Privacy Policy

2. Information We Collect

Personal Information

We collect information that identifies, relates to, or could reasonably be linked with you, including:

• Name, email address, phone number, and contact information
• Professional credentials and license information
• Organization or practice information
• Payment and billing information
• Communication preferences

Protected Health Information (PHI)

As a healthcare technology platform, we handle Protected Health Information in accordance with HIPAA regulations, including:

• Patient medical records and treatment information
• Injury reports and documentation
• Medical billing and insurance information
• Case-related health data

SMS and Text Messaging

When you provide your phone number to us, we may send you text messages (SMS) related to our services. By providing your phone number verbally during a consultation or demonstration, you provide your verbal consent to receive these communications. Please review our full SMS & Text Messaging Consent Policy for more details.

• Consent is obtained verbally or through our platform interfaces
• You can opt out at any time by replying "STOP" to any message
• Msg&Data rates may apply

Usage Information

We automatically collect certain information about your device and how you interact with our platform:

• IP address, browser type, and device information
• Usage data, access times, and pages viewed
• Clickstream data and navigation patterns
• Performance and error logs

3. How We Use Your Information

We use the collected information for various purposes:

• To provide, maintain, and improve our services
• To process transactions and send related information
• To facilitate communication between healthcare providers, attorneys, and patients
• To send administrative information, updates, and security alerts
• To respond to your comments, questions, and provide customer support
• To monitor and analyze usage trends and platform performance
• To detect, prevent, and address technical issues and security threats
• To comply with legal obligations and enforce our terms

4. HIPAA Compliance

MediFlow 360 is committed to full compliance with the Health Insurance Portability and Accountability Act (HIPAA). We implement comprehensive administrative, physical, and technical safeguards to protect Protected Health Information:

• End-to-end encryption for data in transit and at rest
• Role-based access controls and authentication
• Regular security audits and risk assessments
• Business Associate Agreements with all relevant third parties
• Comprehensive audit logging and monitoring
• Employee training on HIPAA requirements

5. Information Sharing and Disclosure

We may share your information in the following circumstances:

• With Your Consent: When you authorize us to share information
• Service Providers: With vendors who perform services on our behalf under strict confidentiality agreements
• Healthcare Coordination: Between authorized providers, attorneys, and relevant parties involved in a case
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Protection of Rights: To protect the rights, property, or safety of MediFlow 360, our users, or others

6. Data Security

We implement industry-standard security measures to protect your information:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• Multi-factor authentication options
• Regular security vulnerability assessments
• Intrusion detection and prevention systems
• Secure data centers with 24/7 monitoring
• Regular backups and disaster recovery procedures

7. Your Rights and Choices

You have certain rights regarding your personal information:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your information (subject to legal requirements)
• Portability: Request a copy of your data in a portable format
• Opt-Out: Unsubscribe from marketing communications
• Analytics Opt-Out: Turn off Google Analytics on our website at any time using the "Your privacy choices" link in the site footer. Visitors from the European Economic Area, the United Kingdom, and Switzerland are not tracked by analytics unless they accept cookies. See our Cookie Policy for details.
• Restriction: Request limitation on how we use your information

Note: Protected Health Information is governed primarily by HIPAA and your healthcare provider's Notice of Privacy Practices. See our HIPAA Notice for PHI-specific rights.

Your California Privacy Rights (CCPA / CPRA)

This section provides additional information for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"). This section does not apply to information regulated by HIPAA, the Confidentiality of Medical Information Act, or other healthcare-specific laws, which are addressed in our HIPAA Notice of Privacy Practices.

Categories of Personal Information We Collect

In the past 12 months, we may have collected the following categories of personal information:

• Identifiers (name, email, phone, postal address, IP address, account identifiers).
• Customer records as defined in Cal. Civ. Code § 1798.80 (e.g., contact and billing information).
• Commercial information (subscription plan, purchase history).
• Internet/network activity (device data, log files, browser type, pages viewed, interactions).
• Geolocation (general, derived from IP address). Our website looks up the country of your IP address to decide whether to ask for cookie consent; the address is not stored for this. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
• Professional/employment information (license, role, organization).
• Inferences drawn from the above (e.g., to personalize the user experience).
• Sensitive personal information (account credentials and, where you provide it through the platform, health-related information). We do not use sensitive personal information for purposes that would trigger your right to limit its use under CPRA § 1798.121.

Sources

We collect personal information directly from you, from your employer or the provider/firm operating your account, from your device when you interact with our Services, and from service providers and analytics partners.

Business Purposes

We use personal information to operate, maintain, secure, and improve the Services; provide customer support; communicate with you; process payments; detect and prevent fraud; comply with legal obligations; and as otherwise described in Section 3 above.

Categories of Third Parties

We disclose personal information for business purposes to service providers and contractors (hosting, analytics, customer support, payment processing, communications), to professional advisors, to authorized providers and attorneys involved in a case, and as required by law.

"Do Not Sell or Share My Personal Information"

We do not "sell" personal information for money. We also do not "share" personal information for cross-context behavioral advertising as those terms are defined under CCPA/CPRA. We honor opt-out preference signals such as the Global Privacy Control (GPC) received from a browser as a valid request to opt out of sale and sharing for that browser, and we also turn off analytics on that browser. To submit a separate opt-out request, email support@mediflow360.com.

"Shine the Light" Disclosure

California Civil Code § 1798.83 permits California residents to request, once per year, information regarding the disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes.

Your CCPA/CPRA Rights

• Right to Know what personal information we collect, use, disclose, and (if applicable) sell or share.
• Right to Delete personal information we have collected, subject to legal exceptions.
• Right to Correct inaccurate personal information we maintain about you.
• Right to Data Portability — to receive a copy of your personal information in a portable, readily usable format.
• Right to Opt-Out of any sale or sharing of personal information.
• Right to Limit Use of Sensitive Personal Information where applicable.
• Right to Non-Discrimination — we will not deny services, charge different prices, or provide a different level of quality because you exercised any of these rights.

How to Submit a Request

Submit verifiable consumer requests to support@mediflow360.com with the subject "CCPA Request," or call 888-348-9348. We will verify your request using information already in our possession (such as your account email and recent activity). We respond within 45 days, extendable once by an additional 45 days where reasonably necessary.

Authorized Agents

You may designate an authorized agent to submit a request on your behalf. We will require (a) written authorization signed by you, or proof that the agent has power of attorney under California Probate Code §§ 4000–4465, and (b) verification of your own identity directly with us.

8. Data Retention

We retain your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Healthcare-related data is retained in accordance with HIPAA requirements and applicable state laws.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.