Privacy Policy

• Professional credentials, NPI numbers, and licensing information
• Contact information (name, email, phone, practice address)
• Organization affiliation, role, and department
• Authentication credentials and multi-factor authentication tokens
• Usage data, platform interactions, and feature adoption metrics

• Clinical notes, assessments, and behavioral health evaluations
• Treatment plans, progress notes, and care coordination records
• Diagnostic information (DSM-5, ICD-10/11 codes)
• Voice recordings and transcriptions (with explicit, revocable consent)
• Patient demographics and insurance identifiers

• IP addresses, device identifiers, and browser fingerprint data
• Browser type, operating system, and screen resolution
• Session logs, timestamps, and API call metadata
• Performance metrics, error logs, and system telemetry
• Geolocation data (coarse, derived from IP address only)

• Organization name, billing address, and tax identification numbers
• Payment method details (processed and stored by PCI DSS-compliant payment processors; Medera does not store raw payment card data)
• Subscription tier, usage volumes, and invoice history

To deliver AI-powered clinical insights, generate evidence-based treatment recommendations, facilitate behavioral health assessments, and support clinical decision-making workflows. PHI is processed solely for the purpose of providing the contracted Services as described in the applicable BAA.

To maintain, monitor, and improve the reliability, performance, and security of our platform. Where we use data for model training or algorithmic improvement, we use only de-identified datasets that meet the HIPAA Safe Harbor or Expert Determination de-identification standard under 45 CFR § 164.514.

To meet regulatory obligations under HIPAA, state privacy laws, and other applicable statutes; to conduct internal and third-party audits; to detect, prevent, and respond to fraud, abuse, security incidents, and threats to patient safety.

To respond to support requests, deliver service notifications, provide onboarding materials, and communicate material changes to our Services or policies. We do not use PHI for marketing purposes under any circumstances.

• All PHI access, creation, modification, and deletion events are logged immutably
• Audit logs are retained for a minimum of six (6) years per HIPAA requirements
• Merkle-tree integrity verification ensures tamper-evident audit records
• Logs include user identity, timestamp, action performed, data elements accessed, and source IP address

• Documented Incident Response Plan (IRP) tested via tabletop exercises at least twice annually
• Dedicated Security Operations Center (SOC) with 24/7/365 monitoring
• Mean time to detect (MTTD) target: under 15 minutes for critical incidents
• Forensic investigation capabilities maintained in-house and via contracted third-party specialists

We execute HIPAA-compliant BAAs with all Covered Entities prior to receiving PHI. Our standard BAA addresses permissible uses and disclosures, safeguard obligations, breach notification requirements, subcontractor flow-down provisions, and data return or destruction obligations upon termination.

• Designated HIPAA Privacy Officer and HIPAA Security Officer
• Mandatory workforce HIPAA training at hire and annually thereafter, with documented completion records
• Formal sanctions policy for workforce members who violate HIPAA policies
• Documented risk analysis and risk management program, updated at least annually
• Workforce access management including background checks for personnel with PHI access
• Contingency planning including data backup, disaster recovery, and emergency mode operation

• Data hosted in SOC 2 Type II-certified cloud infrastructure with physical access controls, biometric entry, and 24/7 surveillance
• Workstation security policies including full-disk encryption and automatic screen lock
• Media disposal procedures using NIST SP 800-88 guidelines for data sanitization

• Unique user identification with audit controls for all PHI access
• Automatic session termination after configurable inactivity period
• Emergency access procedures with break-the-glass protocols and post-access review
• End-to-end encryption exceeding the HIPAA addressable encryption specification
• Integrity controls to detect unauthorized alteration or destruction of PHI

Medera applies the HIPAA minimum necessary standard to all uses, disclosures, and requests for PHI. Our platform is designed to limit PHI exposure to only the data elements required for the specific authorized purpose.

All subprocessors that access, store, or process PHI on our behalf are subject to rigorous due diligence and contractual controls:

• Security assessment and compliance review prior to engagement
• Written subprocessor agreements with HIPAA flow-down provisions
• Annual reassessment of subprocessor security posture and compliance standing
• Right to audit subprocessors upon reasonable notice
• Thirty (30) days advance written notice to Covered Entities before engaging a new subprocessor that will process their PHI, with the right to object

• Cloud infrastructure provider (SOC 2 Type II, ISO 27001, HIPAA-eligible)
• Payment processor (PCI DSS Level 1 certified)
• Transactional email and notification provider (BAA in place)
• Application performance monitoring (de-identified telemetry only)
• Customer support platform (with PHI access controls and BAA)

A complete list of current subprocessors is available upon request.

• Written notification to the affected Covered Entity without unreasonable delay and in no event later than thirty (30) calendar days after discovery of the breach
• Notification will include: identification of each individual whose PHI has been or is reasonably believed to have been accessed; a description of the type of PHI involved; the date of the breach and date of discovery; a description of what Medera is doing to investigate, mitigate harm, and prevent recurrence

• Breaches affecting 500 or more individuals: notification to HHS Secretary and prominent media outlets within sixty (60) calendar days
• Breaches affecting fewer than 500 individuals: logged and reported to HHS Secretary annually
• State Attorney General notifications as required by applicable state law

• Immediate containment and forensic investigation upon breach discovery
• Root cause analysis and corrective action plan documented within fourteen (14) days
• Credit monitoring and identity theft protection offered to affected individuals where warranted
• Post-incident review with Covered Entity including timeline, impact assessment, and preventive measures

California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. These include the right to know what personal information is collected and sold/shared, the right to delete, the right to opt-out of sales and sharing, and the right to limit the use of sensitive personal information. Medera does not sell personal information. To exercise CCPA/CPRA rights, contact us at hi@medera.info.

We also comply with privacy laws enacted in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other states with comprehensive privacy legislation. Where state law provides rights in addition to those described above, we honor those rights for residents of the applicable state.

Medera maintains a comprehensive mapping of state-specific breach notification requirements and will comply with the notification timelines and content requirements of each applicable jurisdiction in addition to federal requirements.

AI models are trained exclusively on de-identified datasets that meet HIPAA Safe Harbor or Expert Determination standards. No identifiable PHI is used in model training, fine-tuning, or evaluation. Training data undergoes bias assessment and fairness auditing.

Medera’s AI generates clinical recommendations as decision-support tools only. No automated decisions with legal or similarly significant effects are made without human clinician review and approval. Healthcare providers retain full authority over all clinical decisions.

Our AI outputs include confidence scores and supporting evidence references. Model performance is monitored continuously for accuracy, bias, and drift. Board-certified clinicians review model outputs as part of our Clinical Oversight Program. Model cards and algorithmic impact assessments are maintained and available to enterprise customers upon request.