all these developments, it’s become harder for consumers and patients to differentiate between public pandemic response and for-profit entities. Crowdsourced resource lists regularly mention Dr. B’s waitlist signup, for example, alongside official public health websites, the federally operated Vaccines.gov, notices from health-care providers, and other medical services.

But public health departments and private companies have different reasons for existing, even if the stated missions sound similar.

“The incentives are the opposite,” says Elizabeth Renieris, a tech and human rights fellow at the Harvard Kennedy School’s Carr Center. “Public health and public interest concerns traditionally are not driven by profit or growth, or speed or efficiency, or any of those values.”

“The famous saying in business is, if you’re not paying, you’re the product,” says Kayte Spector-Bagdady, associate director of the Center for Bioethics and Social Sciences in Medicine at the University of Michigan. “Weight tracker apps will help you track your weight, or fertility applications will help track your cycle. But the business model is really being able to sell that data out the back end.”

There are rules in place under HIPAA, the Health Insurance Portability and Accountability Act, intended to stop oversharing of health data. But if a company is not one of the “covered entities,” then the rules don’t apply, and there is a well-established business model for private health companies that relies on collecting consumer health data and selling it or sharing it with third parties. 

“The vast majority of these private-sector companies providing these tools are not going to be HIPAA-covered entities,” Renieris says. “It’s this displacement of the public interest by the private sector.”

Because Dr. B itself does not provide care, it is one of those entities not covered by HIPAA, and the data it collects falls outside the law’s protections. That means when people sign up for Dr. B’s services, their health information is not protected by HIPAA, but by whatever is outlined in the site’s privacy policy.

The FAQ section of Dr. B’s website says that thanks to its staff’s “decades” of experience dealing with HIPAA, it voluntarily adheres to those standards when storing and sharing user data, including encrypting the information. And its privacy policy does lay out some comprehensive-sounding protections. The website says it does not sell information that would identify people, and only shares users’ personal information with providers once they’ve opted in to receive a vaccine nearby. It also gives users the option to request that their personal data be deleted by sending a sequence of text messages to the service (although that fact is found halfway down the privacy policy page, and couched in legalese). 

But the policy also gives Dr. B the right to use personal data internally for purposes other than vaccinations and, if the company gets bought, to transfer the data to the new owner. The company declined to say what happens to information from users who opt out of vaccine notifications, and its policy is equally silent on the issue.

Such collected information can be lucrative. The zip code you live in and whether you have asthma can be valuable for advertisers marketing treatments; private or industry-sponsored researchers looking to recruit study participants might want a list of people with autoimmune disorders. And though many Americans are used to giving up data in the age of invasive tracking by tech giants, Spector-Bagdady says health data is different from, say, information on what kinds of clothes you like to wear.

“There are only so many pairs of mom jeans that I can purchase, but if you have health data from millions of people who have insurance, to whom you can advertise and target very expensive drugs that the insurance will cover, then you’re into some really profitable areas in terms of drug development, drug marketing, algorithmic and machine-learning developments,” she says.

Some Dr. B users I spoke to said that they expect information about themselves to be shared among private companies. But others said they were so desperate to protect themselves and loved ones that they didn’t even consider what information they were handing over when they signed up.

Renieris says it’s hard enough in normal times to ask people to investigate every digital interaction to make sure they know what they’re signing up for and who they’re giving their data to. Add in the fear and urgency of a pandemic and it’s even more of a burden on the consumer. 

“You begin to sign up for anything at that stage,” says Menendez, the Facebook group administrator. “I think that logic kind of goes out of the window.”

Going straight to the source

Without any evidence that Dr. B was successfully rerouting leftover doses, I still had questions, so I contacted the company to organize a conversation with its founder. 

On May 17, I interviewed Massoumi over Google Meet. He was accompanied by his communications team, including at least one representative from a public relations firm specializing in crisis communications. During the course of our conversation, Massoumi talked about learning from Dr. B’s “highly scalable” system and said that the company had a commitment to equitable distribution of vaccines, but he refused to say how many patients had been vaccinated through Dr. B. 

While the company was happy to publish the number of signups it had on its website, he claimed that revealing vaccination numbers would violate user privacy.

Massoumi said Dr. B is committed to data privacy, reiterating the company’s claim that its staff’s previous experience with HIPAA means it understands how to protect user data. 

“Just because we’re not a covered entity under HIPAA doesn’t mean that we can’t hold our service providers to high standards of patient privacy,” he said. 

The company has already navigated the transfer of user data on at least one occasion. When Vax Standby, the competing covid-19 vaccine waitlist, announced it was ceasing operations and merging with Dr. B, Vax Standby’s founders publicly promised to keep user data separate and not to automatically place its subscribers on Dr. B’s waitlist. Massoumi said he respected Vax Standby’s move, but that it wasn’t ideal.

“I don’t think that was in the public health interest,” he said. “I think many of those people could have benefited from the platform that we built.” (He added that Vax Standby user data was eventually deleted without being transferred.)

Some Dr. B users had told me that data sharing was an issue for them only in hindsight. They said how panicked they had become as vaccination slots seemed nonexistent, and how little attention they paid to the personal information they were handing over. 

“I appreciate the fact that if perhaps an evil person was running this company, that they could do a lot of evil things in the world,” Massoumi said. “I assure you, that’s not my reason for doing this.”

I asked Massoumi more questions about how desperation may have driven people to sign up for services without scrutinizing them. But he began discussing a different topic instead: the number of Americans who do not have health insurance. When pressed, Massoumi ended the conversation.

“I don’t have time to get into it with you,” he said before leaving the call.

“A bizarre attempt”

After our interview, I sent a list of 20 questions to Dr. B representatives to request more information. My queries revolved around the company’s basic business model, its activities, and its privacy policies—and included a request for key details that Massoumi had earlier said he would provide.

Building new technologies is a hard job that has been dramatically complicated by the pandemic, but these were typical questions about its operations that any startup might expect. We asked how many vaccine notifications the company had sent out; how many people had received a vaccine through the service; and whether it had consulted with health-care providers about the service’s usefulness. We also asked what the business model for this free service was, and whether it would seek outside funding in the future.

Dr. B refused to share even basic information about its operations. Instead, the company sent back the following statement, claiming that our inquiries were a “bizarre attempt” to question Dr. B’s attempts to get people vaccinated. 

“Dr. B was created during the height of the covid-19 crisis with the clear mission to save lives by rapidly getting vaccines into as many arms as possible because too many vaccines go to waste,” it said. “This important effort reflects the need to make vaccine distribution efficient and equitable and meet the urgent needs of underserved communities to help bring the pandemic to an end. 

“We are proud to have helped nearly 2.5 million people sign up for notifications about immediately available vaccines through hundreds of providers nationwide. So we are entirely flummoxed by this bizarre attempt to treat such a civic-minded endeavor as anything other than a genuine and committed effort to remove barriers that prevent people from getting vaccinated.

“From day one we understood the importance of protecting users’ data and that is why we have developed robust policies and practices to keep their information private and secure. Our privacy policy makes it clear that user data is never rented, sold or shared with any third party inappropriately. As a completely opt-in service, users have the ability to permanently delete their data from Dr. B at any time.”

Solving a temporary problem?

There is no doubt that Dr. B tapped into a very real issue when it launched: at the time, finding an available appointment was impossible for all but the most internet savvy or well-connected. With so many people struggling to get a vaccine, even whispers of leftover doses that might be trashed were enough to cause anger and confusion.

Manual and digital systems started to proliferate to address the issue: pharmacies set up their own paper waitlists, and alongside Dr. B and Vax Standby, there were digital services like VaccinateCA, a crowdsourced effort to spot open slots in California, and TurboVax, a viral Twitter bot that shared available appointments online as they dropped.

For many people, stories of leftover—or, worse, wasted—vaccines were a particularly painful and visible example of health systems failing. But as vaccine supplies expanded, that moment quickly passed. Hannan, of the Association of Immunization Managers, says waste has actually been minimal compared with what’s accepted in other mass vaccination initiatives. The federal Vaccines for Children program, which provides kids with shots regardless of their family’s ability to pay, has an expected wastage rate of 5%, she says. Data about covid vaccines obtained by Kaiser Health News, meanwhile, show that the CDC recorded 182,874 covid vaccines thrown out in the first three months vaccinations were available—just 0.1% of the more than 147.6 million doses administered as of March 30. According to CDC data, 70% of recorded covid-19 vaccine wastage happened at CVS and Walgreens—both companies that confirmed they have no national-level partnerships with Dr. B.

As vaccines have grown easier to access, some broker services have shuttered. Cities like Philadelphia are asking residents to take themselves off local lists, and TurboVax, the Twitter bot, announced on May 11 that it was winding down.

The willingness of people to help strangers find vaccines—like Joanie Schaffer, the volunteer who tried using Dr. B to help people in New York, and other community efforts—has been a small sliver of hope in an otherwise terrible year. And those who have benefited from such kindness have made their gratitude known. When TurboVax creator Huge Ma said he was closing the service, he was overwhelmed by thousands of tweets, retweets, and responses.

“Thank you for everything you did for the community,” said one follower. “Thank you for helping my wife and me get our first shots!” wrote another. (Indeed, TurboVax followers showed their appreciation by raising more than $200,000 for small businesses in New York’s Chinatown when Ma asked for help amid rising anti-Asian violence.)

I looked through Dr. B’s feed for similar expressions of thanks from grateful, vaccinated users, and found none. But unlike its peers, the company has no plans to shut down even though the appointment crunch has largely passed. Instead, Massoumi and the company say they are looking to what comes next. He says maybe they’ll collaborate with mobile vaccination clinics, or focus on booster shots. And now that the vaccination chaos has largely passed in the US? He wants to take Dr. B overseas. After all, he told me during our interview, the US effort has come so far. “We’ve touched millions of people,” he said.

This story is part of the Pandemic Technology Project, supported by The Rockefeller Foundation.