Privacy Policy

Last updated: April 12, 2025

1. Introduction

MedAlly ("we", "our", or "us") is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our concierge medicine billing services. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site or use our services.

2. Information We Collect

We collect information about Members (Patients) and Doctors solely for internal purposes to improve our services. This information may include, but is not limited to:

• Name, contact information, and other identifying information
• Medical practice information (for Doctors)
• Billing and payment information
• Usage data related to our services

2.1 Marketing and Tracking Information

In addition to the information listed above, we also collect:

• Cookies and similar tracking technologies
• Browser type and version
• Device information
• IP address
• Referral source
• Length of visit, page views, website navigation paths
• Timing, frequency, and patterns of service use
• Marketing campaign engagement data
• Information from QR code scans
• Email and SMS interaction data

3. How We Use Your Information

We use the collected information for various purposes, including:

• Providing and maintaining our services
• Improving and personalizing our services
• Communicating with you about our services
• Complying with legal obligations

3.1 Marketing and Campaign Tracking

We also use your information for the following marketing and tracking purposes:

• Tracking the effectiveness of our marketing campaigns
• Analyzing user behavior to optimize our website and services
• Delivering targeted and personalized marketing communications
• Measuring engagement with our marketing materials (emails, SMS, physical mailings with QR codes)
• Internal reporting and analysis of marketing effectiveness
• Retargeting across different platforms and channels
• Building and maintaining prospect databases for potential doctors and patients

4. Cookies and Tracking Technologies

4.1 What Are Cookies

Cookies are small text files that are placed on your device when you visit our website. We use cookies and similar tracking technologies to track the activity on our service and hold certain information.

4.2 Types of Cookies We Use

• Essential Cookies: Necessary for the basic functionality of our website.
• Functional Cookies: Help us remember your preferences and settings.
• Analytics and Performance Cookies: Help us understand how visitors interact with our website.
• Marketing and Advertising Cookies: Used to track visitors across websites to display relevant advertisements.

4.3 Your Cookie Choices

Most web browsers allow you to control cookies through their settings. However, if you limit the ability of websites to set cookies, you may impact your overall user experience. You can opt out of certain cookie-based tracking by following the instructions in our Cookie Policy or by contacting us directly.

4.4 Preference and Interface Cookies

We use cookies to remember your preferences and improve your user experience, including your cookie consent choices and interface preferences to avoid repeatedly displaying dismissed notifications.

5. Data Retention and Deletion

We retain your personal information for as long as necessary to provide our services and comply with our legal obligations. You have the right to request the deletion of your personal data. To submit a deletion request, please email deletemydata@medally.io.

6. Data Protection Rights

Depending on your location, you may have certain data protection rights. These may include:

• The right to access, update, or delete your personal information
• The right to rectification
• The right to object to processing
• The right of restriction
• The right to data portability
• The right to withdraw consent

6.1 Opting Out of Marketing Communications

You may opt out of receiving marketing communications from us by:

• Following the unsubscribe instructions included in each marketing email
• Replying with "STOP" to any marketing SMS
• Contacting us directly at privacy@medally.io

7. California Privacy Rights

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA). These include:

• The right to know about the personal information we collect about you and how it is used and shared
• The right to delete personal information collected from you (with some exceptions)
• The right to opt-out of the sale of your personal information
• The right to non-discrimination for exercising your CCPA rights

To exercise your California privacy rights, please submit a verifiable consumer request to us by emailing deletemydata@medally.io.

8. HIPAA Compliance

As a provider of services to healthcare professionals, we comply with the Health Insurance Portability and Accountability Act (HIPAA). We implement appropriate safeguards to protect the privacy and security of protected health information (PHI) in accordance with HIPAA regulations.

9. Third-Party Services and Analytics Tools

We use third-party services for analytics, marketing optimization, and security. These third parties may have access to your personal information only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Our technology stack includes:

• Google Analytics (GA4) - Website traffic analysis and user behavior tracking
• PostHog - Behavioral analytics and feature usage tracking
• Google reCAPTCHA - Spam and bot protection for forms
• Email marketing platforms
• Customer relationship management (CRM) systems
• SMS marketing services

These tools collect data including page views, click events, form interactions, device information, and referral sources to help us improve our services and understand user preferences.

10. Data Sharing and Disclosure

We may share your information in the following situations:

• With Service Providers: We may share your information with third-party vendors, service providers, contractors, or agents who perform services for us.
• Business Transfers: If we are involved in a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction.
• With Affiliates: We may share your information with our affiliates, in which case we will require those affiliates to honor this Privacy Policy.
• With Business Partners: We may share your information with our business partners to offer you certain products, services, or promotions.
• To Comply with Legal Obligations: We may disclose your information where required by law or to respond to legal process.

11. International Data Transfers

Your information may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction. If you are located outside the United States and choose to provide information to us, please note that we transfer the data to the United States and process it there.

12. Children's Privacy

Our service is not directed to anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us.

13. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this Privacy Policy.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

MedAlly
Email: legal@medally.io