Privacy Policy
1. Who we are & scope
MediFlow ("MediFlow," "we," "us") provides a clinic management console that lets healthcare practices run scheduling, charting, prescribing, and billing through a conversational interface. This policy explains what data we handle, why, and the choices you have.
For information a clinic enters about its patients, the clinic is the data controller and MediFlow acts as a data processoron the clinic's behalf, under the terms of our service agreement (and, where applicable, a Business Associate Agreement).
2. Information we collect
Account & clinic data
- Clinic name, specialty, working hours, and configuration.
- Team member names, email addresses, roles, and titles.
- Authentication data — password hashes (never plaintext) or Google sign-in identifiers.
Usage & technical data
- Log data such as actions taken, timestamps, and audit-trail entries.
- Device and browser information needed to deliver and secure the service.
- Aggregate usage metrics (e.g. AI message counts) used for billing and capacity.
3. Patient data & protected health information
When a clinic uses MediFlow it stores patient records — demographics, allergies, vitals, visits, diagnoses, prescriptions, lab results, documents, photos, and billing. This may constitute protected health information (PHI). We process it only to provide the service to the clinic and according to the clinic's instructions. We do not sell patient data, and we do not use it for advertising.
4. How we use data
- To operate, maintain, and secure the clinic console and its features.
- To authenticate users and enforce role-based access control.
- To generate drafts (prescriptions, notes, reminders) you review and confirm.
- To run safety checks such as allergy and drug-interaction warnings.
- To send appointment reminders and follow-ups where the clinic has enabled them.
- To maintain an immutable audit log for compliance.
- To provide support, billing, and to comply with legal obligations.
5. AI processing
Some features use large language models to draft clinical text and surface suggestions. Content sent for AI processing is used only to return a result to your clinic for that request. Outputs are drafts — nothing is committed to a record until a clinician reviews and confirms it. AI suggestions are decision support, not medical advice, and the responsible clinician remains accountable for every action.
7. Retention
We retain clinic and patient data for as long as the account is active or as needed to provide the service. A clinic can delete records at any time, and deleting the account purges its data (see Account & data deletion). Some records may be retained where required by law.
8. Security
We use encryption in transit, hashed credentials, tenant isolation so each clinic only sees its own data, role-based permissions, and audit logging. No system is perfectly secure, but we work to protect data with appropriate technical and organizational measures.
9. Your rights
Depending on your jurisdiction, you may have rights to access, correct, export, or delete personal data. Because the clinic controls patient records, patients should direct such requests to their clinic; MediFlow will assist the clinic in fulfilling them. Team members can contact us about their own account data.
10. Account & data deletion
A clinic administrator can permanently delete the entire account from Team & Permissions → Danger zone in the app. Deletion is irreversible: it purges every patient record, appointment, visit, invoice, document, team member, and audit entry belonging to the clinic. Backups, if any, are cycled out on our standard schedule. If you cannot reach the app, email us to request deletion.
11. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by the "last updated" date above and, where appropriate, communicated in-app.
12. Contact
Questions about privacy? Email [email protected].
This document is a general template and not legal advice. Clinics handling regulated health data should have it reviewed against the privacy and healthcare laws that apply to them (e.g. HIPAA, GDPR, India DPDP) before relying on it.