Privacy Policy

Last Updated: January 8, 2026

MedScrub ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our healthcare data de-identification service.

Information We Collect

1. Account Information

When you create an account, we collect:

• Email address
• Company name (optional)
• Password (encrypted)

2. Usage Data

We automatically collect:

• API request metadata (timestamps, endpoint accessed, response times)
• Number of PHI elements de-identified
• Error logs (without PHI)
• Session information (session IDs, expiration times)

3. Protected Health Information (PHI)

• Stored temporarily in encrypted session storage (Redis)
• Automatically deleted after 24 hours (or up to 7 days if extended)
• Never logged or stored permanently
• Never used for any purpose other than re-identification
• Never shared with third parties

How We Use Your Information

Account Information

• Authenticate and authorize API access
• Provide customer support
• Send service updates and security notifications
• Process billing (for paid accounts)

Usage Data

• Improve service performance and reliability
• Monitor for security threats and abuse
• Provide usage analytics in your dashboard
• Comply with legal obligations

PHI

• De-identify healthcare data per your request
• Enable re-identification of AI responses via session tokens

Data Storage and Security

Encryption

• All data in transit: TLS 1.3+
• All data at rest: AES-256 encryption
• Session storage: Redis with encryption enabled
• Database: PostgreSQL with column-level encryption for sensitive fields

Access Controls

• Multi-factor authentication for admin access
• Role-based access control (RBAC)
• API keys with granular permissions
• Audit logging for all administrative actions

Data Retention

• PHI: 24 hours (default) or up to 7 days (if extended), then automatically deleted
• Session metadata: 90 days
• Usage analytics: 2 years
• Account information: Until account deletion
• Audit logs: 7 years (for compliance)

HIPAA Compliance

Business Associate Status

For self-hosted deployments, MedScrub is NOT a Business Associate because:

• You control the infrastructure where PHI is processed
• PHI never leaves your environment
• We do not have access to your PHI

For hosted API usage, we can execute a Business Associate Agreement (BAA) upon request. Contact us at clint@1putthealth.com.

Safe Harbor Method

MedScrub uses the HIPAA Safe Harbor de-identification method, removing all 18 identifiers as specified in 45 CFR § 164.514(b)(2).

Data Sharing and Disclosure

We Do NOT Share Your Data With:

• Third-party advertisers
• Data brokers
• AI/ML training providers
• Analytics platforms (except anonymized usage statistics)

We MAY Share Data With:

• Service providers: Cloud infrastructure (AWS/Azure/GCP), payment processors (Stripe)
• Legal obligations: Law enforcement or regulatory agencies when required by law
• Business transfers: In the event of a merger, acquisition, or asset sale (with notice)

AI Processing and Third-Party AI Services

MedScrub uses third-party AI services to generate clinical assistant output (for example, note drafting, chart summaries, and screening suggestions). This section explains exactly what is sent, to whom, and how we protect it.

What data is sent to AI

Only de-identified clinical text is ever sent to an AI service. Protected Health Information (PHI) never leaves your own infrastructure: de-identification runs on your self-hosted proxy (or, for the desktop app, on your own device) and removes all 18 HIPAA Safe Harbor identifiers before any AI request is made. In the mobile companion app, no clinical data is sent to any AI from the phone — the app sends an end-to-end-encrypted request to your own paired desktop, and the desktop performs de-identification locally before contacting any AI service. AI responses are re-identified locally on your infrastructure and shown only to you.

Who the data is sent to

The AI provider is the one your deployment configures — one or more of Anthropic (Claude), OpenAI (GPT), or Google (Gemini). You control which provider is used. Only de-identified text is transmitted, and it is sent directly from your infrastructure to the provider's API over TLS.

How the data is used and protected

De-identified text is used solely to generate the assistant output you requested. We use these providers under their enterprise/business API terms, which contractually prohibit training on submitted data and provide protections equal to those described in this policy. Because only de-identified data is transmitted, no HIPAA identifiers reach the AI provider.

Your consent

The desktop and mobile apps disclose this AI processing and ask for your permission before running an AI assistant. You can decline, and no data is processed by AI unless you choose to run an assistant.

Your Rights

Cookies and Tracking

Essential Cookies

• Session authentication (required for service)
• CSRF protection tokens

Analytics

We use privacy-focused analytics (Plausible or similar) that:

• Does not use cookies
• Does not track individuals
• Does not share data with third parties
• Complies with GDPR without consent banners

International Data Transfers

Our primary infrastructure is located in the United States. For self-hosted deployments, data remains in your chosen region. For hosted API usage:

• We use Standard Contractual Clauses (SCCs) for EU data transfers
• Data is processed only in regions with adequate data protection laws

Children's Privacy

MedScrub is not intended for individuals under 18. We do not knowingly collect personal information from children. If you believe we have collected such information, contact us immediately.

Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated "Last updated" date. For material changes, we will notify you via email at least 30 days in advance.

Contact Us

For privacy-related questions or requests:

Compliance Certifications

• HIPAA: Safe Harbor de-identification compliant
• SOC 2 Type II: In progress (expected Q2 2026)
• GDPR: Data Processing Agreement available upon request