Privacy Policy

Information we collect

Account information: name, email address, and credentials of clinic staff who use the platform.

Clinical and operational data: information that clinics enter into the platform to run their operations (for example patients, appointments, documents, and clinical records). Clinics remain the controllers of this data; Medify processes it on their behalf.

Usage data: technical logs needed to operate and secure the service.

Google user data (Google Calendar)

If a doctor chooses to connect their Google account, Medify requests access to the Google Calendar events scope (https://www.googleapis.com/auth/calendar.events). We use this access exclusively to create, update, and delete appointment events on the doctor's own calendar so that appointments managed in Medify stay in sync with Google Calendar.

We do not read unrelated calendar events for any purpose other than sync correctness, and we do not use Google user data for advertising, profiling, or model training. We never sell Google user data, and we do not transfer it to third parties except as necessary to provide the sync feature the user requested, to comply with applicable law, or as part of a merger or acquisition with prior notice.

OAuth tokens are stored encrypted and are used only by our servers to perform the sync described above. You can disconnect Google Calendar at any time from the app (Agenda settings), which stops the sync, or revoke Medify's access from your Google Account security settings (myaccount.google.com/permissions). Upon disconnection we delete the stored tokens.

Medify's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information

We use the information described above to provide, maintain, and improve the service; to secure accounts and prevent abuse; and to comply with legal obligations. We do not sell personal information.

Data storage and security

Data is stored in access-controlled databases with tenant isolation enforced at the database layer (row-level security). Access to production systems is restricted and audited. Data is encrypted in transit.

Data retention and deletion

We retain data for as long as the clinic maintains an active agreement with Medify, or as required by applicable healthcare record-keeping laws. Clinics may request deletion or export of their data by contacting us. Google OAuth tokens are deleted when the user disconnects the integration.

Your choices

You may access, correct, or request deletion of your personal information through your clinic administrator or by contacting us directly. Doctors may disconnect the Google Calendar integration at any time as described above.

Contact

For any privacy question or request, contact us at contact@medifyai-health.com.