# Privacy Policy — Medroxa

**Last updated:** July 13, 2026  
**Effective date:** July 13, 2026

## 1. Introduction and scope

This Privacy Policy describes how **Medroxa** (“**we**,” “**us**,” or “**our**”) collects, uses, discloses, retains, and protects information when you access or use the Medroxa clinical decision-support platform (the “**Service**”).

This policy applies to:

- Individual clinician accounts (B2C)
- Organization-sponsored accounts, including **Team** and **Enterprise** deployments (B2B / B2B2C)
- Visitors to our website and public legal pages

**Medroxa is a clinical decision-support tool, not a medical device or licensed healthcare provider.** This document is a technical compliance template. Consult qualified legal counsel for binding compliance in your jurisdiction.

---

## 2. Roles: controller, processor, and business associate

Depending on how you use the Service, privacy roles differ:

| Deployment | Typical role of your organization | Typical role of Medroxa |
|------------|-------------------------------------|-------------------------|
| **Individual / self-serve account** | You are the data controller for account and clinical input data | Medroxa acts as a **processor** on your instructions |
| **Enterprise / covered-entity deployment** | Your organization is the **covered entity** or **business associate** for PHI | Medroxa acts as a **business associate** or **subprocessor**, as defined in your executed **BAA** and/or **DPA** |

Where your organization is the controller, you are responsible for:

- Determining lawful basis for processing health-related data
- Issuing workforce policies and access approvals
- Executing required agreements (BAA, DPA) before PHI is submitted
- Responding to data-subject requests unless contractually delegated to Medroxa

Enterprise customers may execute a separate **Data Processing Agreement (DPA)** and **Business Associate Agreement (BAA)** that supplement this policy.

---

## 3. Information we collect

### 3.1 Account and identity data

- Email address, display name, and authentication provider identifier (local password hash, or Google Sign-In profile fields)
- Account creation and last-updated timestamps
- Session identifiers (HttpOnly cookies)
- Plan tier, subscription status, and usage counters (daily queries, monthly vision uploads)

### 3.2 Clinical and health-related input (special-category data)

When you use clinical tools, you may submit:

- Medication lists, allergies, conditions, lab values, and free-text clinical notes
- Prescription or medical document **images** (OCR / imaging tools)
- **Audio** recordings for speech-to-text (Ask Box, AI Medical Recorder)

**Default deployment:** Clinical content entered in tool forms is processed in **server memory for the duration of the request** and is **not stored in a clinical database** unless explicitly configured in an enterprise deployment.

### 3.3 Billing and payment metadata

For paid plans processed through **Stripe**:

- Stripe Customer ID and Subscription ID (stored by Medroxa)
- Billing email and plan interval (monthly/annual)
- **Payment card data is collected and processed solely by Stripe** (PCI DSS). Medroxa does not store card numbers, CVV, or full PAN.

### 3.4 Technical, security, and audit data

- IP address, request timestamps, and API endpoint identifiers
- Audit log events: authentication outcomes, tool usage type, model name, image/audio presence flags — **without clinical prompt text by default**
- Browser `localStorage` preferences (theme, layout, consent version flags)
- Browser-session result history (client-side, per plan limits)

### 3.6 Prescriber credentials (prescription generation)

When you use the prescription generation tool, you may submit:

- **NPI** (National Provider Identifier) — validated against the CMS NPPES public registry
- **DEA number** (optional) — format and checksum validated only; active registration is not confirmed
- **State license** and **prescriber name** — self-declared; not verified against state medical boards

Validated identifiers are stored in audit logs as **cryptographic hashes** (not plaintext). Masked NPI values (last four digits only) may appear in AI prompts. This workflow is **not** legal electronic prescribing (EPCS) or prescriber identity proofing.

### 3.5 Data we do not intentionally collect

- Social Security numbers or government ID numbers (unless you enter them in free text — **prohibited**)
- Direct patient identifiers when de-identification mode is used as designed
- Analytics or advertising tracking pixels on clinical workflows (none deployed by default)

---

## 4. How we use information

We process information to:

| Purpose | Examples |
|---------|----------|
| **Provide the Service** | Run AI clinical decision-support, OCR, transcription, and reference tools |
| **Authenticate users** | Sign-in, session management, Google OAuth |
| **Enforce entitlements** | Plan limits, controlled-substance blocks, prescriber verification |
| **Billing** | Subscription checkout, renewal, Customer Portal |
| **Security & compliance** | Rate limiting, audit logging, abuse prevention |
| **Support** | Respond to account, billing, and compliance inquiries |

We do **not** use clinical content to train foundation models unless explicitly agreed in a separate enterprise contract.

---

## 5. Lawful basis and consent (summary)

| Jurisdiction | Typical basis |
|--------------|---------------|
| **GDPR (EU/EEA)** | Explicit consent for special-category health data (Art. 9); contract performance for account/billing |
| **HIPAA (US)** | Authorization via BAA and covered-entity policies when PHI is processed |
| **Iran e-commerce / consumer law** | Notice and consent before collecting personal/health data; data minimization |
| **FTC / US consumer** | Privacy practices consistent with published policy; no deceptive health claims |

You accept this policy and linked documents when you sign in, register, continue with Google, or submit a clinical analysis. See the [Clinical Data Consent](/legal/clinical-data-consent.md) page for the consent summary.

---

## 6. Third-party subprocessors

Depending on server configuration, information may be processed by:

| Subprocessor | Purpose | Data categories | Location / notes |
|--------------|---------|-----------------|------------------|
| **Microsoft Azure OpenAI** | AI text and vision analysis | Clinical prompts, uploaded images | Your configured Azure region; requires eligible **Microsoft BAA** for PHI |
| **Azure OpenAI Whisper / OpenAI API** (optional) | Speech-to-text | Audio files (transient) | Configured deployment region; audio deleted from server memory after transcription |
| **Google Sign-In** (optional) | Authentication | Name, email, Google account ID | Google infrastructure |
| **Stripe** (optional) | Subscription billing | Billing email, payment method (PCI by Stripe) | Stripe global infrastructure |
| **Cloud hosting provider** (e.g., Azure App Service) | Application hosting | Session, audit, account metadata | Per deployment configuration |

Active processors are disclosed on the [Clinical Data Consent](/legal/clinical-data-consent.md) page before clinical data is submitted.

**Enterprise customers** may request:

- A current subprocessor list
- **60 days' notice** before material subprocessor changes (where contractually required)
- Restrictions on cross-border transfers via SCCs or regional deployment

---

## 7. International data transfers

If data is processed outside your country, we rely on appropriate safeguards where required, including:

- **Standard Contractual Clauses (SCCs)** with processors
- **Regional Azure deployments** selected by the customer
- **Microsoft and Stripe** data processing terms

Your organization is responsible for assessing transfer mechanisms for PHI under HIPAA and applicable local law.

---

## 8. Retention

| Data type | Default retention |
|-----------|-------------------|
| Clinical tool input | **Request duration only** (in-memory); not persisted to clinical DB by default |
| Account profile (`users.json` or enterprise DB) | Until account deletion or as required for tax/legal records |
| Audit logs | Per `AUDIT_LOG_PATH` / enterprise policy; **no clinical text** by default |
| Stripe billing records | Per Stripe retention and tax requirements |
| Browser `localStorage` | Until user clears storage or signs out |
| Client result history | Per plan tier (e.g., session-only on Free; up to 90 days on paid tiers) |

Enterprise deployments may configure custom retention, export, and deletion schedules in the DPA.

---

## 9. Security measures

We implement administrative, technical, and organizational measures including:

- **Mandatory authentication** for all clinical features
- **HttpOnly, Secure session cookies** with configurable session expiry (`SESSION_MAX_AGE_HOURS`)
- **Rate limiting** on authentication and sensitive API endpoints
- **HTTP security headers** (CSP, frame protection, HSTS in production)
- **Password strength validation** and salted hashing for local accounts
- **Controlled-substance blocking** on prescription tools
- **Audit logging** of access events without clinical content by default
- **TLS encryption** in transit; encryption at rest per hosting configuration

No system is 100% secure. Report suspected incidents to the contact in Section 14.

---

## 10. Your rights

Depending on your jurisdiction, you may have rights to:

- **Access** personal data we hold about your account
- **Rectify** inaccurate account information
- **Erase** account data (subject to legal retention exceptions)
- **Restrict** or **object** to certain processing
- **Data portability** for account metadata
- **Withdraw consent** for health-data processing (stops future processing; does not retroactively invalidate prior lawful processing)

**How to exercise rights:**

- **Individual users:** Contact us at the details in Section 14
- **Enterprise users:** Contact your organization's system administrator or privacy officer first; Medroxa will assist the controller as required by DPA/BAA

**Withdraw consent in-app:** Sign out, clear browser storage, and cease submitting clinical data.

---

## 11. Breach notification

We will notify affected customers and, where required by law, supervisory authorities of a personal data breach without undue delay and in accordance with applicable timelines (e.g., **72 hours** under GDPR where feasible; **60 days** under HIPAA BAA for covered entities).

Enterprise contracts may specify dedicated security contact channels and incident response procedures.

---

## 12. Children's privacy

The Service is intended for **authorized healthcare professionals and pharmacy staff aged 18+**. We do not knowingly collect data from children under 13 (or under 16 in the EU without parental consent). Contact us if you believe a minor has provided data.

---

## 13. Changes to this policy

We may update this policy to reflect product, legal, or regulatory changes. Material changes will be posted on this page with an updated **Last updated** date. Continued use after notice constitutes acceptance where permitted by law. Enterprise customers with executed agreements may receive direct notice per contract terms.

---

## 14. Contact

**Privacy and compliance inquiries**

**Mohammadamin Asadirad**  
Cell: (209) 684-2978  
Cell: (925) 529-2345  
Email: [support@medroxa.com](mailto:support@medroxa.com)

For enterprise BAA/DPA execution, security incidents, or subprocessor questions, use the subject line **“Medroxa Privacy / Compliance.”**

---

## 15. Related documents

- [Terms of Service](/legal/terms-of-service.md)
- [Clinical Data Consent](/legal/clinical-data-consent.md)
- [Legal Notices & Disclaimer](/legal/legal-notices-disclaimer.md)
- [Business Associate Agreement (BAA)](/legal/baa-agreement.md)

---

*This document is a technical compliance template. It does not constitute legal advice. Consult qualified legal counsel for binding compliance decisions.*