MedRecPro Privacy Policy

1.1 Organization-Provided Accounts

If your employer, healthcare organization, or pharmaceutical company provides your MedRecPro account, they assume the role of Data Controller for most Personal Data used in our Services. In such cases, MedRecPro functions as a Data Processor, adhering to the Data Controller's instructions. Please refer to your organization's privacy policies for additional information.

1.2 Professional Services

When we provide training, consulting, or implementation services, the data protection terms in your service agreement govern the processing of your data.

2.1 Information You Provide

We collect information you provide directly, including:

Account Data

When you create an account, we collect your name, email address, and profile information provided by your authentication provider (Microsoft, Google, or Apple).

Profile Information

Optional information you provide such as professional title, organization name, pharmacy license numbers, or other professional credentials.

User Content and Files

Pharmaceutical labeling documents, SPL files, annotations, notes, and other content you upload or create within the Services.

Support Data

Information you provide when contacting customer support, including descriptions of issues, screenshots, and communication history.

Feedback Data

Information you submit through surveys, feature requests, or interactive feedback mechanisms.

Payment Information

For paid subscriptions, billing details including name, billing address, and payment method information processed through our payment provider.

2.2 Information Collected Automatically

When you use our Services, we automatically collect certain information:

Service Usage Information

Data about your interactions with the Services, including IP address, device information, browser type, session details, date and time of requests, pages viewed, features used, and search queries.

Device Information

Operating system, device type, device identifiers, screen resolution, and application version.

Geolocation Data

Approximate geographic location based on IP address to provide region-appropriate services and comply with jurisdictional requirements.

Log Data

Server logs that record your access to the Services, including timestamps, referring URLs, and actions performed.

Performance Data

Information about service performance, error reports, and diagnostic data to maintain and improve the Services.

2.3 Information from Third Parties

We may receive information about you from third-party sources:

Authentication Providers

When you authenticate using Microsoft, Google, or Apple, we receive your name, email address, and profile information as permitted by your settings with those services.

Publicly Available Sources

We may collect publicly available professional information such as pharmacy license verification data from state boards of pharmacy.

Organization Administrators

If you are part of an organization account, administrators may provide information about you for account management purposes.

3.1 Service Provision

To provide, maintain, and improve our pharmaceutical labeling management Services, including processing SPL documents, managing labeling workflows, and delivering personalized experiences.

3.2 Authentication and Security

To authenticate your identity, authorize access to features based on your role and permissions, maintain session security, detect and prevent fraud, abuse, and security threats.

3.3 Communication

To send service-related notifications, respond to support requests, provide updates about features or policy changes, and deliver information you have requested.

3.4 Analytics and Improvement

To analyze usage patterns, identify accessibility gaps, troubleshoot issues, and improve the Services' functionality, performance, and user experience.

3.5 AI-Assisted Features

When you use AI-powered features, your queries and relevant document content may be processed by third-party AI services (such as Anthropic's Claude) to generate responses and analysis. We do not use your content to train AI models.

3.6 Compliance and Legal Obligations

To comply with applicable laws, regulations, and legal processes, including FDA regulations, healthcare data requirements, and responding to lawful requests from authorities.

3.7 Business Operations

To conduct billing, accounting, capacity planning, and other business operations necessary to provide the Services.

4.1 Data Ownership

You retain full ownership of all SPL documents, labeling content, and related data you upload or create through the Services. MedRecPro processes this data solely to provide the Services you request.

4.2 FDA Compliance

We process SPL data according to FDA Structured Product Labeling specifications and HL7 standards. Our processing supports, but does not replace, your organization's regulatory compliance obligations.

4.3 Data Accuracy

While we strive for accuracy in rendering and processing SPL data, you remain responsible for verifying the accuracy of pharmaceutical labeling content before submission to regulatory authorities.

4.4 Protected Health Information

MedRecPro is not designed to process Protected Health Information (PHI) as defined by HIPAA. Do not upload patient-identifiable health information to the Services.

5.1 Service Providers

We engage trusted third-party service providers to perform functions on our behalf, including cloud hosting (Microsoft Azure), content delivery (Cloudflare), authentication services, payment processing, and analytics. These providers are contractually obligated to protect your data and use it only for the services they provide to us.

5.2 AI Service Providers

When you use AI-powered features, relevant data is processed by Anthropic's Claude API. Anthropic's data processing is governed by their privacy policy and our data processing agreement with them.

5.3 Organization Administrators

If you use MedRecPro through an organization account, your organization's administrators may have access to your account information and usage data as permitted by your organization's agreement with us.

5.4 Legal and Safety Purposes

We may disclose Personal Data when we believe in good faith that disclosure is necessary to comply with applicable laws or legal processes, protect the rights, property, or safety of MedRecPro, our users, or the public, or detect, prevent, or address fraud, security, or technical issues.

5.5 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your Personal Data may be transferred as part of that transaction. We will notify you of any such change and the choices you may have regarding your data.

5.6 With Your Consent

We may share your Personal Data with other parties when you explicitly consent to such sharing.

6.1 Infrastructure

Your data is stored securely on Microsoft Azure infrastructure in the East US 2 region. Azure maintains SOC 2 Type II, ISO 27001, and other security certifications.

6.2 Encryption

We implement encryption at rest using AES-256 encryption for stored data and encryption in transit using TLS 1.2 or higher for all data transmission.

6.3 Access Controls

We employ role-based access controls, secure authentication mechanisms, and the principle of least privilege to limit access to Personal Data to authorized personnel who require it for legitimate business purposes.

6.4 Security Practices

We conduct regular security assessments, maintain security logs and monitoring, implement secure software development practices, and promptly address identified vulnerabilities.

6.5 Incident Response

We maintain incident response procedures to detect, respond to, and recover from security incidents. In the event of a data breach affecting your Personal Data, we will notify you and relevant authorities as required by applicable law.

7.1 Account Data

We retain your account information for as long as your account remains active. Upon account deletion, we will delete or anonymize your Personal Data within 90 days, except where retention is required for legal obligations or legitimate business purposes.

7.2 SPL Documents and Content

User-uploaded documents and content are retained until you delete them or request account deletion. Deleted content may be retained in backups for up to 30 days.

7.3 Usage and Log Data

Service usage logs and analytics data are typically retained for up to 24 months for service improvement and security purposes, then deleted or anonymized.

7.4 Legal Requirements

We may retain certain data for longer periods when required by law, to resolve disputes, enforce our agreements, or protect our legal rights.

8.1 General Rights

Subject to applicable law, you have the right to:

Access

Request access to the Personal Data we hold about you.

Correction

Request correction of inaccurate or incomplete Personal Data.

Deletion

Request deletion of your Personal Data, subject to certain exceptions.

Portability

Receive your Personal Data in a structured, commonly used, machine-readable format.

Restriction

Request restriction of processing of your Personal Data under certain circumstances.

Objection

Object to processing of your Personal Data for certain purposes.

Withdraw Consent

Where processing is based on consent, withdraw that consent at any time.

8.2 Exercising Your Rights

To exercise your privacy rights, contact us at [email protected]. We will respond to your request within the timeframe required by applicable law (typically 30-45 days). We may need to verify your identity before processing your request.

8.3 Account Settings

You can access, update, and manage much of your account information directly through your account settings in the Services.

8.4 Appeals

If we deny your rights request, you have the right to appeal that decision. We will provide you with information on how to submit an appeal at that time.

9.1 Contractual Necessity

Processing necessary to perform our contract with you, including providing the Services, managing your account, and delivering features you request.

9.2 Legitimate Interests

Processing necessary for our legitimate interests, including improving the Services, ensuring security, conducting analytics, and communicating with you, provided these interests are not overridden by your data protection rights.

9.3 Legal Obligation

Processing necessary to comply with applicable laws and regulations.

9.4 Consent

Where required by law, we will obtain your consent before processing your Personal Data. You may withdraw consent at any time.

10.1 Transfer Mechanisms

When we transfer Personal Data from the EEA, UK, or Switzerland to countries not recognized as providing adequate data protection, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

10.2 Data Privacy Framework

We are committed to complying with applicable data transfer requirements and protecting your Personal Data regardless of where it is processed.

11.1 Essential Cookies

We use essential cookies for authentication, session management, security, and core functionality. These cookies are necessary for the Services to function and cannot be disabled.

11.2 Analytics Cookies

We may use analytics cookies to understand how users interact with the Services, identify usage patterns, and improve functionality. You can opt out of analytics cookies through your browser settings.

11.3 No Advertising Cookies

We do not use advertising or third-party tracking cookies. We do not sell your Personal Data or share it for targeted advertising purposes.

11.4 Cookie Controls

You can manage cookie preferences through your browser settings. Note that disabling essential cookies may affect the functionality of the Services.

11.5 Do Not Track

We honor Do Not Track (DNT) signals sent by your browser. When we detect a DNT signal, we will not set non-essential cookies.

12.1 Authentication Providers

We use Microsoft, Google, and Apple for authentication. Their privacy policies govern their collection and use of your data: Microsoft Privacy Statement (https://privacy.microsoft.com), Google Privacy Policy (https://policies.google.com/privacy), Apple Privacy Policy (https://www.apple.com/legal/privacy/).

12.2 Cloud Infrastructure

Our Services are hosted on Microsoft Azure. Microsoft's privacy practices are governed by the Microsoft Privacy Statement and applicable data processing agreements.

12.3 AI Services

AI-powered features are provided through Anthropic's Claude API. Anthropic's privacy policy (https://www.anthropic.com/privacy) governs their processing of data.

12.4 Content Delivery

We use Cloudflare for DNS management and content delivery. Cloudflare's privacy policy (https://www.cloudflare.com/privacypolicy/) governs their data processing.

13.1 California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know

You have the right to request information about the categories and specific pieces of Personal Data we have collected about you.

Right to Delete

You have the right to request deletion of your Personal Data, subject to certain exceptions.

Right to Correct

You have the right to request correction of inaccurate Personal Data.

Right to Opt-Out of Sale/Sharing

We do not sell your Personal Data or share it for cross-context behavioral advertising.

Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

13.2 Virginia, Colorado, and Connecticut Residents

Residents of Virginia, Colorado, and Connecticut have similar rights to access, correct, delete, and port their Personal Data, as well as the right to opt out of targeted advertising, sale of Personal Data, and profiling. You also have the right to appeal our decision regarding a rights request.

13.3 Categories of Personal Information

In the past 12 months, we have collected the following categories of Personal Information: identifiers (name, email address, IP address), professional information (job title, organization), internet activity information (usage data, log data), and geolocation data (approximate location based on IP address).

13.4 Exercising Your Rights

To exercise your rights under state privacy laws, email [email protected] or submit a request through your account settings. You may also designate an authorized agent to make requests on your behalf.