Legal · Privacy
This summary provides a quick overview of our privacy practices. The full policy below contains complete details.
| Practice | Our Commitment |
|---|---|
| Do we sell your health data? | No. We never sell your personal health information. |
| Do we share data for marketing? | No. Your health data is never shared with third parties for marketing or advertising. |
| Are we covered by HIPAA? | MedXShield is not a HIPAA-covered entity. However, we voluntarily commit to HIPAA-grade privacy and security protections. |
| How do we access your data? | Only when you explicitly authorize access through your health plan's secure login. We never see or store your health plan password. |
| Do we use AI or automated systems? | Yes. We use automated pattern detection to flag suspicious claims activity. Every alert requires your review before any action is taken. You may opt out of AI-assisted monitoring. See Section 5A. |
| How is data secured? | AES-256 encryption at rest, TLS 1.2+ in transit, on HIPAA-compliant Google Cloud infrastructure with audit logging and access controls. |
| Can you delete your data? | Yes. You may request complete deletion at any time. You may also disconnect your health plan at any time. |
| Breach notification | We will notify you within 60 calendar days of discovering any breach, consistent with FTC requirements. |
| Who can create an account? | Account holders must be 18 or older. Parents and guardians may monitor dependents' medical identity through their own account. |
| State privacy rights | We honor rights under the California CCPA/CPRA, Washington My Health My Data Act, New Jersey Data Privacy Act, and all other applicable state privacy laws. |
| Will you retaliate if I exercise my rights? | Never. We will never retaliate against you for filing a complaint or exercising any of your rights. |
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
MedXShield is a medical identity monitoring platform operated by STL Innovation, LLC ("STL Innovation," "Company," "we," "us," or "our"), a New Jersey limited liability company located at [COMPANY_ADDRESS — TO BE COMPLETED BEFORE LAUNCH]. MedXShield continuously monitors your medical claims, insurance benefits, and health records to detect unauthorized healthcare transactions, billing errors, and medical identity theft.
This Privacy Policy applies to all personal information collected through:
By using our Services, you acknowledge that you have read this Privacy Policy. If you do not agree with our practices described here, please do not use our Services.
The Health Insurance Portability and Accountability Act ("HIPAA") imposes privacy and security requirements on "covered entities" (health plans, healthcare providers, and healthcare clearinghouses) and their "business associates" (companies that handle health data on behalf of covered entities).
MedXShield is not a HIPAA-covered entity and does not function as a business associate under HIPAA. When you authorize MedXShield to access your health data through your health plan's Patient Access API, you are directing the transfer of your own data to an application of your choosing. Under guidance issued by the U.S. Department of Health and Human Services Office for Civil Rights (OCR, February 2016) and the CMS Interoperability and Patient Access Final Rule (CMS-9115-F, 85 FR 25510, May 1, 2020), a third-party application that receives health data at the patient's direction — rather than under a contract with the health plan — is not acting "on behalf of" the covered entity and is therefore not a business associate. Once your health plan transmits your data to MedXShield at your request, HIPAA's regulatory framework no longer governs that data.
This is sometimes called the "HIPAA gap" for patient-directed health applications.
Although HIPAA does not apply directly to MedXShield, the following federal and state laws protect your health information in our care:
Despite falling outside HIPAA's regulatory scope, STL Innovation voluntarily commits to maintaining privacy and security protections consistent with HIPAA standards for all protected health information we receive. Specifically, we commit to:
These commitments are enforceable as binding representations under the FTC Act, Section 5.
We collect the following categories of information:
When you connect your health plan account, we access your claims and encounter data through the FHIR R4 ExplanationOfBenefit resource. This includes:
Purpose: Detecting unauthorized claims, billing errors, and medical identity theft.
We access your insurance enrollment and coverage information through the FHIR R4 Coverage resource. This includes:
Purpose: Verifying your coverage status, identifying unauthorized enrollment changes, and monitoring benefits utilization.
We access basic demographic information through the FHIR R4 Patient resource. This includes:
Purpose: Identity verification, account matching, and alert delivery.
When you create a MedXShield account, we collect:
Purpose: Account creation, authentication, security, and alert delivery.
We automatically collect technical information when you use our Services:
Purpose: Service improvement, troubleshooting, security monitoring, and fraud detection.
We collect approximate location data (city/state level) derived from your IP address. We do not collect precise GPS location data. We do not use geofencing technology near any healthcare facility for any purpose.
Purpose: Fraud detection pattern analysis, compliance with applicable state laws, and content localization.
If you contact us for support or provide feedback, we collect the content of those communications, including:
Purpose: Customer support, service improvement, and record-keeping.
MedXShield uses secure, industry-standard technology called SMART on FHIR (built on OAuth 2.0) to access your health plan data. This is the same type of secure authorization technology used by major banks and technology companies for "Log in with Google" or "Log in with Apple" features. Here is how it works:
Key facts about this process:
In addition to Patient Access API connections, we collect information:
We use your information only for the following purposes:
| Purpose | Data Categories Used |
|---|---|
| Medical identity theft detection — Monitoring claims for unauthorized healthcare transactions filed using your identity | Health claims, coverage, demographics |
| Fraud alerts — Notifying you of suspicious activity on your medical identity | Health claims, coverage, account data |
| Billing error detection — Identifying potential errors in medical bills and insurance claims | Health claims, coverage |
| Account security — Protecting your MedXShield account from unauthorized access | Account data, device/usage data, location data |
| Service operation — Running, maintaining, and operating the platform and your monitoring connections | Health claims, coverage, demographics, account data |
| Service improvement — Analyzing usage patterns and improving platform performance | Device/usage data in de-identified or aggregated form only |
| Customer support — Responding to your inquiries and resolving issues | Communication data, account data |
| Legal compliance — Complying with applicable laws, regulations, and legal processes | All categories as required |
We do NOT use your health information for:
MedXShield uses a combination of automated systems to monitor your medical identity. We believe you should understand how these systems work and what role they play in your experience.
The core of our monitoring service is a deterministic rules engine — a system of predefined rules that check your claims data against known fraud patterns, CMS fee schedules, and billing standards. This system is code-based and does not use artificial intelligence. It checks for things like: claims filed after a provider's license was revoked, services billed that are biologically impossible for your demographics, duplicate charges for the same service, and billing amounts that significantly exceed Medicare-established rates.
In addition to the rules engine, we use AI-powered pattern analysis to identify suspicious activity that may not match a predefined rule. These AI systems analyze your claims patterns to flag unusual changes that could indicate unauthorized use of your medical identity.
Our AI systems are trained and improved using only de-identified, aggregated data patterns. We do not use your individually identifiable health data to train AI models that would be used for other customers or purposes. We do not sell, license, or share training data derived from your health information with any third party.
MedXShield does not sell your personal health information. We have never sold personal health information. We will not sell your personal health information in the future.
This commitment applies under any definition of "sale," including:
We do not share your personal health information for cross-context behavioral advertising, as defined under the CPRA.
We may share your information only in the following limited circumstances:
Service providers and processors. We share information with a limited number of service providers who assist us in operating our Services — for example, our cloud infrastructure provider (Google Cloud Platform), security monitoring services, and customer support tools. All service providers are contractually required to:
With your consent or at your direction. We share information when you explicitly authorize us to — for example, if you request that we export your data to another application or service.
Aggregate or de-identified data. We may share data that has been de-identified in accordance with the HIPAA Safe Harbor method (45 CFR § 164.514(b)), which requires the removal of 18 categories of identifiers. We maintain controls to prevent re-identification and do not attempt to re-identify any de-identified data.
Legal requirements. We may disclose information if required to do so by law, regulation, legal process, or enforceable governmental request. Before disclosing your health information in response to a subpoena, court order, or warrant, we will provide you with three (3) business days' written notice so that you may seek a protective order or other appropriate remedy, unless we are legally prohibited from doing so or there is an imminent risk of serious harm.
Protection of rights. We may disclose information to enforce our Terms of Service, protect the rights, privacy, safety, or property of MedXShield, our users, or the public, or to address fraud, security, or technical issues.
Business transfers. If STL Innovation is involved in a merger, acquisition, bankruptcy, or asset sale, your information may be transferred to the successor entity. We will notify you by email and/or by prominent notice on our Website at least 30 days before your information becomes subject to a different privacy policy. Any successor entity will be required, as a condition of the transfer, to honor the commitments in this Privacy Policy for all data collected before the transfer date, or to provide you with the opportunity to request deletion of your data before the transfer is completed.
MedXShield does not voluntarily disclose any data relating to reproductive health care or gender-affirming care in response to subpoenas, court orders, warrants, or law enforcement requests from jurisdictions where such care is lawful. We will provide you with notice of any such legal demand as described in Section 6.2 above. This commitment is consistent with applicable state laws including the Washington My Health My Data Act.
| Data Category | Retention Period |
|---|---|
| Health claims data (EOB) | Retained for the duration of your active account, plus 30 days following account closure to allow for reactivation |
| Insurance coverage data | Same as health claims data |
| Demographic data | Same as health claims data |
| Account and authentication data | Retained for the duration of your active account, plus 90 days. OAuth tokens are deleted immediately upon account closure or disconnection |
| Device and usage data | Retained for 12 months from collection, then automatically deleted or de-identified |
| Communication data (support tickets) | Retained for 3 years for legal compliance and quality assurance |
| Audit logs | Retained for 6 years, consistent with healthcare compliance standards |
| De-identified or aggregated data | May be retained indefinitely as it cannot be linked to you |
You may close your account and request deletion of your data at any time by:
Upon receiving a verified deletion request, we will:
Certain limited data may be retained after deletion where required by law (for example, records necessary for legal compliance, dispute resolution, or fraud prevention), but only for the minimum period required and subject to appropriate safeguards.
If your account has had no activity for 12 consecutive months, we will notify you by email and in-app notification that your account is considered dormant. If you do not respond within 30 days, we will revoke all API connections and begin the data deletion process described above.
We implement comprehensive security measures to protect your health information, including:
Encryption. All health data is encrypted at rest using AES-256 encryption managed through a dedicated key management service. All data in transit is protected using TLS 1.2 or higher. Encryption keys are managed in a hardened, FIPS 140-2 validated environment and are never stored alongside the data they protect.
Infrastructure. Our Services are hosted on Google Cloud Platform (GCP) infrastructure that is covered under a HIPAA Business Associate Agreement. GCP maintains ISO 27001, ISO 27017, ISO 27018, and SOC 2 Type II certifications. All Protected Health Information is stored using healthcare-specific infrastructure designed for FHIR R4 data with built-in access controls and audit logging.
Network security. We employ service perimeter controls that create security boundaries around our cloud resources, preventing data exfiltration and unauthorized access. Our serverless architecture reduces the attack surface by eliminating persistent server infrastructure.
Access controls. Access to health data is restricted on a need-to-know basis using role-based access controls. All access is authenticated through multi-factor authentication and logged for audit purposes. No MedXShield employee can access your raw health data without a documented business justification and supervisory approval.
Audit logging. We maintain comprehensive audit logs of all access to and operations on health data. Logs are immutable, stored separately from operational data, and retained for a minimum of 6 years.
Vulnerability management. We conduct regular security assessments, including penetration testing and vulnerability scanning. We maintain a responsible disclosure program for security researchers.
You can help protect your information by:
As a vendor of personal health records under the FTC Health Breach Notification Rule (16 CFR Part 318, as amended effective July 29, 2024), we are legally required to notify you if your personally identifiable health information is subject to a "breach of security." This includes both unauthorized access to your data (such as a cybersecurity incident) and unauthorized disclosure of your data (such as sharing data with a third party without your authorization, including sharing with analytics or advertising partners — something we do not do).
In the event of a breach of security affecting your health information, we will notify you without unreasonable delay and no later than 60 calendar days after discovery of the breach. Notification will be sent via:
Your notification will include:
For breaches affecting 500 or more individuals, we will simultaneously notify:
For breaches affecting fewer than 500 individuals, we will maintain a log and report to the FTC annually within 60 calendar days of the end of the calendar year.
We will also comply with all applicable state breach notification requirements, including those of New Jersey (N.J.S.A. 56:8-163), California (Cal. Civ. Code § 1798.29), Washington (RCW 19.255.010), Connecticut, and all other states where affected users reside. Where state law imposes shorter timelines or additional requirements, we will comply with the more protective standard.
Consistent with our voluntary HIPAA-grade commitments, we will also assess all breaches under the HIPAA breach notification framework (45 CFR §§ 164.400–414), including the presumption that any unauthorized acquisition, access, use, or disclosure of unsecured PHI constitutes a breach unless we can demonstrate a low probability that the data was compromised based on a documented risk assessment.
Because our entire mission is protecting your medical identity, we hold ourselves to the highest standard if our own systems are compromised:
Regardless of where you reside, MedXShield provides the following rights to all users. Additional state-specific rights are described in Sections 11–14.
You may request a copy of all personal information we hold about you, including your health claims data, coverage data, and demographic data. We will provide your data in a commonly used, machine-readable format (such as JSON or CSV) within 30 calendar days of receiving your verified request. If you request data in FHIR R4 format, we will provide it in that format.
You may request that we correct inaccurate personal information in your account. Note that health claims data originates from your health plan; to correct errors in claims data, you may need to contact your health plan directly. We will assist you in identifying the appropriate contact.
You may request deletion of all personal information we hold about you. See Section 7.2 for the deletion process and timeline.
You may disconnect any health plan account at any time through the MedXShield App settings or by contacting us. Disconnection will:
You may also revoke MedXShield's access directly through your health plan's website or member portal.
You may request an export of your data in a structured, commonly used, machine-readable format, including FHIR R4 format where applicable.
You may request that we limit our use of your health information to specific purposes. We will honor reasonable restriction requests, though certain restrictions may prevent us from delivering some or all of our monitoring services.
Where our processing of your information is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted before withdrawal.
You have the right to opt out of AI-assisted monitoring as described in Section 5A. You also have the right to appeal any automated finding to a qualified human reviewer. See Section 5A for details.
If you believe your privacy rights have been violated, you may:
We will never retaliate against you for filing a complaint or exercising any of your rights.
To exercise any of the rights described above, contact us by:
We will verify your identity before processing your request. For requests involving health data, we may ask you to verify your identity through your MedXShield account or through additional identity verification steps. We will respond to all requests within 30 calendar days (or sooner where required by applicable law). If we need additional time, we will notify you of the extension and the reason within the initial response period.
We will not charge a fee for processing your request unless the request is manifestly unfounded, excessive, or repetitive.
This section applies to California residents and supplements the rights described in Section 10, as required by the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 et seq.).
Because MedXShield is not a HIPAA-covered entity or business associate, the CCPA's exemption for HIPAA-protected health information (Cal. Civ. Code § 1798.145(c)(1)) does not apply to health data we collect. All health data we hold is fully subject to the CCPA/CPRA.
| CCPA Category | Examples | Sources | Purpose | Sold? | Shared for Ads? |
|---|---|---|---|---|---|
| A. Identifiers | Name, email, phone, IP address, health plan member ID | You; health plan APIs; automatic | Account management, identity verification, alert delivery | No | No |
| B. Personal info per Cal. Civ. Code § 1798.80 | Name, address, phone, health insurance info | You; health plan APIs | Service delivery, fraud detection | No | No |
| D. Commercial information | Service plan, transaction history with MedXShield | You; our systems | Account management, billing | No | No |
| F. Internet or network activity | Browsing history on our site, app usage, device info | Automatic | Service improvement, security | No | No |
| G. Geolocation data | Approximate location (city/state from IP) | Automatic | Fraud pattern analysis, compliance | No | No |
| Sensitive PI: Health data | Medical claims, diagnoses, procedures, medications, insurance coverage | Health plan APIs at your direction | Medical identity theft detection, fraud alerts, billing error detection | No | No |
In addition to the rights in Section 10, California residents have the right to:
Under the California CCPA regulations effective January 1, 2027, MedXShield's automated monitoring systems may qualify as ADMT used for significant decisions. We provide all California residents with:
You may designate an authorized agent to exercise your rights on your behalf. We will require verification of both the agent's identity and their written authorization from you.
Although we do not sell or share personal information, we provide the following links as required by California law:
We recognize and honor the Global Privacy Control (GPC) browser signal as a valid opt-out preference signal under the CCPA.
We do not offer financial incentives for the collection, sale, or deletion of personal information.
This section applies to Washington residents and to any individual whose consumer health data is collected in Washington, as required by the Washington My Health My Data Act (RCW 19.373, effective March 31, 2024).
Important: As required by the MHMDA, we maintain a separate, standalone Consumer Health Data Privacy Policy accessible via a prominent link on our homepage. That policy contains only the disclosures required by the MHMDA. This section provides a summary; the standalone policy is the controlling document for Washington residents.
| Category of Consumer Health Data | Purpose for Collection |
|---|---|
| Individual health conditions, treatment, diseases, or diagnoses (as reflected in claims data) | Medical identity theft detection, billing error detection, fraud alerts |
| Use or purchase of prescribed medication (as reflected in pharmacy claims) | Medical identity theft detection, billing error detection |
| Diagnoses, diagnostic testing, treatment, and medication information | Medical identity theft detection, fraud alerts |
| Health insurance coverage and claims information | Coverage monitoring, unauthorized enrollment detection |
We do not share consumer health data with affiliates for marketing or any secondary purpose.
We do not sell consumer health data. In the event we ever sought to sell consumer health data in the future — which we do not intend to do — we would first obtain your signed, written authorization containing all elements required by RCW 19.373.030.
We will respond to deletion requests within 30 calendar days.
As required by the MHMDA, we obtain separate consent for the collection of your consumer health data (through the API authorization flow described in Section 4.1) and for the sharing of that data with our service providers. Your consent is freely given, specific, informed, voluntary, and unambiguous. We do not obtain consent through pre-checked boxes, general terms of service acceptance, or any deceptive design patterns.
MedXShield does not use geofencing technology within 2,000 feet (or any distance) of any entity providing in-person healthcare services for the purpose of identifying, tracking, collecting data from, or sending messages to consumers seeking health care services.
This section applies to New Jersey residents, as required by the New Jersey Data Privacy Act (S332, effective January 15, 2025).
In addition to the rights described in Section 10, New Jersey residents have the right to:
We do not sell personal data, engage in targeted advertising using your health data, or engage in profiling that produces legal effects.
Health data and financial information are classified as sensitive data under the NJDPA. We process sensitive data only with your opt-in consent, obtained through the explicit authorization process described in Section 4.
We recognize and honor universal opt-out mechanisms as required by the NJDPA (effective July 15, 2025), including the Global Privacy Control (GPC) signal.
If we decline your rights request, you may appeal our decision. Submit an appeal to privacy@medxshield.com with the subject line "NJDPA Appeal." We will respond to your appeal within 45 days. If your appeal is denied, we will provide information on how to file a complaint with the New Jersey Division of Consumer Affairs.
Consistent with the NJDPA's requirements, we conduct and document data protection assessments for our processing of sensitive health data. These assessments evaluate the risks and benefits of our processing activities and the safeguards we employ to mitigate risk.
Connecticut residents have similar rights to those described in Section 10, including the right to access, correct, delete, and port personal data, and to opt out of the sale of personal data and targeted advertising. We obtain opt-in consent before processing Connecticut residents' consumer health data, as required by Public Act 23-56. We do not use geofencing technology within 1,750 feet of any mental health or reproductive/sexual health facility.
Colorado residents may exercise rights to access, correct, delete, and port personal data, and to opt out of the sale of personal data, targeted advertising, and certain profiling. We process sensitive health data only with opt-in consent and recognize universal opt-out mechanisms.
Virginia residents may exercise rights to access, correct, delete, and port personal data, and to opt out of the sale of personal data, targeted advertising, and profiling. We process sensitive health data only with opt-in consent. We will respond to rights requests within 45 days.
Texas residents may exercise rights to access, correct, delete, and port personal data, and to opt out of the sale of personal data and targeted advertising. We process sensitive health data only with opt-in consent and recognize universal opt-out mechanisms.
Nevada residents and individuals whose consumer health data is collected in Nevada have the right to access, delete, and withdraw consent for their consumer health data. We obtain affirmative opt-in consent before collecting consumer health data from Nevada consumers. We do not sell consumer health data. We do not use geofencing technology within 1,750 feet of any entity providing in-person healthcare services.
We monitor the evolving landscape of state privacy legislation and will comply with all applicable state privacy laws. If you reside in a state with applicable privacy laws not specifically listed above, you may exercise your rights by contacting us using the information in Section 18. We will apply the most protective standard applicable to your state of residence.
MedXShield accounts may only be created by individuals who are 18 years of age or older. All account holders must verify their age during registration.
Parents and legal guardians who hold a MedXShield account may monitor the medical identity of their dependents (including minor children) through the Family Dashboard feature of their own account. In this model:
For dependents under the age of 13, we comply with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. § 6501 et seq.). Before any data related to a child under 13 is processed through the platform, we require verifiable parental consent from the account-holding parent or guardian. Parents may at any time:
For dependents between the ages of 13 and 17, the parent or guardian retains full control through their account. Dependents in this age range do not have independent login access.
When a dependent turns 18, they are no longer eligible for monitoring through a parent's account. To continue medical identity monitoring, they must create their own MedXShield account. We will notify the account-holding parent and the dependent (if contact information is on file) in advance of this transition.
If we discover that we have collected personal information from a child under 13 without verified parental consent, or from any individual under 18 without the involvement of a parent or guardian account, we will promptly delete that information and terminate the associated monitoring.
If you believe we may have collected information from a minor without proper parental involvement, please contact us immediately at privacy@medxshield.com.
Our Services may contain links to third-party websites, services, or applications that are not operated by us. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party service before providing your information. We are not responsible for the privacy practices of third-party services.
Our Services integrate with health plan Patient Access APIs operated by HIPAA-covered entities (such as your health insurance company). Your relationship with your health plan and the data maintained by your health plan are governed by your health plan's own privacy practices and HIPAA Notice of Privacy Practices.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
For material changes (changes to the types of data collected, purposes of use, sharing practices, security practices, or your rights):
For non-material changes (clarifications, formatting, grammatical corrections):
If you do not agree with a material change, you may:
Your continued use of our Services after the effective date of a material change constitutes your acceptance of the updated Policy.
If you have questions about this Privacy Policy, wish to exercise any of your rights, or have a privacy concern, please contact us:
Privacy Officer
STL Innovation, LLC
[COMPANY_ADDRESS — TO BE COMPLETED BEFORE LAUNCH]
Email: privacy@medxshield.com
Phone: [CONTACT_PHONE — TO BE COMPLETED BEFORE LAUNCH]
Online privacy request form: https://www.medxshield.com/privacy
Website: https://www.medxshield.com
For general inquiries about our Services, visit https://www.medxshield.com or contact hello@medxshield.com.
We aim to respond to all privacy inquiries within 5 business days and to all formal rights requests within 30 calendar days (or sooner where required by applicable law).
STL Innovation is a signatory to the CARIN Alliance Code of Conduct, a voluntary, industry-consensus framework for consumer-facing applications that access health data. Our commitments under the CARIN Code of Conduct include:
You can verify our CARIN Code of Conduct endorsement at https://www.myhealthapplication.com/.
| Framework | Applies? | Key Implications |
|---|---|---|
| HIPAA Privacy, Security, and Breach Notification Rules | Not directly (not a covered entity or business associate) | We voluntarily commit to HIPAA-grade protections |
| FTC Health Breach Notification Rule (16 CFR Part 318) | Yes — as a vendor of personal health records | Breach notification within 60 days; covers both cyberattacks and unauthorized disclosures |
| FTC Act, Section 5 | Yes | Our privacy commitments are legally enforceable |
| CCPA/CPRA (California) | Yes — HIPAA exemption does not apply | Full consumer rights; ADMT provisions (eff. Jan 2027); right to limit use of sensitive PI |
| My Health My Data Act (Washington) | Yes — no minimum threshold | Separate consumer health data privacy policy required; private right of action |
| NJDPA (New Jersey) | Yes — subject to threshold requirements | Opt-in for sensitive data; universal opt-out mechanism |
| CTDPA (Connecticut) | Yes — health data provisions have no threshold | Opt-in consent for consumer health data |
| CPA (Colorado) | Yes | Opt-in for sensitive data; universal opt-out |
| VCDPA (Virginia) | Yes | Opt-in for sensitive data |
| TDPSA (Texas) | Yes | Opt-in for sensitive data |
| NV SB 370 (Nevada) | Yes | Affirmative opt-in; written authorization for sale |
| COPPA | Applicable to dependents under 13 monitored through parent accounts | Verifiable parental consent required |
| 42 CFR Part 2 | Applies if SUD records are received | All health data treated under same heightened standard |
| TEFCA IAS Provider Requirements | Not currently participating (planned future integration) | Will comply when enrolled |
| CMS Patient Access API (CMS-9115-F) | Voluntary attestation framework | Privacy attestations submitted to payer portals |
| CARIN Alliance Code of Conduct | Voluntary endorsement | Industry-recognized trust framework |
This Privacy Policy has been reviewed by qualified legal counsel specializing in healthcare privacy, FTC compliance, and multi-state consumer privacy law.