Privacy Policy

Introduction

MedNex ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal and health information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our healthcare platform, website, mobile applications, and related services (collectively, the "Services").

By using our Services, you consent to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use our Services.

Information We Collect

Personal Identifiable Information (PII)

We may collect the following personal information:

• Full name, date of birth, and gender
• Contact information (email address, phone number, mailing address)
• Social Security Number (when required for billing or insurance purposes)
• Emergency contact information
• Insurance and billing information
• Government-issued identification

Protected Health Information (PHI)

In accordance with HIPAA regulations, we collect and maintain:

• Medical history and health records
• Diagnosis and treatment information
• Prescription and medication data
• Laboratory and imaging results
• Clinical notes and care plans
• Insurance claims and billing records

Usage Data

We automatically collect information about how you interact with our Services:

• Device information (IP address, browser type, operating system)
• Log data (access times, pages viewed, links clicked)
• Location data (with your permission)
• Cookies and similar tracking technologies

How We Use Your Information

We use the information we collect for the following purposes:

• Providing medical services and coordinating patient care
• Scheduling and managing appointments
• Communicating test results and health information
• Processing billing, payments, and insurance claims
• Sending appointment reminders and follow-up notifications via SMS, email, or in-app messaging
• Improving our Services through analytics and research
• Complying with legal and regulatory requirements
• Preventing fraud and ensuring security

Information Sharing & Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

• With Your Consent: When you authorize us to share information with other healthcare providers or third parties
• For Treatment: With healthcare professionals involved in your care
• For Payment: With insurance companies and billing processors
• For Healthcare Operations: For quality improvement, training, and compliance activities
• Legal Requirements: When required by law, court order, or government regulations
• Business Associates: With HIPAA-compliant vendors who help us provide Services

Note: Phone numbers collected for SMS consent will not be shared with third parties or affiliates for marketing purposes.

Your Rights

Under HIPAA and applicable privacy laws, you have the following rights:

Data Deletion Requests

You may request deletion of your personal data by contacting us at privacy@mednexapp.com. Please note:

• We will verify your identity before processing deletion requests
• Requests will be processed within 30 days
• Some information may be retained as required by law (e.g., medical records retention requirements)
• Deletion of certain data may affect your ability to use our Services

Third-Party Services

Our Services may integrate with third-party services, including:

• Payment processors (Stripe)
• SMS and communication services (Twilio)
• Email services (AWS SES)
• Analytics services
• Cloud hosting providers (AWS)

These third parties have their own privacy policies, and we encourage you to review them. All our third-party partners are HIPAA-compliant and have signed Business Associate Agreements.

Security Measures

We implement industry-standard security measures to protect your information:

• SSL/TLS encryption for all data transmission (HTTPS)
• AES-256 encryption for data at rest
• Multi-factor authentication for account access
• Regular security audits and penetration testing
• 24/7 security monitoring and intrusion detection
• Secure data centers with physical access controls

In the event of a data breach, we will notify affected individuals and relevant authorities as required by law within 72 hours of discovery.

Children's Privacy

Our Services are not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically.