Privacy Statement

Who this statement covers

This Privacy Statement applies when you visit Medtrix, create or use an account, book or receive healthcare-related services, use community or pharmacy features, connect supported identity or wallet services, or otherwise communicate with Medtrix.

In this statement, “Medtrix,” “we,” “our,” and “us” refer to the Medtrix platform. A healthcare professional or another third party using Medtrix may separately control information they collect from you and may provide additional privacy terms.

Information we collect

We collect information directly from you, automatically from your browser or device, from professionals or service providers involved in your requested service, and from third parties you choose to connect.

Google and Microsoft account data

When you choose “Continue with Google” or “Continue with Microsoft,” the provider asks for your permission before sharing information with Medtrix. For authentication, Medtrix requests only the basic scopes needed to identify you: OpenID, email address, and basic profile information. Microsoft sign-in also uses the delegated User.Read permission to retrieve the signed-in account’s identifier, display name, and email address.

• We use the provider account identifier to distinguish the authorizing account.
• We use your name and email address to create, locate, and display your Medtrix account.
• We do not request access to Google Drive, Gmail, contacts, calendars, or other Google product content.
• We do not sell Google or Microsoft user data or use it for targeted advertising.
• We do not store the provider access token after the sign-in request has been completed.

You can revoke Medtrix’s access from your Google Account or Microsoft Account security settings. Revoking access stops future provider authorization but does not automatically erase information already stored in your Medtrix account. To request deletion, use the contact method below.

How we use information

• Authenticate you, create your account, maintain sessions, and provide account recovery and security functions.
• Operate appointments, consultations, pharmacy, community, rewards, transaction, and customer-support features.
• Personalize your profile, language, region, display, and service preferences.
• Process requested transactions and maintain accurate service and financial records.
• Detect fraud, misuse, security incidents, prohibited activity, and technical problems.
• Measure and improve reliability, accessibility, performance, and user experience.
• Send service notices, appointment updates, security alerts, and communications you request.
• Comply with law, enforce our Terms of Service, and protect users, professionals, Medtrix, and the public.

Where applicable law requires a legal basis, we rely on performance of our agreement with you, legitimate interests in operating and securing the platform, your consent, and compliance with legal obligations.

When information may be shared

We do not sell personal information. We may disclose only the information reasonably necessary in the following circumstances:

• Healthcare and service delivery: with a professional, pharmacy, delivery provider, or other participant needed to provide a service you request.
• Vendors: with hosting, security, communications, analytics, identity, payment, and infrastructure providers acting for Medtrix under appropriate obligations.
• At your direction: when you connect a third-party service, publish content, or otherwise ask us to share information.
• Legal and safety reasons: when reasonably necessary to comply with law, legal process, or enforceable requests, or to protect rights, safety, and platform integrity.
• Business changes: as part of a merger, financing, acquisition, reorganization, or transfer, subject to applicable safeguards.

Public posts and profile information you choose to publish may be visible to other users and should not contain information you want to keep confidential.

Retention and deletion

We retain personal information only for as long as reasonably needed to provide the service, keep required transaction or clinical-service records, resolve disputes, prevent fraud, enforce agreements, and satisfy legal, accounting, or regulatory requirements. Retention periods vary by the type of information and the reason it is held.

When information is no longer required, we take reasonable steps to delete, de-identify, or securely isolate it. Backups may retain limited copies for a short period until they are overwritten. We may retain de-identified information that cannot reasonably identify you.

Security and confidentiality

We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, or loss. These include access controls, session protection, encrypted provider connections, input validation, and monitoring appropriate to the platform.

No internet service can guarantee absolute security. Protect your connected accounts and devices, use only trusted networks, and notify us if you believe your Medtrix account or information has been compromised.

Your privacy choices and rights

Depending on your location, you may have the right to request access, correction, deletion, restriction, portability, or objection to certain processing. You may also withdraw consent where processing relies on consent. Some requests may be limited where information must be retained by law or for security, fraud prevention, transaction records, or legal claims.

• Update available profile and preference information from your Medtrix dashboard.
• Revoke Google or Microsoft authorization from the connected provider’s account settings.
• Control browser cookies through your browser, understanding that required session cookies are necessary for account access.
• Contact us to request account or personal information deletion.

We may verify your identity before completing a privacy request so that personal information is not disclosed or deleted improperly.

Children and guardian use

Medtrix accounts are not intended to be created independently by children who cannot legally consent to data processing in their location. A parent or legal guardian should manage services for a minor where permitted. If you believe a child provided personal information without appropriate authorization, contact us so we can review and take appropriate action.

International processing

Medtrix and its providers may process information in countries other than the country where you live. Privacy laws may differ across those locations. Where required, we use contractual, technical, or other recognized safeguards for international transfers.

Changes to this statement

We may update this Privacy Statement to reflect changes in our services, technology, legal requirements, or data practices. The effective date at the top identifies the current version. If a change materially affects how we use personal information, we will provide a reasonable notice through the platform or another appropriate channel.

Questions or privacy requests

Contact Medtrix if you have questions about this statement, want to exercise a privacy right, need to report a security concern, or want to request deletion of your account information.