Privacy Policy

1. Information We Collect

• When you register, we collect your name, email address, and, if you provide one, organisation name.
• We collect aggregated feature and reliability signals to keep the service working. This is not a log of clinical chart content.
• Text you submit for coding is processed to generate code suggestions for your session. Charts, prompts, and model outputs are not retained as logs. Saved work is kept only if you explicitly save it.
• Authentication and billing run on our platform; payment card numbers are not stored on our systems.
• If you contact us we retain the content of that correspondence.

2. How We Use Your Information

• To provide, operate, and improve the MedicalCode AI service.
• To authenticate your identity and maintain your account.
• To send transactional emails (e.g. receipts, password resets).
• To detect and prevent fraud, abuse, and security incidents.
• To comply with legal obligations.
• Clinical charts are processed solely to provide coding suggestions to you. We do not sell your personal or clinical data. We do not use submitted charts, prompts, or outputs to train shared models.

3. HIPAA and Clinical Privacy

MedicalCode AI is built privacy-first and designed around HIPAA, GDPR, and PDPA where they apply. Clinical notes you submit may constitute Protected Health Information (PHI). Sensitive identifiers (names, MRNs, dates of birth, addresses, contact details) are masked before a chart reaches the coding system. We strongly recommend de-identifying patient data before submission, especially for pilots. If your organisation requires a Business Associate Agreement (BAA), please contact us at info@medicoder.io before processing any PHI through the platform.

4. Data Retention

• Account data is retained for the lifetime of your account plus 90 days after deletion. Clinical charts, prompts, and outputs are not logged; session-only clinical data is purged at session end. Items you explicitly save are retained until you delete them or close your account. Security and account audit logs, which do not contain clinical chart content are retained for 12 months.
• Google Analytics event data is kept for 14 months. The _ga cookies Google Analytics sets last up to 2 years.
• Google Ads cookies last as set out in Google's Ads cookies policy.

5. Data Security

• All data in transit is encrypted with TLS 1.2 or higher. Data at rest is encrypted using AES-256.
• Access to production systems is restricted to authorised personnel and is logged.
• Sensitive identifiers are masked before a chart reaches the coding system.
• We operate under a strict no-logging principle: prompts and outputs are not retained and are never used to train shared models.
• We conduct regular security reviews and vulnerability assessments.

6. Cookies and Tracking

• Session cookies are used to keep you signed in during a browsing session.
• Preference cookies are used to remember your colour mode (light/dark) setting.
• On this website and on the sign-in and sign-up pages of our app, we use Google Analytics and Google Ads to measure visits and how well our advertising works. These services set cookies and receive information such as the pages you view, your browser and device, and whether you arrived from one of our ads and went on to create an account or upgrade your plan. They do not record what you do inside the coding workspace, and no clinical note content is ever sent to them.
• Google processes this information under its own privacy policy. You can opt out of Google Analytics with Google's browser add-on and manage ad personalisation in My Ad Center.
• For visitors in the European Economic Area, the United Kingdom and Switzerland, analytics and advertising storage is denied by default. There is no consent banner yet, so Google Analytics and Google Ads cookies are not set for those visitors. Google may still receive cookieless pings that carry no identifier stored on your device.
• We do not sell personal data.

7. Your Rights

• You may request a copy of the personal data we hold about you.
• You may update inaccurate personal data via your account settings or by contacting us.
• You may request deletion of your account and associated data.
• You may request an export of your data in a machine-readable format.
• To exercise any of these rights, email info@medicoder.io.

8. Children's Privacy

MedicalCode AI is intended for healthcare professionals and organisations. We do not knowingly collect personal information from individuals under the age of 18.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, notify you by email or via an in-app banner.

10. Contact Us

Questions about this policy? Contact us at info@medicoder.io or visit medicalcodeai.com/contact.