Privacy Policy

MD Telemed ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our telemedicine Platform, including when you sign up, book appointments, attend video visits, manage medical records, or contact support.

Health information you provide may be protected under applicable laws, including the Health Insurance Portability and Accountability Act (HIPAA) where we act as a covered entity or business associate. This Policy supplements—not replaces—any Notice of Privacy Practices provided for HIPAA-covered treatment.

Depending on how you use the Platform, we may collect:

• Account and identity data: name, email, phone number, password (stored in hashed form), role (patient, doctor, or admin), timezone, and profile status.
• Clinical and appointment data: medical history, visit preferences, appointment details, notes, prescriptions, ratings, and documents you upload during onboarding or care.
• Communications: messages with support, contact form submissions, and in-platform notifications.
• Payment information: billing details and transaction records processed through our payment partners (we do not store full card numbers on our servers where tokenization is used).
• Technical data: device and browser type, IP address, cookies, session identifiers, and security logs used to protect accounts and meet organizational security policies (including session timeout controls).
• Video visit data: audio/video streams during consultations are transmitted through our real-time communications provider only for the duration of the visit, subject to permissions you grant in your browser or device.

We use information to:

• Create and authenticate accounts, including email verification and password recovery.
• Facilitate appointment booking, reminders, virtual visits, and clinical workflows for patients and providers.
• Process payments, issue receipts, and support billing inquiries.
• Operate doctor onboarding, credential review, and administrative dashboards.
• Improve Platform reliability, security, fraud prevention, and customer support.
• Comply with legal obligations and respond to lawful requests.

Where required by law (for example, in certain jurisdictions outside the United States), we process personal data based on your consent, performance of a contract, legitimate interests in operating a secure telemedicine service, or compliance with legal obligations.

We do not sell your personal information. We may share information with:

• Healthcare providers you choose, so they can deliver care and maintain appropriate medical records.
• Service providers that help us host the Platform, send email or SMS, process payments, provide video infrastructure, or perform security monitoring—bound by contractual confidentiality and security obligations.
• Administrators authorized to manage doctors, services, appointments, and support inquiries.
• Regulators, courts, or law enforcement when required by law or to protect rights, safety, and security.
• Successors in connection with a merger or acquisition, subject to continued protections.

Medical information entered for treatment, payment, or healthcare operations may constitute protected health information (PHI). We apply administrative, technical, and physical safeguards designed to protect PHI, including access controls, encryption in transit where supported, and workforce policies aligned with healthcare privacy standards.

Providers participating on the Platform are responsible for using PHI only for permitted purposes under applicable law and their professional obligations.

We retain information for as long as needed to provide the Platform, resolve disputes, enforce agreements, and meet legal and clinical record retention requirements. Health records may be retained for periods required by healthcare regulations even after you close your account.

Patients signed in to the Platform can access certain privacy controls under Settings → Data & privacy, including:

• Downloading a machine-readable JSON export of personal data and medical records associated with your account.
• Requesting permanent deletion of your account and associated records from the app, which signs you out and cannot be undone, subject to legal retention exceptions.
• Updating profile and medical history information where the Platform allows self-service edits.

Depending on your location, you may have rights to access, correct, delete, or restrict certain processing of personal information, or to opt out of specific disclosures. To exercise these rights, contact support@mdtelemed.com. We will verify requests as required by law.

We use cookies and similar technologies to keep you signed in, remember preferences, and secure the Platform. You can control cookies through browser settings; disabling essential cookies may limit functionality.

We implement safeguards such as authentication tokens, password policies, content security policies, and automatic session timeout after periods of inactivity. No method of transmission or storage is completely secure; please use a strong, unique password and protect your device.

The Platform is not directed to children under 13. Accounts for minors should be created and managed by a parent or guardian where permitted. If you believe we collected information from a child without appropriate consent, contact us to request deletion.

If you access the Platform from outside the United States, your information may be processed in the United States or other countries where our service providers operate, which may have different data protection laws than your home country.

We may update this Privacy Policy from time to time. The “Last updated” date at the top indicates when changes were posted. Material changes may also be communicated through the Platform or by email where appropriate.

Privacy questions or requests: support@mdtelemed.com | +1 (800) 555-1234. You may also reach us through Contact.