Scope and roles
This policy covers the medichro.com website and the MediChro application (the “Service”). “MediChro”, “we” and “us” mean the operator of the Service. Words defined in the Terms of Service have the same meaning here.
- Account and website information. We decide how this is used, as described below.
- Records and reports. The medical records you upload and the reports made from them (“Your Content”) belong to the matter you are working on. Your organization decides why they are processed and is responsible for having the right to process them. We process them on your behalf to provide the Service.
If you are a patient or another person named in records, we generally cannot identify or act on those records ourselves. Please contact the law firm or organization that holds them.
Do not send records through the website
The public website does not accept medical records. Never send medical records or patient information through its forms or by email to us. Upload records only inside the application.
What we collect
On the website
- No accounts and no cookies. You cannot sign in on the website, and it does not set cookies.
- No analytics service. None is connected at present. If that changes, we will update this policy.
- Request logs. Our hosting provider may keep standard logs, such as IP address, browser type and the page requested, to deliver and protect the site.
- Contact and demo forms. These prepare an email draft in your browser. Nothing reaches us unless you send that email yourself. If you do, we receive what you include.
In the application
- Account details: your name, email address, organization, a protected form of your password, and two-step sign-in details.
- Workspace details: members, roles, settings and preferences.
- Your Content: the files you upload, their names and the reports made from them. Medical records can contain sensitive health information about the people named in them.
- Activity and device information: sign-ins, IP address, browser and device type, and actions such as starting, viewing, downloading or deleting a report.
- Billing information: what you bought and your page balance. Our payment provider collects your payment details. We do not receive your full card number.
- Support messages: what you write to us.
How we use information
We use information to provide, operate, secure and support the Service; to run reports and show them to you; to send service emails such as sign-in codes and notices; to bill; to detect misuse and investigate problems; to improve reliability; and to meet legal obligations or protect our rights.
We do not sell personal information. We do not train any AI model of our own on Your Content.
Who receives information
We share information only as needed with:
- Hosting and storage providers, which store the Service’s data and files;
- AI model providers and routing services, which receive the pages of the records you upload, because reading them is how a report is made. They handle that data under their own terms and policies;
- Email delivery providers, which send service emails. These emails do not name reports or files;
- Our payment provider, which acts as merchant of record. It receives identifiers and purchase details, not Your Content;
- Other members of your workspace, according to their roles;
- Professional advisers, authorities and courts, where the law requires it or where we need to protect our rights, our users or others;
- A buyer or successor, if the business or its assets are sold or reorganized.
Ask support@medichro.com for the current list of providers. Our staff may access information, including Your Content, only where needed for support, security, investigating a problem or a legal requirement.
International transfers
We and our providers operate in the United States, India and other countries. Information, including Your Content, may be processed in countries whose laws differ from those of your country. By using the Service, you accept this, and you are responsible for any notice, consent or safeguard your own law requires.
How long we keep information
- Reports move to Trash at the end of the workspace’s retention period, which is 90, 180 or 365 days, unless extended.
- Trash keeps a report for 30 days, after which it is permanently deleted.
- Unfinished uploads expire after 24 hours and move to Trash. Reports paused for 30 days are cancelled.
- Data exports are available for 7 days.
- Account and workspace deletion takes effect after a 7-day grace period.
- Audit and activity records are kept for up to two years. Notifications are kept for 90 days.
- Billing and tax records are kept for as long as the law requires.
After these periods, data is removed from active systems. Copies may remain for a limited time in backups, in logs and with providers under their own retention terms. We may keep information longer where the law requires or where it is needed for a dispute, investigation or the protection of our rights.
Cookies
The website sets no cookies. The application uses a strictly necessary cookie to keep you signed in and uses your browser’s storage for preferences. It does not use advertising cookies.
Security
We use reasonable technical and organizational measures for a service of this kind. No system is completely secure, and we cannot guarantee the security of any information. You are responsible for your own sign-in details, your devices and how you handle downloaded reports. See the Terms of Service for the limits on our responsibility.
Your choices and rights
You can update your account details, change email notification settings, export your data and delete your account in the application’s settings.
Depending on where you live, you may have rights to access, correct, delete or restrict your personal information, to object to its use, or to complain to a regulator. To make a request, email support@medichro.com. We may need to verify who you are. For Your Content, we may pass your request to the organization that uploaded it. Rights can be limited by law.
Children
The Service is for professionals and is not directed to children. Records about minors may be uploaded only by a customer who has the legal right to do so.
Changes
We may change this policy at any time by posting a new version with a new date at the top. Your continued use of the Service after that date means you accept the new version.
Contact
Questions about this policy or a privacy request: support@medichro.com.