Security & record handling
Sensitive records. Thoughtful handling.
Careful review starts with careful handling. Understand the controls in the record workflow and how the service handles your data.
The public site has no record-upload forms.
The record workflow
From upload to review.
A few important controls keep the source, the processing copy and access to the file connected.
- 01
PDF validation
Start with a usable file
PDFs are checked before processing. Locked files need to be unlocked. Files with no pages, files that cannot be opened and exact copies already in the report are rejected.
- 02
Integrity checks
Keep the file consistent
File integrity checks compare the uploaded source with the copy used for processing, helping detect unexpected changes.
- 03
Temporary links
Limit the lifetime of access
Source files are passed for processing through time-limited links, rather than permanent public document links.
For your organization
What to know,
before you begin.
Security requirements depend on your organization. Here is how the service is designed to work.
Access and workspace controls
Accounts sign in with email and password or Google, and two-step sign-in is available by authenticator app or passkey. A workspace’s reports are private to that workspace, and Owner, Admin, Member and Viewer roles control what each person can do.
AI processing and providers
AI processing is part of report creation, so the pages of your records are sent to third-party AI model providers. Ask us for the current provider list and processing locations. The public website does not accept medical-record uploads.
Retention, deletion and backups
A report moves to Trash at the end of its workspace’s retention period of 90, 180 or 365 days, unless extended. Trash keeps it for 30 days, and it is then permanently deleted. Copies may remain for a limited time in backups and with providers. The Privacy Policy has the details.
Activity and audit information
The audit log records report views, downloads and administrative actions. A workspace’s Owners and Admins can review it, and audit records are kept for up to two years.
Security documentation and agreements
Request current documentation and any available agreements relevant to your review. No HIPAA compliance, SOC 2 certification or BAA availability is asserted on this page.
Start a security conversation
A clear point of contact.
For security questions or a potential vulnerability, email support@medichro.com.
Keep medical records, patient information, credentials and private document links out of email.
Read our security contact file