Privacy Policy

1. Introduction

Your privacy is fundamental to the work we do. Medical Insightz Private Limited ("Medical Insightz," "we," "us," or "our") provides AI-powered medical-legal review services to law firms, insurance carriers, and healthcare organizations across the United States.

This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices you have. It applies to medicalinsightz.com, our secure client portal, and all services we provide.

2. Information We Collect

2.1 Information You Provide

• Contact information — name, law firm, email, phone, and any details submitted through our contact forms or sample-document download requests.
• Account information — credentials, organization details, and user roles when you register for our secure portal.
• Case-related communications — messages, notes, and instructions you send to our team about specific case files.
• Medical records and Protected Health Information (PHI) — documents you upload for review, including medical chronologies, billing records, deposition transcripts, and related case materials.

2.2 Information We Collect Automatically

• Usage data — pages visited, features used, time on page, referral source, and similar analytics that help us improve the experience.
• Device and technical data — IP address, browser type, operating system, device identifiers, and approximate geographic location (country/state level only).
• Cookies and tracking technologies — see Section 8 for details.

2.3 Information from Third Parties

• If you sign in via a third-party identity provider, we receive the basic profile information that provider shares.
• If a colleague invites you to collaborate on a case, we receive their contact details for you.

3. Why We Collect Your Data

We collect and process information for the following purposes:

• Service delivery — to perform medical record review, generate chronologies, narrative summaries, demand letter support, and other contracted services.
• Account management — to authenticate users, provision access, and maintain accurate billing.
• Communication — to respond to inquiries, send service-related notifications, and (only with your consent) send relevant content or product updates.
• Quality assurance — to audit deliverables, train our human reviewers, and maintain SOC 2-aligned controls.
• Legal compliance — to fulfill our HIPAA obligations, respond to lawful requests, and maintain required records.
• Product improvement — to analyze aggregated usage data and improve our website and services. We never use client PHI to train external AI models.

4. HIPAA & Data Protection

Medical Insightz operates as a Business Associate under HIPAA. Every client engagement begins with a signed Business Associate Agreement (BAA) that defines our responsibilities for safeguarding PHI.

4.1 Technical Safeguards

• Encryption at rest — AES-256 encryption for all stored PHI
• Encryption in transit — TLS 1.2+ on all network connections
• Access controls — role-based access, multi-factor authentication, automatic session timeouts
• Audit logging — every PHI access is logged and retained for compliance review
• Network security — segmented infrastructure, intrusion detection, and continuous monitoring

4.2 Administrative Safeguards

• Workforce training on HIPAA, security, and confidentiality at hire and annually
• Background checks for all personnel handling PHI
• Documented incident response and breach notification procedures
• Periodic risk assessments and third-party security audits
• SOC 2-aligned internal controls

4.3 Physical Safeguards

Servers are hosted in SOC 2 / ISO 27001-certified data centers with biometric access controls, 24×7 surveillance, and environmental protections.

5. Data Sharing

We do not sell, lease, or trade your personal information or PHI to third parties. We share information only in the following limited circumstances:

• With your direction — when you instruct us to deliver a completed work product, send records to opposing counsel, or share with another party.
• With service providers under BAA — vetted infrastructure and software vendors that support our operations and are contractually bound to the same HIPAA standards we maintain.
• For legal reasons — when required by subpoena, court order, or other valid legal process, or to protect the rights, property, or safety of Medical Insightz, our clients, or others.
• In a business transition — in the event of a merger, acquisition, or asset sale, your information may transfer to the successor entity, subject to the same protections described here.

6. Storage & Retention

We retain information only as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations.

• PHI and case files — retained per the terms of the applicable BAA and your firm's records-retention policy. We securely return or destroy PHI upon termination of services or at your written request.
• Contact form submissions — name, firm name, email, and message details are retained for up to 90 days for follow-up purposes, then securely deleted unless an active business relationship exists.
• Sample-document download requests — lead information retained for up to 12 months for sales follow-up and lifecycle marketing.
• Account and billing records — retained for the duration of the account plus the period required by tax and accounting laws (typically 7 years).
• Audit logs and security records — retained for at least 6 years to meet HIPAA retention requirements.

7. Your Rights

Depending on your jurisdiction and the nature of the information, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete personal information we no longer need to retain
• Restrict or object to certain processing activities
• Data portability — receive your information in a structured, machine-readable format
• Withdraw consent at any time for processing based on consent
• Opt out of marketing communications using the unsubscribe link in any email or by emailing us

For PHI specifically, patient rights under HIPAA (access, amendment, accounting of disclosures) are exercised through the covered entity (the healthcare provider or law firm acting on the patient's behalf), not directly with us as a Business Associate.

To exercise any of these rights, email contact@medicalinsightz.com. We will respond within 30 days.

8. Cookies & Tracking

We use cookies and similar technologies to operate the website, remember preferences, and analyze usage. The categories we use:

• Essential cookies — required for the website and portal to function (login state, security tokens). Cannot be disabled.
• Analytics cookies — Google Analytics 4 (GA4) and Zoho PageSense help us understand how the site is used so we can improve it. You may opt out via your cookie preferences or browser settings.
• Functional cookies — remember your choices (e.g., dismissed cookie banner).

We do not use third-party advertising cookies or sell information to ad networks.

9. Children's Privacy

Our services are intended for use by legal professionals and authorized business users. We do not knowingly collect personal information from children under 13. If you believe a child has submitted information, please contact us and we will delete it promptly.

10. International Transfers

Medical Insightz is based in the United States and processes data in the U.S. and at the location of our SOC 2-aligned hosting providers. If you access our services from outside the U.S., your information will be transferred to and processed in the U.S., which may have data-protection laws different from those in your country.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, provide additional notice (such as a banner on our website or an email to registered users).

We encourage you to review this page periodically. Your continued use of our services after a revised policy is posted constitutes your acceptance of the updated terms.

12. Contact Us

For questions, concerns, or requests related to this Privacy Policy or how we handle your information: