Privacy Policy

Last Updated: January 8, 2026

MedScrub ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our healthcare data de-identification service.

Information We Collect

1. Account Information

When you create an account, we collect:

• Email address
• Company name (optional)
• Password (encrypted)

2. Usage Data

We automatically collect:

• API request metadata (timestamps, endpoint accessed, response times)
• Number of PHI elements de-identified
• Error logs (without PHI)
• Session information (session IDs, expiration times)

3. Protected Health Information (PHI)

• Stored temporarily in encrypted session storage (Redis)
• Automatically deleted after 24 hours (or up to 7 days if extended)
• Never logged or stored permanently
• Never used for any purpose other than re-identification
• Never shared with third parties

How We Use Your Information

Account Information

• Authenticate and authorize API access
• Provide customer support
• Send service updates and security notifications
• Process billing (for paid accounts)

Usage Data

• Improve service performance and reliability
• Monitor for security threats and abuse
• Provide usage analytics in your dashboard
• Comply with legal obligations

PHI

• De-identify healthcare data per your request
• Enable re-identification of AI responses via session tokens

Data Storage and Security

Encryption

• All data in transit: TLS 1.3+
• All data at rest: AES-256 encryption
• Session storage: Redis with encryption enabled
• Database: PostgreSQL with column-level encryption for sensitive fields

Access Controls

• Multi-factor authentication for admin access
• Role-based access control (RBAC)
• API keys with granular permissions
• Audit logging for all administrative actions

Data Retention

• PHI: 24 hours (default) or up to 7 days (if extended), then automatically deleted
• Session metadata: 90 days
• Usage analytics: 2 years
• Account information: Until account deletion
• Audit logs: 7 years (for compliance)

HIPAA Compliance

Business Associate Status

For self-hosted deployments, MedScrub is NOT a Business Associate because:

• You control the infrastructure where PHI is processed
• PHI never leaves your environment
• We do not have access to your PHI

For hosted API usage, we can execute a Business Associate Agreement (BAA) upon request. Contact us at cj@medscrub.ai.

Safe Harbor Method

MedScrub uses the HIPAA Safe Harbor de-identification method, removing all 18 identifiers as specified in 45 CFR § 164.514(b)(2).

Data Sharing and Disclosure

We Do NOT Share Your Data With:

• Third-party advertisers
• Data brokers
• AI/ML training providers
• Analytics platforms (except anonymized usage statistics)

We MAY Share Data With:

• Service providers: Cloud infrastructure (AWS/Azure/GCP), payment processors (Stripe)
• Legal obligations: Law enforcement or regulatory agencies when required by law
• Business transfers: In the event of a merger, acquisition, or asset sale (with notice)

Your Rights

Cookies and Tracking

Essential Cookies

• Session authentication (required for service)
• CSRF protection tokens

Analytics

We use privacy-focused analytics (Plausible or similar) that:

• Does not use cookies
• Does not track individuals
• Does not share data with third parties
• Complies with GDPR without consent banners

International Data Transfers

Our primary infrastructure is located in the United States. For self-hosted deployments, data remains in your chosen region. For hosted API usage:

• We use Standard Contractual Clauses (SCCs) for EU data transfers
• Data is processed only in regions with adequate data protection laws

Children's Privacy

MedScrub is not intended for individuals under 18. We do not knowingly collect personal information from children. If you believe we have collected such information, contact us immediately.

Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated "Last updated" date. For material changes, we will notify you via email at least 30 days in advance.

Contact Us

For privacy-related questions or requests:

Compliance Certifications

• HIPAA: Safe Harbor de-identification compliant
• SOC 2 Type II: In progress (expected Q2 2026)
• GDPR: Data Processing Agreement available upon request