Med.xyz Logo
Med.xyz
Draft for review. This document has not been finalized by qualified legal counsel. It is published as a working draft to support the launch readiness review and is not legally binding in its current form.

HIPAA Notice of Privacy Practices

Effective: October 15, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our role

Med.xyz is a health-technology platform. Where we receive Protected Health Information (“PHI”) on behalf of, or in service to, a HIPAA-covered entity, we operate as a Business Associate. Where individuals upload health information directly to the Service for their own personal wellness use, we maintain the privacy and security protections described below as a matter of policy.

How we may use and disclose your PHI

  • Treatment: to support care coordination with healthcare providers you authorize.
  • Payment: to process payments for your subscription and to coordinate benefits, where applicable.
  • Healthcare operations: for quality improvement, customer support, and administrative functions.
  • As required by law: when disclosure is required by federal, state, or local law.
  • Public health and safety: to prevent or lessen a serious threat to health or safety, or as required for public-health activities.
  • Health oversight: in response to lawful audit, investigation, or licensure activity.
  • Legal proceedings: in response to a valid subpoena, court order, or similar process.
  • De-identified information: we may de-identify your health information in accordance with HIPAA's de-identification standard, 45 C.F.R. § 164.514(a)–(b), using either the Safe Harbor method (removing the identifiers listed in the rule) or the Expert Determination method (a qualified expert determines that the risk of re-identification is very small). Information de-identified in this way is no longer PHI, and we may use it for analytics, for research, and to improve our services. We will not attempt to re-identify de-identified information. Where we act as a Business Associate, we de-identify PHI only as permitted by our business associate agreement with the covered entity.
  • Limited data sets: we may use or disclose a limited data set (health information from which direct identifiers have been removed) for research, public-health, or healthcare-operations purposes, but only under a data use agreement that meets the requirements of 45 C.F.R. § 164.514(e).
  • With your authorization: for any purpose not described above, only with your written authorization, which you may revoke at any time.

We do not sell PHI. We do not use or disclose PHI for marketing purposes that require authorization without first obtaining your written authorization. We do not use PHI to train general-purpose AI models.

Your rights

  • Right to access: you have the right to inspect and obtain a copy of PHI we maintain about you, including in electronic form where readily producible.
  • Right to amend: you may request that we amend PHI you believe is inaccurate or incomplete.
  • Right to an accounting of disclosures: you may request a list of certain disclosures of your PHI made by Med.xyz.
  • Right to request restrictions: you may request limits on certain uses and disclosures.
  • Right to confidential communications: you may request that we communicate with you in a particular way or at a particular location.
  • Right to a paper copy of this Notice: available on request.
  • Right to be notified of a breach: we will notify you in the event of a breach of unsecured PHI affecting your information, in accordance with HIPAA and applicable state law.

Our duties

  • We are required by law to maintain the privacy and security of your PHI.
  • We are required to provide you with this Notice of our legal duties and privacy practices.
  • We will follow the terms of the Notice currently in effect.
  • We will not use or disclose your PHI other than as described in this Notice unless we have your written authorization, or unless permitted by law.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Privacy Officer at privacy@med.xyz. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue SW, Washington, D.C. 20201, or by visiting https://www.hhs.gov/hipaa/filing-a-complaint. We will not retaliate against you for filing a complaint.

Changes to this Notice

We reserve the right to change this Notice and to make the new Notice apply to PHI we already have, as well as to PHI we receive in the future. The most current version is always available on this page.

Contact

Privacy Officer
Med.xyz
privacy@med.xyz
30 E Broadway, Suite 203 #1053
Salt Lake City, UT 84111