Our Commitment to Your Privacy
MedicalRecords.com is committed to protecting the privacy and security of your personal and health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.
We apply privacy and security controls intended to support obligations that apply to the service and its deployments. Whether a specific law, including HIPAA or a state privacy law, applies can depend on the data, relationship, location, and use.
Information We Collect
Personal Information
When you use our services, we may collect:
- Name, email address, phone number, and mailing address
- Date of birth and Social Security Number (when required for identity verification)
- Payment information (processed securely through third-party payment processors)
- Account credentials and preferences
Protected Health Information (PHI)
When you request medical records, we may collect:
- Healthcare provider information
- Medical record numbers and dates of service
- Information needed to locate and retrieve your medical records
- Authorization signatures and consent forms
Automatically Collected Information
- IP address, browser type, and device information
- Pages visited, time spent on pages, and referral sources
- Cookies and similar tracking technologies
How We Use Your Information
We use your information to:
- Provide Services: Retrieve and deliver your medical records
- Process Payments: Handle billing and payment processing
- Communicate: Send updates about your requests and respond to inquiries
- Improve Services: Analyze usage patterns and enhance user experience
- Legal Compliance: Meet regulatory and legal requirements
- Security: Protect against fraud and unauthorized access
How We Share Your Information
We do not sell your personal or health information. We may share your information with:
Healthcare Providers
To fulfill your medical records requests, we share necessary information with the healthcare facilities and providers where your records are maintained.
Service Providers
We work with trusted third-party service providers who assist us in:
- Payment processing
- Cloud hosting and data storage
- Email and communication services
- Analytics and website optimization
Service providers are expected to protect information and comply with applicable contractual and legal requirements. Where HIPAA requires a Business Associate Agreement for a relationship, that agreement must be in place before the provider handles PHI.
Legal Requirements
We may disclose information when required by law, court order, or government request, or to protect our rights, property, or safety.
Data Security
We implement industry-standard security measures to protect your information:
- Encryption: SSL/TLS encryption for data in transit
- Access Controls: Restricted access to authorized personnel only
- Private Storage: Sensitive uploads are stored in non-public buckets and accessed through authorized, time-limited delivery paths
- Application Controls: Input validation, CSRF protection, rate limiting, and signed-webhook verification on supported endpoints
- Employee Training: Staff trained in privacy and security best practices
Your Privacy Rights
When HIPAA Applies
- HIPAA rights generally apply through the covered entity that maintains the designated record set
- Depending on the relationship, rights can include access, amendment, an accounting of disclosures, and requested restrictions
- Contact the relevant healthcare provider and our privacy team if you are unsure where to direct a request
Under CCPA (California Residents)
- Right to know what personal information is collected
- Right to delete personal information
- Right to opt-out of sale of personal information (we do not sell your information)
- Right to non-discrimination for exercising privacy rights
How to Exercise Your Rights
To exercise any of your privacy rights, contact us at:
- Email: privacy@medicalrecords.com
- Phone: 1-888-633-7327
- Mail: Privacy Officer, MedicalRecords.com, 405 Waltham Street, Suite 408, Lexington, MA 02421
Cookies and Tracking Technologies
We use cookies and similar technologies to:
- Remember your preferences and settings
- Understand how you use our website
- Improve website performance and user experience
- Provide personalized content and features
You can control cookies through your browser settings. Note that disabling cookies may limit certain website functionality.
Third-Party Links
Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.
Children's Privacy
Our services are not directed to individuals under 18. We do not knowingly collect personal information from children. Parents or guardians may request medical records on behalf of minors.
Data Retention
We retain your information for as long as necessary to:
- Provide our services
- Comply with applicable legal, accounting, security, and contractual obligations
- Resolve disputes and enforce agreements
International Users
Our services are based in the United States. If you access our website from outside the U.S., your information may be transferred to and processed in the United States, where privacy laws may differ from your country.
Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on our website with a new "Last Updated" date.
Contact Us
If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us:
MedicalRecords.com
Email: privacy@medicalrecords.com
Phone: 1-888-633-7327
Mail: Privacy Officer
MedicalRecords.com
405 Waltham Street, Suite 408
Lexington, MA 02421
This Privacy Policy is effective as of December 5, 2025. By using our website and services, you acknowledge that you have read and understood this Privacy Policy.