Privacy Policy

1. Introduction

This Privacy Policy describes how MDChat Inc. (“MDChat,” “we,” “us,” or “our”) collects, uses, discloses, and protects information about you when you use our website, mobile applications, and telehealth platform services (collectively, the “Services”). This Privacy Policy is incorporated into our Terms of Service. We are committed to respecting your privacy and the confidentiality of your health information.

2. Protected information and HIPAA

HIPAA status. MDChat is not a “covered entity” under HIPAA. However, MDChat acts as a “business associate” of the Medical Group and pharmacies when it creates, receives, maintains, or transmits Protected Health Information (“PHI”) on their behalf, and it uses and discloses PHI only in accordance with HIPAA and its Business Associate Agreements.

Protected information. Information you provide that is intended for diagnosis or treatment by the Medical Group or pharmacies is PHI and is protected under HIPAA and applicable state law, including medical history, symptoms, diagnoses, prescriptions, lab results, and communications with providers.

Registration and account information. Information you provide for account registration (name, email, phone, shipping address, billing information) is governed by this Privacy Policy and applicable state laws. Where MDChat holds this information on behalf of the Medical Group in connection with your treatment, it may also constitute PHI, and under certain state laws (including Washington, Nevada, and Connecticut) it may constitute “consumer health data” because it identifies you as a person seeking health services. We treat it accordingly.

Notice of Privacy Practices. The Medical Group has adopted a separate Notice of Privacy Practices describing how providers use and disclose PHI. By using the Services, you acknowledge receipt of this Notice.

Research and clinical trial recruitment. MDChat may use your health information to identify you as a potential candidate for clinical trials, research studies, or other research opportunities conducted by third-party research organizations, pharmaceutical companies, or clinical research organizations. We may query your health data against eligibility criteria provided by research partners, contact you about studies you may be eligible for, and share a Limited Data Set (excluding direct identifiers, per 45 CFR § 164.514(e)) with research partners under a Data Use Agreement for feasibility analysis and patient matching. We share your identifiable PHI with research partners only after you provide explicit, standalone authorization for each specific trial referral. You are under no obligation to participate, and declining will not affect your access to the Services or your treatment.

3. Information we collect

Information you provide directly: account and contact information (name, email, phone number, date of birth, shipping/billing address); demographic information (gender, age, state of residence); payment information (processed by third-party payment processors); health information (medical history, current medications, allergies, symptoms, height, weight, BMI, treatment goals, medical conditions, provided via intake forms); identity verification (a government-issued ID for prescription verification); photos and files you upload for medical evaluation; and communications with providers or customer support.

Information collected automatically: log data (IP address, browser and device type, operating system, access times, pages viewed, clickstream data); general location derived from IP address; usage data (features used, time spent, activity patterns); and cookies, web beacons, tracking pixels, and mobile advertising IDs used for analytics, personalization, and advertising, subject to the scope limits in Section 6.4.

Information from third parties: from advertising partners about your activity on other websites, so we can deliver relevant ads; from service providers who perform functions on our behalf (payment processing, analytics, shipping); and from a social media account you choose to connect.

4. How we use your information

We use the categories of information above for: product and service delivery (providing the platform, coordinating telehealth, processing prescriptions, shipping medications, facilitating provider consultations); business operations (billing, accounting, fraud prevention, security, legal compliance); product improvement, research, and AI training (using de-identified and aggregated data, de-identified per HIPAA standards before use); data commercialization (licensing or sharing de-identified and aggregated data only — never PHI or identifiable data — for AI training, research, market analysis, and product development); personalization; customer support; account and service communications; and, on our marketing site only and never using health information, marketing and advertising (see Section 6.4) and clinical-trial recruitment as described in Sections 2 and 6.7.

5. Artificial intelligence

5.1 AI-enhanced Services. MDChat uses AI technologies including AI-assisted intake processing and symptom assessment, clinical decision support reviewed by licensed providers, customer support automation, and analytics for service improvement. Where you interact with an AI-powered feature, the Services clearly disclose that you are interacting with artificial intelligence and not a human clinician.

5.2 HIPAA-compliant AI. Any AI processing involving PHI follows HIPAA. We require AI vendors who access PHI to sign Business Associate Agreements. AI does not make autonomous clinical decisions, and all AI-generated clinical outputs are reviewed by qualified healthcare professionals.

5.3 AI training and de-identified data. We may use data de-identified under HIPAA’s de-identification standards (Safe Harbor or Expert Determination) and other applicable law to train, develop, improve, and refine machine-learning models and other analytical tools, including sharing de-identified data with third parties for AI/ML training, research, and product development. Properly de-identified data is no longer PHI. We will not attempt to re-identify de-identified data, and we contractually require any recipient to commit not to re-identify it.

6. How we disclose your information

6.1 Medical Group and providers. We share your health information (including PHI) with the Medical Group’s licensed providers to enable them to evaluate your suitability for treatment, prescribe medications, and provide ongoing care.

6.2 Pharmacies. If a provider prescribes medication, we share your prescription information, name, address, and relevant health information with our pharmacy partners to fulfill your prescription.

6.3 Service providers. We share information with vendors who perform services on our behalf — payment processors, shipping companies, analytics providers, and hosting providers — bound by confidentiality obligations, and by Business Associate Agreements where they access PHI.

6.4 Advertising partners. We may share limited identifiers (such as hashed email addresses, cookie IDs, and mobile advertising IDs) with advertising partners to deliver and measure ads for MDChat on other websites and apps, subject to all of the following limits: advertising technologies operate only on our marketing website, and only after you have consented through our consent banner — they are never used on the patient application (app.mdchat.com), the intake, the patient portal, or checkout; we do not share PHI, health information, or any data derived from health information (conditions, symptoms, intake answers, treatments, or triage results) with advertising partners, and we do not build advertising audiences based on health information; and we honor opt-outs, including the Global Privacy Control signal, and actively remove opted-out individuals from advertising audiences.

6.5 SMS/text data. We do not sell, share, or rent mobile phone numbers or SMS consent information with third parties for their own marketing purposes, except with your consent or as permitted by law.

6.6 De-identified and aggregated data. We may use, disclose, license, and commercialize de-identified and aggregated data de-identified in accordance with HIPAA standards (45 CFR § 164.514(b)) and other applicable law, including sharing it with research institutions, AI/ML companies, and pharmaceutical companies for AI/ML training, outcomes research, market analysis, product development, and data licensing. We will not attempt to re-identify de-identified data, and we contractually require recipients to commit not to re-identify it.

6.7 Research partners and clinical-trial sponsors. We may share a Limited Data Set (excluding direct identifiers, per 45 CFR § 164.514(e)) with research partners under a Data Use Agreement that prohibits re-identifying or contacting you, for feasibility analysis, patient matching, and site selection. We share identifiable PHI with research partners only after you provide explicit, standalone written authorization for each specific trial or study, as required by 45 CFR § 164.508, which you may revoke at any time. When you express interest in a clinical trial, we may share your contact information and relevant health data with the trial sponsor or its designated recruitment partner to facilitate screening and enrollment.

6.8 Legal disclosures. We may disclose information when required by law, subpoena, or legal process, or to protect the rights, property, or safety of MDChat, our users, or the public.

6.9 Corporate transactions. In a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you by email before your information is transferred.

7. Your rights and choices

7.1 Access, correction, and deletion. You can access, correct, or delete your personal information by logging into your account at app.mdchat.com or emailing privacy@mdchat.com. We will respond within 45 days.

7.2 Opt out of marketing. Click “unsubscribe” in any marketing email, reply “STOP” to any SMS, or visit our Your Privacy Choices page.

7.3 Do not sell or share. Under the CCPA and similar state laws, you have the right to opt out of the “sale” or “sharing” of your personal information for advertising purposes. We do not sell or share identifiable health information or identifiable sensitive personal information. To opt out of the sale or sharing of your identifiable personal information, visit Your Privacy Choices or use the Global Privacy Control browser signal. Properly de-identified and aggregated data is not “personal information” under the CCPA.

7.4 Limit sensitive personal information. You have the right to limit our use of sensitive personal information (including health data) for purposes other than providing the services you requested, on our Your Privacy Choices page.

7.5 Authorized agents. You may designate an authorized agent to make privacy requests on your behalf. We require proof of authorization before accepting requests from agents.

8. State-specific privacy rights

8.1 California (CCPA/CPRA). California residents have the right to know what personal information is collected, request deletion, request correction, opt out of sale/sharing, limit sensitive PI use, and not be discriminated against for exercising these rights. Contact privacy@mdchat.com.

8.2 Other state privacy laws. Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Nevada, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have rights under their state privacy laws, which may include access, correction, deletion, portability, and opt-outs of targeted advertising, sale, and certain profiling. Some states, including Maryland, impose heightened restrictions on sensitive data, including a prohibition on selling identifiable sensitive data — we do not sell identifiable sensitive data. Contact privacy@mdchat.com.

8.3 Washington, Nevada, and Connecticut (consumer health data). For residents of these states, our Consumer Health Data Privacy Policy applies to health data not covered by HIPAA. If you are in the EU or UK, see our GDPR / UK-GDPR Notice.

8.4 Shine the Light (California). California residents may request information about our disclosure of personal information to third parties for direct marketing. We do not disclose personal information to third parties for their direct marketing purposes. Contact privacy@mdchat.com.

9. Data retention

We retain your information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Medical records are retained per state medical-record retention requirements (typically 7-10 years). Account information is retained for the duration of your membership plus a reasonable period for legal compliance.

10. Children

We do not knowingly collect personal information from anyone under 18. If we discover we have collected information from a minor under 18, we will delete it. If you are a parent and believe your child has provided us information, contact privacy@mdchat.com.

11. Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption of data in transit and at rest, role-based access controls, logging and monitoring of access to health information, workforce security training, and Business Associate Agreements with vendors who access PHI. No method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

12. Breach notification

If a breach of security affecting your unsecured identifiable health information occurs, you will be notified as required by applicable law, including the HIPAA Breach Notification Rule (where PHI is involved), the FTC Health Breach Notification Rule (where non-HIPAA health data is involved), and applicable state breach-notification laws.

13. Do Not Track

We do not currently respond to “Do Not Track” signals from web browsers. We do honor Global Privacy Control (GPC) signals for opt-out of sale/sharing as required by law.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be posted on our website and communicated to you in advance by email or in-app notice, and where required by law we will obtain your consent. Your continued use of the Services after the effective date of an updated policy constitutes acceptance of the update.

15. Contact us

MDChat Inc.
8 The Green, Ste. A, Dover, DE 19901
privacy@mdchat.com · support@mdchat.com · (201) 503-4930