Privacy Policy — Medroxa

Last updated: July 13, 2026
Effective date: July 13, 2026

1. Introduction and scope

This Privacy Policy describes how Medroxa (“we,” “us,” or “our”) collects, uses, discloses, retains, and protects information when you access or use the Medroxa clinical decision-support platform (the “Service”).

This policy applies to: - Individual clinician accounts (B2C)

• Organization-sponsored accounts, including Team and Enterprise deployments (B2B / B2B2C)

• Visitors to our website and public legal pages

Medroxa is a clinical decision-support tool, not a medical device or licensed healthcare provider. This document is a technical compliance template. Consult qualified legal counsel for binding compliance in your jurisdiction.

---

2.

Roles: controller, processor, and business associate

Depending on how you use the Service, privacy roles differ:

Where your organization is the controller, you are responsible for:

• Determining lawful basis for processing health-related data

• Issuing workforce policies and access approvals

• Executing required agreements (BAA, DPA) before PHI is submitted

• Responding to data-subject requests unless contractually delegated to Medroxa

Enterprise customers may execute a separate Data Processing Agreement (DPA) and Business Associate Agreement (BAA) that supplement this policy.

---

3. Information we collect

3.1 Account and identity data

• Email address, display name, and authentication provider identifier (local password hash, or Google Sign-In profile fields)

• Account creation and last-updated timestamps

• Session identifiers (HttpOnly cookies)

• Plan tier, subscription status, and usage counters (daily queries, monthly vision uploads)

3.2 Clinical and health-related input (special-category data)

When you use clinical tools, you may submit:

• Medication lists, allergies, conditions, lab values, and free-text clinical notes

• Prescription or medical document images (OCR / imaging tools)

• Audio recordings for speech-to-text (Ask Box, AI Medical Recorder)

Default deployment: Clinical content entered in tool forms is processed in server memory for the duration of the request and is not stored in a clinical database unless explicitly configured in an enterprise deployment.

3.3 Billing and payment metadata

For paid plans processed through Stripe:

• Stripe Customer ID and Subscription ID (stored by Medroxa)

• Billing email and plan interval (monthly/annual)

• Payment card data is collected and processed solely by Stripe (PCI DSS). Medroxa does not store card numbers, CVV, or full PAN.

3.4 Technical, security, and audit data

• IP address, request timestamps, and API endpoint identifiers
  - Audit log events: authentication outcomes, tool usage type, model name, image/audio presence flags — without clinical prompt text by default

• Browser localStorage preferences (theme, layout, consent version flags)

• Browser-session result history (client-side, per plan limits)

3.6 Prescriber credentials (prescription generation)

When you use the prescription generation tool, you may submit:

• NPI (National Provider Identifier) — validated against the CMS NPPES public registry

• DEA number (optional) — format and checksum validated only; active registration is not confirmed

• State license and prescriber name — self-declared; not verified against state medical boards

Validated identifiers are stored in audit logs as cryptographic hashes (not plaintext). Masked NPI values (last four digits only) may appear in AI prompts. This workflow is not legal electronic prescribing (EPCS) or prescriber identity proofing.

3.5 Data we do not intentionally collect

• Social Security numbers or government ID numbers (unless you enter them in free text — prohibited)

• Direct patient identifiers when de-identification mode is used as designed

• Analytics or advertising tracking pixels on clinical workflows (none deployed by default)

---

4. How we use information

We process information to:

We do not use clinical content to train foundation models unless explicitly agreed in a separate enterprise contract.

---

5. Lawful basis and consent (summary)

You accept this policy and linked documents when you sign in, register, continue with Google, or submit a clinical analysis. See the Clinical Data Consent page for the consent summary.

---

6. Third-party subprocessors

Depending on server configuration, information may be processed by:

Active processors are disclosed on the Clinical Data Consent page before clinical data is submitted.

Enterprise customers may request:

• A current subprocessor list

• 60 days' notice before material subprocessor changes (where contractually required)

• Restrictions on cross-border transfers via SCCs or regional deployment

---

7. International data transfers

If data is processed outside your country, we rely on appropriate safeguards where required, including:

• Standard Contractual Clauses (SCCs) with processors

• Regional Azure deployments selected by the customer

• Microsoft and Stripe data processing terms

Your organization is responsible for assessing transfer mechanisms for PHI under HIPAA and applicable local law.

---

8. Retention

Enterprise deployments may configure custom retention, export, and deletion schedules in the DPA.

---

9. Security measures

We implement administrative, technical, and organizational measures including:

• Mandatory authentication for all clinical features

• HttpOnly, Secure session cookies with configurable session expiry (SESSION_MAX_AGE_HOURS)

• Rate limiting on authentication and sensitive API endpoints

• HTTP security headers (CSP, frame protection, HSTS in production)

• Password strength validation and salted hashing for local accounts

• Controlled-substance blocking on prescription tools

• Audit logging of access events without clinical content by default

• TLS encryption in transit; encryption at rest per hosting configuration

No system is 100% secure. Report suspected incidents to the contact in Section 14.

---

10. Your rights

Depending on your jurisdiction, you may have rights to:

• Access personal data we hold about your account

• Rectify inaccurate account information

• Erase account data (subject to legal retention exceptions)

• Restrict or object to certain processing

• Data portability for account metadata

• Withdraw consent for health-data processing (stops future processing; does not retroactively invalidate prior lawful processing)

How to exercise rights:

• Individual users: Contact us at the details in Section 14

• Enterprise users: Contact your organization's system administrator or privacy officer first; Medroxa will assist the controller as required by DPA/BAA

Withdraw consent in-app: Sign out, clear browser storage, and cease submitting clinical data.

---

11. Breach notification

We will notify affected customers and, where required by law, supervisory authorities of a personal data breach without undue delay and in accordance with applicable timelines (e.g., 72 hours under GDPR where feasible; 60 days under HIPAA BAA for covered entities).

Enterprise contracts may specify dedicated security contact channels and incident response procedures.

---

12. Children's privacy

The Service is intended for authorized healthcare professionals and pharmacy staff aged 18+. We do not knowingly collect data from children under 13 (or under 16 in the EU without parental consent). Contact us if you believe a minor has provided data.

---

13. Changes to this policy

We may update this policy to reflect product, legal, or regulatory changes. Material changes will be posted on this page with an updated Last updated date. Continued use after notice constitutes acceptance where permitted by law. Enterprise customers with executed agreements may receive direct notice per contract terms.

---

14. Contact

Privacy and compliance inquiries

Mohammadamin Asadirad
Cell: (209) 684-2978
Cell: (925) 529-2345
Email: support@medroxa.com

For enterprise BAA/DPA execution, security incidents, or subprocessor questions, use the subject line “Medroxa Privacy / Compliance.”

---

15. Related documents

• Terms of Service

• Clinical Data Consent

• Legal Notices & Disclaimer

• Business Associate Agreement (BAA)

---

This document is a technical compliance template. It does not constitute legal advice. Consult qualified legal counsel for binding compliance decisions.