Legal Notice
This document is a working draft prepared for legal review. It should be reviewed and approved by qualified legal counsel before publication. Nothing in this document constitutes legal advice.
Our Commitment to Privacy
At MyMediFile, we believe your health information belongs to you.
Our mission is to help individuals organize, understand, and share their health information with healthcare providers when they choose. We believe healthcare works best when patients arrive with accurate, organized information and providers have the context they need before the visit begins.
Privacy is fundamental to that mission. We are committed to handling your information responsibly, communicating our data practices transparently, and continually improving the safeguards that protect your information.
Our Privacy Principles
Patient Control
You decide what health information you add to MyMediFile and what information you choose to share with healthcare providers.
Transparency
We strive to explain our privacy practices in clear language.
Purpose Limitation
We collect information needed to operate and improve MyMediFile. We do not collect information unrelated to providing our services.
Security
We implement reasonable administrative, technical, and organizational safeguards designed to protect information entrusted to us.
Continuous Improvement
As MyMediFile evolves, we will continue strengthening our privacy practices and update this Privacy Policy when material changes occur.
Introduction
MyMediFile is a patient-controlled health information platform operated by E³ Health Technologies, Inc. (“MyMediFile,” “we,” “us,” or “our”).
Patient Control is a foundational principle of MyMediFile. We are committed to giving individuals meaningful control over the health information they choose to organize and share through the platform.
MyMediFile is built on the principle that patients should be able to organize, understand, and securely share their health information while remaining in control of what they choose to provide to healthcare professionals.
MyMediFile enables patients to organize their health information and share provider-ready summaries with healthcare providers and authorized care teams before appointments. The platform is designed to complement — not replace — existing clinical workflows and electronic medical record systems.
This Privacy Policy explains what information we collect, how we use it, when we share it, and the choices available to you regarding your information.
By using MyMediFile, you acknowledge that you have read and understand this Privacy Policy. Use of the platform is also subject to our Terms of Use.
What MyMediFile Is Not
MyMediFile is a health information technology platform. MyMediFile is not a healthcare provider, hospital, physician practice, health insurance company, pharmacy, or emergency medical service.
MyMediFile does not provide medical advice, diagnose medical conditions, prescribe treatment, or replace the relationship between patients and licensed healthcare professionals.
Healthcare decisions should always be made in consultation with qualified healthcare professionals.
1. Who This Policy Covers
This Privacy Policy applies to:
- Patients who create a MyMediFile account and use the platform to organize and share their health information.
- Providers and clinic staff who use MyMediFile to review patient summaries and manage intake workflows.
- Visitors to mymedifile.org who browse our public website without creating an account.
2. Information We Collect
2.1 Information You Provide
Patients provide:
- Name, date of birth, gender, and contact information
- Medical history, including conditions, medications, allergies, surgeries, and hospitalizations
- Lab results, imaging reports, discharge summaries, and other uploaded medical documents
- Symptoms, visit notes, and health updates
- Insurance information
- Emergency contact information
Providers and clinic staff provide:
- Name, role, specialty, and clinic or organization name
- Work email address
- Billing information (processed securely by Stripe)
2.2 Platform Activity Information
- Provider-ready summaries generated from your health information
- Changes since your last visit, automatically identified by the platform
- Audit logs of actions taken — including who reviewed, exported, or copied a summary and when
- Intake link activity — including when a link was sent, opened, and completed
2.3 Artificial Intelligence Features
MyMediFile currently uses Google's Gemini AI services to power the Explain Results feature.
When you choose to use this feature, only the information reasonably necessary to generate the requested explanation is transmitted for processing. AI processing occurs only when you actively choose to use the Explain Results feature.
AI-generated explanations:
- are generated automatically
- are intended for informational purposes only
- may contain inaccuracies or omissions
- do not constitute medical advice
- should not be relied upon for diagnosis or treatment decisions
Users should consult qualified healthcare professionals regarding any medical questions or treatment decisions.
2.4 Information Collected Automatically
- Log data including IP address, browser type, and pages visited
- Device information
- Session activity within the platform
MyMediFile does not currently use third-party analytics tools. Platform usage data is derived from our own internal systems.
2.5 Cookies and Similar Technologies
MyMediFile uses cookies and similar technologies necessary for authentication, account security, maintaining user sessions, and supporting core platform functionality.
These technologies are not currently used for third-party advertising or behavioral tracking.
Users may configure their browser settings to manage cookies. However, disabling essential cookies may prevent portions of the MyMediFile platform from functioning properly.
3. How We Use Your Information
We collect, use, and retain only the information reasonably necessary to operate, secure, improve, and provide the MyMediFile platform and the services requested by our users.
We use your information to:
- Provide and operate the MyMediFile platform
- Generate provider-ready summaries from your health information
- Send intake links, account notifications, security notifications, and other service-related communications
- Enable providers and clinical staff to review your health summary before visits
- Process provider billing through Stripe
- Maintain audit logs and records of platform activity
- Improve platform functionality and reliability
- Communicate with you about your account, updates, and support
We do not use your health information for advertising purposes. We do not sell your health information to third parties. We do not share your health information with advertisers.
5. Health Information
MyMediFile is designed to help individuals securely organize and share health information.
We use cloud infrastructure and security practices intended to help protect sensitive information stored within the platform.
Healthcare organizations that require a Business Associate Agreement (BAA) in connection with their use of MyMediFile may contact us at privacy@mymedifile.org.
Each healthcare organization remains responsible for evaluating whether MyMediFile satisfies its own legal, regulatory, and organizational compliance requirements.
6. Data Storage and Security
MyMediFile currently utilizes Amazon Web Services (AWS) infrastructure to store and process platform data. The following protections are in place:
- Encryption in transit using TLS
- Encryption at rest for stored files and records
- Role-based access controls
- Authentication safeguards
- Security monitoring
- Routine infrastructure updates where appropriate
- Audit logging of all significant platform actions
Users are responsible for maintaining the confidentiality of their account credentials and should promptly notify MyMediFile if they believe their account has been accessed without authorization.
No security system is perfect. If you believe your account has been compromised, contact us immediately at privacy@mymedifile.org.
7. Data Retention
We retain your health information for as long as your account is active or as needed to provide services. You may request deletion of your account and associated personal information. Certain information may be retained where required by law, to resolve disputes, maintain security, or satisfy legitimate business obligations.
8. Your Rights and Choices
You have the right to:
- Access your health information stored in MyMediFile at any time through your account
- Update or correct your information at any time
- Delete your account and request deletion of your data
- Download available copies of your health information through features made available within the MyMediFile platform
- Control what information is shared with your clinic
- Withdraw consent for AI-powered features at any time
Depending on your location and applicable law, you may also have additional privacy rights.
To exercise any of these rights, contact us at privacy@mymedifile.org.
9. Children's Privacy
MyMediFile is not intended to be used independently by children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental or guardian consent. If you believe a child under 13 has provided us with personal information, please contact us at privacy@mymedifile.org.
10. Analytics and Tracking
MyMediFile does not currently use third-party analytics tools such as Google Analytics, PostHog, or similar services. We do not track your activity across other websites.
Platform usage data is derived from our own internal systems only.
If MyMediFile introduces third-party analytics in the future, this Privacy Policy will be updated before those services are implemented.
11. International Users
MyMediFile is operated from the United States.
If you access the platform from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States, where privacy laws may differ from those in your country of residence.
By using MyMediFile, you consent to these transfers where permitted by applicable law.
12. Third-Party Links
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies independently.
13. Governing Law
This Privacy Policy is governed by applicable United States federal law and, where applicable, the laws of the State of Delaware, without regard to conflict of law principles.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform. Your continued use of MyMediFile following the effective date of an updated Privacy Policy constitutes acknowledgment of the revised policy to the extent permitted by applicable law.
15. Contact Us
If you have questions about this Privacy Policy or how we handle your data, contact us at:
MyMediFile
Operated by E³ Health Technologies, Inc.
- Email: privacy@mymedifile.org
- Website: https://www.mymedifile.org
We encourage users to contact us with any questions about this Privacy Policy or our privacy practices before using the platform.
Closing Statement
Thank you for trusting MyMediFile with your health information. We recognize the responsibility that comes with helping individuals organize and share sensitive medical information, and we are committed to continually earning that trust through transparency, security, and responsible stewardship of your data.
Document Information
| Document | MyMediFile Privacy Policy & Data Practices |
|---|---|
| Version | 1.0 |
| Effective Date | July 1, 2026 |
| Document Owner | E³ Health Technologies, Inc. |
| Review Schedule | Annually or upon material change to platform, data practices, security controls, or applicable law |
Version History
| Version | Date | Description |
|---|---|---|
| 1.0 | July 1, 2026 | Initial privacy policy prepared for public launch |
This document is a working draft and should be reviewed by qualified legal counsel before publication.