Version 1.0 | September 15, 2026
Applies to MDTelemed LLC websites, patient-facing digital services, communications, and related online interactions
3. PURPOSE, SCOPE, AND PRIVACY COMMITMENT
MDTelemed LLC ("MDTelemed," "we," "us," or "our") provides telemedicine services through licensed medical doctors and related digital services. This Policy explains how MDTelemed collects, uses, discloses, retains, and otherwise processes personal information when individuals visit our public website, create or use an account, communicate with us, receive administrative services, interact with our patient-facing technology, or otherwise use services to which this Policy is posted or linked.
MDTelemed recognizes that information connected with health care can be exceptionally sensitive. Our privacy program is designed to distinguish among different legal categories of information rather than assuming that every item of information is governed by the same law. Depending on the context, information may be protected by HIPAA, state medical-record confidentiality laws, state consumer-health-data laws, general state privacy laws, communications laws, or other federal or state requirements.
This Policy is intended to provide a clear public description of our privacy practices. It does not create a representation that a particular statute applies where the statute itself provides an exemption or exclusion. It also does not expand MDTelemed's legal obligations beyond applicable law or an express contractual commitment.
3.1 Services Covered
This Policy applies to MDTelemed's public website, account-registration pages, patient portal and other patient-facing online functions, telemedicine access technology, administrative communications, customer support, billing and membership interactions, electronic forms, secure messaging, and other digital services that expressly link to this Policy.
MDTelemed may provide care through synchronous video, audio-only/telephone, asynchronous communications, and secure messaging when clinically appropriate and legally permitted. A patient's physical location is collected or confirmed in connection with telemedicine care because physician licensure and other legal requirements generally depend on where the patient is physically located at the time of care.
3.2 Services and Information Not Governed Solely by This Policy
Protected Health Information (PHI) subject to HIPAA is also governed by MDTelemed's separate Notice of Privacy Practices. Consumer health data subject to a state consumer-health-data statute may also be governed by MDTelemed's Consumer Health Data Privacy Policy and State Privacy Rights Supplement. Employment and workforce information is governed by separate workforce policies and applicable law. Third-party websites, applications, pharmacies, laboratories, imaging facilities, and other independent services may have their own privacy practices. Clinical consent, pediatric consent, behavioral-health privacy, AI-assisted documentation, electronic communications, and other specialized topics are addressed in separate MDTelemed policies or consents where appropriate.
4. INFORMATION WE MAY COLLECT
The information MDTelemed collects depends on how an individual interacts with us. We collect only information reasonably related to providing, securing, administering, improving, and lawfully operating our services, and for other purposes described in this Policy or disclosed at the point of collection.
4.1 Identifiers and Contact Information
Name, date of birth, mailing address, email address, telephone number, and account identifiers. Usernames, authentication information, verification information, and other information used to establish or protect an account. Parent, legal guardian, caregiver, proxy, or authorized-representative information when a person acts for a patient. Physical location or state at the time of a telemedicine encounter, and other location information when required for care, safety, licensure, or legal compliance.
4.2 Health and Clinical Information
When an individual seeks medical care, MDTelemed may collect health information such as symptoms, medical history, diagnoses, medications, allergies, treatment information, photographs or other patient-submitted media, laboratory or imaging information, clinical communications, physician documentation, and information necessary to coordinate care. To the extent this information is PHI, MDTelemed handles it under HIPAA and the Notice of Privacy Practices in addition to other applicable law.
MDTelemed provides clinical care through human medical doctors. MDTelemed does not represent an autonomous artificial-intelligence system as the treating physician. MDTelemed may use AI-assisted telescribing or documentation technology to assist the physician in creating clinical documentation. The specific collection, processing, and consent rules for that function are addressed in MDTelemed's separate AI Telescribe, Audio Capture & Documentation Consent.
4.3 Payment, Membership, and Transaction Information
Billing name and address, transaction amount, payment status, membership status, refunds, credits, and related transaction records. Payment-card or bank information may be processed by payment technology used to complete transactions. MDTelemed does not state in this Policy that it stores or does not store full payment credentials unless that implementation has been technically verified. Self-pay documentation, Good Faith Estimate information, and other financial-administration information.
4.4 Communications and Support Information
Emails, text messages, secure messages, customer-service communications, complaints, grievances, survey responses, and other communications with MDTelemed. Communication preferences, including consent or opt-out choices for marketing and text messages. Information voluntarily submitted through forms, questionnaires, feedback tools, or support requests.
4.5 Device, Network, and Usage Information
When individuals use our websites or digital services, MDTelemed and service providers acting on our behalf may collect technical information such as IP address, browser type, device type, operating system, approximate location derived from network information, referring or exit pages, timestamps, pages or features viewed, interactions with content, error and diagnostic information, and security-related events.
Some of this information may be collected through cookies, pixels, software development kits, local storage, logs, or similar technologies. Because health-related websites and authenticated patient services can create heightened privacy risks, MDTelemed's use of tracking technology must be configured and governed according to applicable HIPAA and state-law requirements. A general cookie banner is not treated as a substitute for a HIPAA authorization where HIPAA requires an authorization.
4.6 Information From Other Sources
MDTelemed may receive information from a parent or guardian, authorized representative, treating or referring health professional, pharmacy, laboratory, imaging facility, payment or fraud-prevention service, communications provider, identity-verification service, or other person or entity involved in providing or supporting a requested service. The precise sources depend on the service and the patient's choices.
5. HOW WE USE PERSONAL INFORMATION
MDTelemed may use personal information for the following purposes, subject to applicable law and, for PHI, the separate HIPAA Notice of Privacy Practices.
5.1 Provide and Administer Telemedicine Services
Create and administer patient accounts. Verify identity, age, parent/guardian authority, and patient location where appropriate. Connect a patient with an MD licensed or otherwise legally authorized to provide care in the patient's location. Support video, audio-only, asynchronous, secure-messaging, and other permitted telemedicine modalities. Support prescriptions, referrals, laboratory testing, imaging, diagnostic testing, results management, follow-up, and care coordination when ordered or recommended by the physician. Maintain medical and administrative records as required or permitted by law.
5.2 Safety, Security, Fraud Prevention, and Compliance
Authenticate users and protect accounts. Detect, investigate, and respond to suspected fraud, abuse, unauthorized access, cybersecurity events, or violations of MDTelemed terms. Maintain audit information and other records required for security, privacy, clinical, financial, or legal compliance. Comply with court orders, subpoenas, reporting obligations, licensing requirements, and other legal processes when applicable. Protect patients, physicians, workforce members, MDTelemed, and others from threats to safety or unlawful conduct.
5.3 Communications
MDTelemed may send transactional or service-related communications concerning appointments, account activity, prescriptions, laboratory or imaging coordination, results, billing, membership, privacy or security notices, policy updates, and other operational matters. MDTelemed may also send promotional email or text communications where permitted by law and consistent with the individual's consent and preferences. Marketing consent is not a condition of receiving medical treatment unless legally permitted and clearly disclosed.
5.4 Service Improvement and Analytics
MDTelemed may use information to understand how its services function, troubleshoot technical issues, improve usability, measure service performance, perform quality activities, and develop or improve services. Where such activities involve PHI, they must be conducted under a HIPAA permission, a valid authorization, or another lawful mechanism. MDTelemed will not characterize data as "anonymous" or "de-identified" unless the applicable legal or technical standard has actually been satisfied.
6. HOW AND WHY INFORMATION MAY BE DISCLOSED
MDTelemed does not use the word "share" to imply that every disclosure is a sale or advertising disclosure. Information may be disclosed for health care, operational, legal, security, and other purposes. PHI disclosures are additionally governed by the Notice of Privacy Practices.
6.1 Physicians and Workforce Members
Information may be made available to MDTelemed physicians and authorized workforce members who need it to provide care, administer services, perform privacy or security functions, address complaints, process payments, or carry out other authorized responsibilities. Access should be limited according to role and legitimate need.
6.2 Service Providers and Contractors
MDTelemed may use service providers to support hosting, communications, payment processing, identity verification, e-prescribing, clinical documentation, AI-assisted telescribing, analytics, security, customer support, laboratory or imaging coordination, and other functions. MDTelemed currently describes its technology stack as proprietary and does not identify specific vendors in this Policy unless their identity has been verified and disclosure is required or appropriate.
When a service provider is a HIPAA business associate, MDTelemed will use a Business Associate Agreement when required by HIPAA. A vendor's access to information must also satisfy applicable privacy, security, consumer-health-data, and contractual requirements.
6.3 Pharmacies, Laboratories, Imaging Facilities, and Other Care Participants
At the patient's direction or as otherwise permitted by law, information may be disclosed to pharmacies, laboratories, imaging facilities, specialists, emergency services, or other health care participants to facilitate prescriptions, testing, referrals, treatment, follow-up, or care coordination.
6.4 Legal, Regulatory, Public Health, and Safety Disclosures
MDTelemed may use or disclose information when required or permitted by law, including in response to valid legal process, licensing-board requirements, public-health obligations, mandatory reporting duties, or circumstances involving serious threats to health or safety. The existence and scope of any disclosure depend on the applicable law and facts; this Policy does not promise that MDTelemed will disclose information whenever a request is made.
6.5 Corporate Transactions
If MDTelemed is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, information may be reviewed or transferred as permitted by applicable law and subject to required protections. PHI remains subject to HIPAA where HIPAA applies.
7. COOKIES, PIXELS, ANALYTICS, AND ONLINE TRACKING
MDTelemed expects to use cookies and related technologies for functions such as authentication, security, preferences, analytics, service improvement, and marketing. The actual technologies deployed may change. MDTelemed therefore does not state that any particular named advertising or analytics vendor is currently deployed unless verified.
7.1 Essential Technologies
Certain technologies may be necessary to maintain sessions, authenticate users, remember privacy preferences, prevent fraud, protect forms, balance traffic, or provide requested digital functionality. Where legally permitted, these technologies may operate without an optional advertising consent because they are necessary for the requested service or security function.
7.2 Analytics and Performance Technologies
Analytics technologies may help MDTelemed understand aggregate service usage, diagnose errors, and improve user experience. Their configuration must be assessed for the type of information transmitted, the page or service on which they operate, whether the user is authenticated, the recipient's role, and whether HIPAA or a state privacy law requires a contract, authorization, consent, opt-out, or other control.
7.3 Advertising and Marketing Technologies
Marketing technologies may be used on appropriate public-facing portions of MDTelemed's digital properties where legally permitted. MDTelemed will not intentionally use advertising technologies to disclose PHI for marketing without a lawful HIPAA basis, including authorization when required. Tracking technologies should not be deployed in authenticated patient areas in a manner that impermissibly discloses PHI.
7.4 Cookie and Privacy Choices
Where required, MDTelemed will provide mechanisms to accept, reject, or manage non-essential cookies and other privacy choices. Browser settings may also permit users to limit cookies. Disabling some technologies may affect functionality. A cookie preference does not replace any separate authorization or consent required by health privacy law.
8. HIPAA AND PROTECTED HEALTH INFORMATION
MDTelemed intends to operate its clinical services in compliance with HIPAA when MDTelemed is acting as a covered health care provider or otherwise subject to HIPAA. HIPAA governs PHI maintained or transmitted by a covered entity or business associate, subject to statutory and regulatory definitions and exceptions.
MDTelemed's separate Notice of Privacy Practices describes patient rights and MDTelemed's permitted uses and disclosures of PHI. That notice, rather than this general website policy, is the primary patient-facing HIPAA notice required by 45 C.F.R. § 164.520.
If this Policy and the Notice of Privacy Practices appear to conflict with respect to PHI, MDTelemed will apply the Notice of Privacy Practices and applicable law to the PHI at issue.
9. CONSUMER HEALTH DATA AND STATE PRIVACY LAWS
Several states regulate consumer health data outside traditional HIPAA frameworks. These laws can apply to health-related information, precise location information connected to health services, inferences, or other data even when the information is not PHI. They may also contain exemptions for HIPAA-regulated entities or HIPAA-regulated data, so applicability must be determined under the specific statute.
MDTelemed will maintain a separate Consumer Health Data Privacy Policy and State Privacy Rights Supplement to address rights and disclosures that cannot be accurately compressed into one national statement. Those documents may address, where applicable, categories of consumer health data, sources, purposes, sharing, processors or third parties, consumer requests, appeals, consent, authorization for sale, geofencing restrictions, and material changes.
10. CHILDREN, MINORS, PARENTS, AND GUARDIANS
MDTelemed provides telemedicine services to patients of all ages, including infants, children, and adolescents. The ability of a minor to consent to treatment, control confidential information, or authorize disclosure varies substantially by state and by the type of service.
MDTelemed may collect information about a parent, legal guardian, or other authorized person to establish authority to consent or act for a minor. MDTelemed will not rely on a single national age rule where state law provides a different rule for a particular service.
Information concerning pediatric consent, confidential adolescent services, parent or guardian access, emancipated minors, mandatory reporting, and related matters is addressed in the Pediatric Care, Parent/Guardian Consent & Minor Rights Policy and the 50-State Minor Consent & Confidentiality Addendum.
11. AI-ASSISTED TELESCRIBING AND AUDIO PROCESSING
MDTelemed's clinical model is physician-led. Medical diagnosis, treatment, prescribing decisions, referrals, and clinical judgment are made by human MD physicians, not by an autonomous AI clinician.
MDTelemed may use AI-assisted telescribing technology to assist the physician in documenting an encounter. Such technology may process audio or encounter information for documentation purposes. This Privacy Policy does not state that raw audio is permanently stored, immediately deleted, used for model training, or retained for a particular period because those technical facts must be verified against the implemented system before MDTelemed makes a public promise.
Before implementation, MDTelemed should document and disclose the actual audio-processing pathway, retention period, vendor or internal processing role, training use or prohibition, security controls, correction process, and patient consent/declination workflow in its AI Telescribe, Audio Capture & Documentation Consent and related internal data-flow documentation.
12. DATA SECURITY
MDTelemed uses administrative, technical, and physical safeguards designed to protect information appropriate to the nature of the information and applicable legal requirements. No internet-connected system can be guaranteed to be completely secure, and MDTelemed does not promise absolute security.
The earlier MDTelemed draft referenced specific encryption algorithms, multi-factor authentication requirements, intrusion-detection systems, geographic backup arrangements, quarterly recovery testing, a 99.9% uptime commitment, and SOC 2 Type II audits. Those statements are not repeated here because MDTelemed has not yet verified that each technical specification or certification is implemented. Public privacy language should describe verified controls only.
MDTelemed will maintain more detailed internal security policies, risk-management procedures, access controls, incident-response procedures, workforce safeguards, and vendor requirements as appropriate. Security practices may evolve in response to technology, risk assessments, legal requirements, and recognized security practices.
13. DATA RETENTION AND DELETION
MDTelemed retains information for periods reasonably necessary to provide services, satisfy medical-record retention requirements, comply with legal and regulatory obligations, resolve disputes, enforce agreements, maintain security and audit records, and support legitimate operational needs.
Medical-record retention periods vary by state and may differ for adults and minors. Accordingly, MDTelemed does not use a single seven-year rule for every record and every state. The Medical Record Retention & Destruction Notice and MDTelemed's internal 50-state retention schedule govern applicable clinical retention periods.
A consumer request to delete information does not necessarily require deletion of medical records or other information that MDTelemed must or is permitted to retain under HIPAA, state medical-record law, litigation-hold requirements, fraud-prevention obligations, or another legal exception. Where deletion rights apply, MDTelemed will process them according to applicable law and the relevant privacy supplement.
14. INDIVIDUAL PRIVACY RIGHTS
Privacy rights vary according to the type of information, the law governing that information, and the individual's state. Depending on applicable law, an individual may have rights to access, obtain a copy, correct, amend, delete, restrict, opt out, withdraw consent, request confidential communications, obtain an accounting or list of certain disclosures, appeal a denied privacy request, or obtain information about categories of data and recipients.
HIPAA rights are described in the Notice of Privacy Practices. State consumer and consumer-health-data rights are described in the State Privacy Rights Supplement and Consumer Health Data Privacy Policy.
14.1 Submitting a Privacy Request
Unless a more specific method is provided in an applicable notice, privacy requests may be sent to Support@MDTelemed.com or mailed to MDTelemed LLC, 304 S Jones Blvd #4872, Las Vegas, NV 89107. MDTelemed may need to verify the requester's identity and authority before acting on a request.
14.2 Authorized Agents and Representatives
Where permitted by law, an individual may use an authorized agent or personal representative. MDTelemed may request documentation sufficient to verify the representative's authority and protect the patient from unauthorized disclosure.
14.3 Appeals
If applicable state law provides a right to appeal denial of a consumer privacy request, MDTelemed will provide an appeal process in the applicable state privacy notice and respond within the period required by that law.
15. MARKETING, EMAIL, AND TEXT MESSAGES
MDTelemed may communicate by email, text message, telephone, secure messaging, or other electronic means for administrative and care-related purposes. Because ordinary email and SMS may not always be secure, patients should avoid sending sensitive medical information through an unsecured channel when a secure channel is available.
Promotional communications will be managed according to applicable consent and opt-out requirements. Individuals may opt out of promotional email using the unsubscribe mechanism provided in the message. Text-message opt-out and related terms will be addressed in MDTelemed's SMS/Text Messaging Terms & Consent. Opting out of marketing does not necessarily stop non-marketing communications that are necessary to provide requested services, protect an account, or comply with law.
16. DO NOT SELL / SHARE AND TARGETED ADVERTISING RIGHTS
Some state laws use defined terms such as "sell," "share," "targeted advertising," or "cross-context behavioral advertising." Whether a particular disclosure falls within one of these definitions depends on the law and the actual data flow.
MDTelemed will not state categorically that it "never sells" or "never shares" information for statutory purposes until its advertising, analytics, and vendor data flows have been technically and legally mapped. Where applicable law grants an opt-out right, MDTelemed will provide the required mechanism and disclosures in the State Privacy Rights Supplement or a linked privacy-choice interface.
MDTelemed will not sell PHI in violation of HIPAA. Certain state consumer-health-data laws may impose separate authorization requirements on a statutory "sale" of consumer health data.
17. THIRD-PARTY WEBSITES AND SERVICES
MDTelemed services may link to or interact with independent pharmacies, laboratories, imaging centers, payment services, or other third parties. A link or technical connection does not necessarily mean MDTelemed controls that third party's privacy practices. Individuals should review the third party's privacy notice when the third party independently determines how it processes information.
When a third party processes PHI on MDTelemed's behalf as a business associate, HIPAA contractual requirements apply as appropriate. When a third party acts independently, different privacy rules may apply.
18. DATA TRANSFERS AND SERVICE LOCATION
MDTelemed is a United States telemedicine service. Information may be processed or stored in locations used by MDTelemed or its service providers, subject to applicable contractual and legal safeguards. This Policy does not promise that all information remains physically within a particular state or data center unless MDTelemed later verifies and adopts such a requirement.
19. PRIVACY INCIDENTS AND BREACH NOTIFICATION
MDTelemed maintains procedures to evaluate suspected privacy or security incidents. If an incident constitutes a reportable breach, MDTelemed will provide notices required by applicable law. The timing, recipients, and content of a notice depend on the law governing the affected information and the facts of the incident.
MDTelemed does not promise a universal 24-hour patient notification period. HIPAA and state breach-notification laws contain different standards, and premature promises can conflict with required investigation, law-enforcement delay, or statutory timing rules.
Where an incident involves information outside HIPAA, other laws may apply, including state breach laws and, for entities within its scope, the Federal Trade Commission’s Health Breach Notification Rule.
20. CHANGES TO THIS POLICY
MDTelemed may update this Policy to reflect changes in law, technology, services, or privacy practices. The revised Policy will identify its effective date. If applicable law requires additional notice, consent, or authorization before a materially different use of information, MDTelemed will follow that requirement rather than relying solely on a website posting.
Archived versions may be maintained as appropriate to document the privacy terms in effect at a particular time.
21. CONTACT MDTelemed
Questions, privacy requests, or complaints concerning this Website & Consumer Privacy Policy may be directed to: MDTelemed LLC Attn: Privacy / Business Administration 304 S Jones Blvd #4872 Las Vegas, NV 89107 Email: Support@MDTelemed.com
For rights involving PHI, individuals should also consult MDTelemed's Notice of Privacy Practices, which will identify the applicable HIPAA privacy contact and the right to complain to the U.S. Department of Health and Human Services Office for Civil Rights without retaliation.
22. RELATED MDTelemed PRIVACY AND LEGAL DOCUMENTS
Terms of Use & Terms of Service Telehealth Informed Consent Pediatric Care, Parent/Guardian Consent & Minor Rights Behavioral Health Services & Mental Health Privacy Security & Privacy Safeguards Statement Medical Records Access, Amendment & Release Policy Cookie, Tracking Technology & Analytics Policy Medical Record Retention & Destruction Notice HIPAA Notice of Privacy Practices Consumer Health Data Privacy Policy State Privacy Rights Supplement Electronic Communications, Electronic Records & E-SIGN Consent SMS/Text Messaging Terms & Consent AI Telescribe, Audio Capture & Documentation Consent
23. LEGAL AND REGULATORY REFERENCES
Health Insurance Portability and Accountability Act (HIPAA), 42 U.S.C. § 1320d et seq.; HIPAA Privacy, Security, and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. 45 C.F.R. § 164.520 — Notice of Privacy Practices for protected health information. U.S. Department of Health and Human Services, Office for Civil Rights, Model Notice of Privacy Practices for HIPAA Covered Health Care Providers, revised February 2026. U.S. Department of Health and Human Services, Office for Civil Rights, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (current guidance, including the 2024 federal-court limitation noted by HHS). Nevada Revised Statutes Chapter 603A, including Nevada consumer health data provisions enacted by SB 370 (2023). Washington My Health My Data Act, Wash. Rev. Code ch. 19.373, as applicable. Federal Trade Commission Act, 15 U.S.C. §§ 41–58, including prohibitions on unfair or deceptive acts or practices. Federal Trade Commission Health Breach Notification Rule, 16 C.F.R. Part 318, as applicable. Electronic Signatures in Global and National Commerce Act (E-SIGN), 15 U.S.C. § 7001 et seq., for electronic records and signatures where applicable. Applicable state medical-record confidentiality, breach-notification, consumer privacy, consumer-health-data, telehealth, minor-consent, communications, and professional-practice laws.
24.1 Primary online sources reviewed for Version 1.0
HHS — Model Notices of Privacy Practices (revised February 2026): https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/model-notices-privacy-practices/index.html HHS — Model Notice of Privacy Practices for HIPAA Covered Health Care Provider: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/privacy-practices-health-care-provider/index.html HHS OCR — Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html Nevada Legislature — NRS Chapter 603A, Security and Privacy of Personal Information: https://www.leg.state.nv.us/nrs/nrs-603a.html FTC — Health Breach Notification Rule, 16 C.F.R. Part 318: https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule
IMPORTANT: This Website & Consumer Privacy Policy is not MDTelemed LLC's HIPAA Notice of Privacy Practices. The HIPAA Notice of Privacy Practices is a separate document governing protected health information under HIPAA. Additional state privacy and consumer-health-data notices may also apply and should be read together with this Policy.