Med.xyz Logo
Med.xyz
Draft for review. This document has not been finalized by qualified legal counsel. It is published as a working draft to support the launch readiness review and is not legally binding in its current form.

Privacy Policy

Effective: October 15, 2026

1. Who we are

Med.xyz (“Med.xyz,” “we,” “us,” or “our”) operates the website at https://www.med.xyz and the associated services that allow individuals to upload health-related documents, receive AI-assisted summaries, and track personal wellness information (collectively, the “Service”).

To the extent we receive Protected Health Information (“PHI”) on behalf of, or in service to, a covered entity, we operate as a Business Associate under the Health Insurance Portability and Accountability Act (“HIPAA”). When we receive personal information directly from consumers outside of a covered-entity relationship, that information is governed by this Privacy Policy and any applicable consumer-health-data laws.

2. Information we collect

We collect the following categories of information when you use the Service:

  • Account information: name, email address, password (managed by our authentication provider), profile preferences.
  • Health information you submit: bioresonance scan reports, lab results, hormone panels, medications, symptoms, medical history, insurance documents, and other documents you upload.
  • Derived health insights: scores (including your MedQ Score), AI-generated summaries, body-region findings, and recommendations produced from the documents you upload.
  • Payment information: processed by our payment provider; we do not store full card numbers.
  • Device and usage information: IP address, browser type, pages viewed, timestamps, and similar log data, including through analytics cookies on our public marketing pages (see Advertising and Analytics below).
  • Communications: messages you send to support and feedback you provide.

3. How we use your information

  • To provide, operate, and improve the Service.
  • To analyze documents you upload and generate summaries, scores, and recommendations.
  • To authenticate you, secure your account, and prevent fraud or abuse.
  • To process payments and manage subscriptions.
  • To communicate with you about your account, the Service, and (with your consent) marketing messages.
  • To comply with legal obligations and enforce our Terms.

We do not sell your personal information. We do not use your health information for advertising.

4. Service providers and processors

We rely on a small set of vetted vendors to operate the Service. Each vendor that handles PHI on our behalf is required to enter into a HIPAA Business Associate Agreement with us. Current categories include:

  • Cloud hosting and database providers.
  • Authentication and identity providers.
  • AI model providers used to summarize the documents you upload.
  • Payment processors.
  • Email delivery and customer-support tooling.
  • Web analytics on our public marketing pages only (Google Analytics). Google Analytics does not receive health information or PHI; see Advertising and Analytics below.

A current list of subprocessors is available on request by contacting us at the address below.

5. Advertising and Analytics

We use Google Analytics, an analytics service provided by Google, on our public marketing pages (such as our home page, our sign-in and sign-up pages, and our legal pages) to measure how visitors find and use the site. Google Analytics uses cookies and similar technologies and may collect information about your visits, such as pages viewed and actions taken, along with device and browser identifiers and an approximate location derived from your IP address. We configure Google Analytics not to use Google signals or ad-personalization signals, so this information is not used for advertising. We do not use advertising pixels.

Google Analytics never loads on signed-in account pages, and it never receives your health information, the documents you upload, or anything derived from them. We do not sell personal information, and we never share your health information, scans, lab results, uploaded documents, or other protected health information with advertising or analytics partners.

You can opt out of Google Analytics at any time on our Your Privacy Choices page. We also honor the Global Privacy Control (GPC) browser signal as an opt-out.

6. AI processing of health documents

When you upload a document, the contents may be transmitted to an AI model provider that operates under a HIPAA Business Associate Agreement and a zero-retention configuration. Our AI providers do not use your data to train general-purpose models. Outputs (such as your MedQ Score) are stored in your account so that you can view them again. You can delete uploaded documents and derived outputs from your account at any time.

7. De-identified Data and AI

Med.xyz may create de-identified and aggregated statistics from information in Med.xyz and from how Med.xyz is used, combined across many users, so that they cannot reasonably be linked to any person, family, household or organization (“De-identified Data”). We may use De-identified Data to operate, measure, improve and develop Med.xyz, including its analytics and AI features, and Med.xyz owns it. We will not try to re-identify De-identified Data, and anyone we share it with must agree not to try either.

We never use personal information to train AI models. This includes health information, scans, lab results and other protected health information and anything else that identifies a person. Health information is de-identified only as permitted by HIPAA (45 C.F.R. § 164.514) before any aggregate use. We do not sell personal information or share it for cross-context behavioral advertising.

8. How we secure your information

  • Encryption in transit (TLS 1.2+) for all traffic to and from the Service.
  • Encryption at rest for stored data and uploaded files.
  • Role-based access controls and least-privilege production access.
  • Audit logging of access to identifiable health information.
  • Regular review of vendor compliance posture.

No system can be guaranteed perfectly secure. If we detect a breach affecting your information, we will notify you and the appropriate regulators in accordance with applicable law.

9. Retention and deletion

We retain your information for as long as your account is active and for a reasonable period afterward to comply with legal, audit, and dispute-resolution obligations. Audit logs are retained for at least six (6) years where required by HIPAA. You can request deletion of your account by emailing privacy@med.xyz. We will honor verified deletion requests within the time frames required by applicable law.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or limit our processing of your personal information. Specifically:

  • If you are in California, you have rights under the CCPA/CPRA, including the right to know, delete, correct, and limit the use of sensitive personal information, and the right to opt out of the “sale” or “sharing” of personal information. We do not sell personal information. You can opt out of sale or sharing, including our use of analytics cookies, on our Your Privacy Choices page or by turning on the Global Privacy Control (GPC) signal in your browser, which we honor automatically. Residents of other states with similar laws can use the same choices.
  • If you are in Washington, Nevada, or Connecticut, you have rights under state consumer-health-data laws (including the Washington My Health My Data Act).
  • If you are in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the GDPR/UK GDPR.

To exercise any of these rights, email us at privacy@med.xyz. We may need to verify your identity before fulfilling the request.

11. Children

The Service is not directed to children under 13 (or under 16 in some jurisdictions). We do not knowingly collect information from children. If you believe a child has provided information to us, please contact us so we can delete it.

12. International transfers

Med.xyz is operated from the United States. If you access the Service from outside the United States, your information will be processed in the United States and may be transferred to vendors in other jurisdictions under appropriate safeguards.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated via the Service or by email. The “Effective” date at the top of this page indicates the most recent revision.

14. Contact

Questions, complaints, or requests regarding this Policy may be sent to privacy@med.xyz or by mail to our Privacy Officer at:

Med.xyz, Attn: Privacy Officer
30 E Broadway, Suite 203 #1053
Salt Lake City, UT 84111