Privacy Policy

Medozai Inc. ("Medozai," "we," "us," or "our") is committed to protecting the privacy of the healthcare practices and individuals who use our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

1. Information We Collect

Information You Provide

• Account information: Name, email address, phone number, clinic name, and billing details when you register.
• Practice information: Provider credentials, NPI numbers, specialty, and practice configuration.
• Communications: Messages you send us via email, contact forms, or in-app chat.

Information Collected Automatically

• Usage data: Pages visited, features used, session duration, and interaction patterns.
• Device information: IP address, browser type, operating system, and device identifiers.
• Cookies and similar technologies: Session tokens, preferences, and analytics identifiers.

Protected Health Information (PHI)

When Medozai is used to manage patient scheduling, communications, or billing on behalf of your practice, we may process Protected Health Information (PHI) as your Business Associate under HIPAA. This processing is governed by our Business Associate Agreement (BAA), not this Privacy Policy. This can include audio recordings of patient visits, their transcripts, and clinical notes generated from them when your practice uses our scribe features.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Medozai platform
• Process transactions and send related account information
• Respond to comments, questions, and support requests
• Send administrative emails and operational updates
• Monitor and analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues or security incidents
• Comply with legal obligations

3. How We Share Your Information

We do not sell your personal information. We may share information with:

• Service providers: Vendors who help us deliver our platform (cloud hosting, analytics, customer support tools), all under confidentiality agreements.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to you.
• Legal compliance: When required by law, subpoena, or other legal process.
• Safety: To protect the rights, property, or safety of Medozai, our users, or the public.

4. Data Retention

We retain your information for as long as your account is active or as needed to provide our services. You may request deletion of your account at any time by contacting us at connect@medozai.com. We will retain certain information as required by law or for legitimate business purposes.

5. Security

We implement industry-standard security measures including encryption in transit (TLS 1.2+), encryption at rest, access controls, and regular security assessments. We maintain a SOC 2 Type II audit program. No system is completely secure — if you believe your account has been compromised, contact us immediately.

6. HIPAA Compliance

Medozai is a HIPAA-compliant platform. We sign Business Associate Agreements (BAAs) with all covered entity customers. Our security practices, access controls, and audit logging are designed to meet HIPAA requirements. For detailed documentation, visit our Trust Center.

7. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your personal information
• Object to or restrict processing of your information
• Data portability — receive your data in a machine-readable format

To exercise these rights, contact us at connect@medozai.com.

8. Cookies

We use essential cookies for authentication and session management, and analytics cookies to understand how our platform is used. You can control cookie preferences through your browser settings. Disabling certain cookies may affect platform functionality.

9. Children's Privacy

Medozai is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected such information, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on our platform. Your continued use of Medozai after such notification constitutes acceptance of the updated policy.

11. SMS / Text Messaging

When you opt in to receive SMS from a clinic that uses Medozai, the mobile phone number and consent you provide are used only to send transactional, appointment-related text messages — such as appointment confirmations and requests, intake-form links, and appointment reschedule/cancel links. Message frequency varies and is typically 1–2 messages per appointment. Message and data rates may apply.

Mobile phone numbers and SMS opt-in consent data are never sold, and are not shared with third parties or affiliates for marketing or promotional purposes. This information is shared only with our SMS delivery provider (Twilio) strictly to transmit the messages you requested. You can opt out at any time by replying STOP, or reply HELP for assistance.

12. Medozai Companion Browser Extension

The Medozai Companion Chrome extension lets signed-in practice staff view today's appointments, book appointments, and use the Ad-hoc Scribe from a browser side panel. It works with the same account, role, and permissions you have in Medozai.

• What it handles: the information shown in those features, which can include patient names, contact details, appointment details, and protected health information. It also handles audio you record or upload in the Ad-hoc Scribe, the resulting transcript, and generated notes.
• Where it goes: only to Medozai's servers over encrypted connections, and to our service providers as described in this policy, in order to provide those features. Audio is recorded only after patient consent is confirmed in the extension.
• What stays on your device: your sign-in tokens and the panel's lock state, kept in the extension's own browser storage. They are cleared when you sign out and when the extension is removed.
• What it does not do: it does not read or collect the content of other websites, does not use advertising or analytics trackers, and does not sell your data or use it for any purpose other than providing the extension's features.
• Sign-in: you sign in through Medozai's Auth0 login page. The extension never sees your password.

Retention and deletion follow Section 4 and your practice's agreement with us. To ask about or delete data, contact connect@medozai.com. The extension's use of information received from Chrome browser APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at:

Medozai Inc.
Email: connect@medozai.com
Website: trust.medozai.com