MedVault Privacy Policy

Last Updated: September 1, 2026

MedVault ("MedVault," "we," "us," or "our") operates the MedVault mobile application and related services (the "App"). MedVault is designed to help individuals organize, store, manage, and share their personal health information in one place.

This Privacy Policy explains what information MedVault collects, how we use and protect that information, when information may be shared, how third-party service providers may process information on our behalf, and the choices available to you.

By creating an account or using MedVault, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, storage, and disclosure of information as described in this Privacy Policy.

1. Information We Collect

Account Information

When you create a MedVault account, we collect your email address for purposes such as creating and maintaining your account, authenticating your access, and assisting with account recovery.

We do not require you to provide your name, phone number, or other personal contact information to create a MedVault account unless a particular feature requires additional information and we explain that requirement to you.

Your account email address is maintained separately from the health information you store in MedVault to the extent supported by our technical architecture.

Health Information You Choose to Store

MedVault allows you to enter, upload, organize, and maintain health-related information that you choose to store in your account.

Depending on how you use the App, this may include:

• Medical records and documents
• Imaging reports
• Laboratory, microbiology, and pathology results
• Medications and allergies
• Medical conditions and diagnoses
• Surgical and medical history
• Vital signs
• Healthcare provider information
• Insurance information
• Emergency contacts
• Medical powers of attorney
• Advance directives
• HIPAA authorizations or release forms
• Other health, medical, or legal documents you choose to store

You control the information you choose to enter or upload to MedVault.

Personal Identifiers in Uploaded Documents

MedVault does not require you to provide certain personal identifiers as part of your account registration. However, documents and health records you upload may contain personal identifiers, including your name, date of birth, medical record number, address, insurance information, or other identifying information.

If you do not need those identifiers for your personal record-keeping or sharing purposes, you should consider removing or redacting them before uploading a document.

Do not upload unnecessary:

• Social Security numbers
• Credit or debit card numbers
• Bank account or routing numbers
• Driver's license or passport numbers
• Other government-issued identification numbers
• Other financial account information

MedVault cannot guarantee that a document will be free of personal identifiers if you choose to upload a document containing them.

Patient Jacket Code

MedVault may assign your account a unique patient jacket code. This code is intended to help organize and identify your records without requiring the use of unnecessary personal identifiers.

A patient jacket code is not intended to replace legal identifiers when a healthcare facility or other recipient requires them.

Document Processing and Automated Extraction

When you upload a medical document, MedVault may use automated technologies, including optical character recognition (OCR), document processing, and automated information extraction or organization tools, to help identify and organize information contained in the document.

For example, these technologies may identify information such as:

• Medications
• Laboratory results
• Allergies
• Surgeries
• Medical conditions
• Provider information
• Other information contained within an uploaded document

The original document and extracted information may be processed by third-party technology providers that support these features.

These providers may process information contained in uploaded documents only as necessary to provide the applicable MedVault functionality, subject to the agreements, configurations, and privacy practices applicable to those services.

Automated extraction and organization may not always be accurate, complete, or current. You are responsible for reviewing extracted information before relying on it or including it in a transfer packet, emergency summary, or other communication.

Payment Information

MedVault may offer paid features, subscriptions, licenses, or other paid services.

Payments may be processed by a third-party payment provider. We do not intentionally collect or store your complete payment card number when payment processing is handled by that provider.

Payment information is handled according to the payment provider's applicable terms and privacy policy.

Device and Usage Information

We may collect limited technical and usage information necessary to operate, maintain, secure, troubleshoot, and improve MedVault.

Depending on the services and technologies used by MedVault, this may include:

• App version
• Device type
• Operating-system information
• Crash reports
• Error logs
• Security and diagnostic information
• Basic usage information

We do not use personal health information for advertising or targeted marketing.

2. How We Use Information

We may use information collected through MedVault to:

• Create and maintain your account
• Authenticate your access
• Provide, operate, and maintain the App
• Store and organize information you choose to enter or upload
• Process uploaded documents
• Extract and organize information from uploaded documents
• Generate transfer packets and emergency summaries you choose to create
• Provide features you request
• Process purchases and provide access to paid features
• Maintain the security and reliability of the App
• Diagnose technical problems
• Prevent fraud, misuse, unauthorized access, and other harmful activity
• Improve App functionality and user experience
• Comply with applicable legal obligations
• Respond to lawful requests from governmental authorities when legally required

We do not sell your personal health information.

We do not use your personal health information for advertising or targeted marketing.

We do not use the contents of your personal medical records to train general-purpose artificial intelligence models unless that practice is specifically disclosed to you and any consent or other authorization required by applicable law is obtained.

3. Third-Party Service Providers

MedVault may use third-party service providers to provide and support App functionality.

Depending on the features you use, third-party providers may assist with:

• Cloud hosting and infrastructure
• Authentication and account management
• Database services
• Document storage
• OCR and document processing
• Automated information extraction
• Security and monitoring
• Technical support
• Payment processing
• Other services necessary to operate MedVault

These providers may receive or process information on MedVault's behalf as necessary to provide their contracted services.

We seek to configure and use third-party services in a manner consistent with this Privacy Policy and applicable law.

Because third-party providers operate independently from MedVault, their processing of information may also be governed by their own agreements, security practices, and privacy policies.

MedVault does not authorize third-party service providers to use your personal health information for advertising or unrelated marketing purposes.

4. Artificial Intelligence and Automated Technologies

MedVault may use automated technologies, including OCR, machine-learning tools, artificial intelligence-assisted extraction, or similar technologies, to help organize information you choose to upload.

These technologies may process the contents of uploaded documents when necessary to provide the requested functionality.

MedVault does not intentionally use your medical records to train general-purpose AI models unless we specifically disclose that practice and obtain any consent or authorization required by applicable law.

Automated technologies can make mistakes. Information generated or extracted by these technologies should be reviewed for accuracy before you rely on it or share it with another person or organization.

5. How We Protect Your Information

We use administrative, technical, and organizational safeguards designed to protect information from unauthorized access, use, alteration, or disclosure.

Depending on the applicable system or service, these safeguards may include:

• Encryption of health information in transit
• Encryption of health information at rest
• Secure connections between your device and MedVault services
• Account-level access controls
• Authentication and authorization controls
• Measures designed to prevent one user's information from being improperly accessed by another user
• Security monitoring
• Technical safeguards designed to detect and prevent unauthorized activity

No method of electronic storage or transmission is completely secure. Accordingly, we cannot guarantee that your information will never be accessed, disclosed, altered, or destroyed as a result of a security incident.

You are responsible for protecting your account credentials and maintaining reasonable security on the devices you use to access MedVault.

6. Sharing Your Information

When You Choose to Share Information

MedVault may allow you to generate, download, transmit, or otherwise share transfer packets, emergency summaries, medical records, or other information you select.

Information is shared with a recipient when you choose to initiate that sharing action or otherwise authorize the disclosure.

You are responsible for reviewing information before sharing it and confirming that the information selected is appropriate for the intended recipient.

Service Providers

As described above, MedVault may share information with third-party service providers when necessary to operate the App or provide requested functionality.

These providers may process information on our behalf and are expected to maintain appropriate safeguards consistent with the services they provide.

Legal and Safety Requirements

We may access, use, preserve, or disclose information when reasonably necessary to:

• Comply with applicable law, regulation, legal process, or governmental request
• Respond to a valid subpoena, court order, or other legal process
• Protect the rights, safety, or property of MedVault, our users, or others
• Detect, investigate, or prevent fraud, abuse, security incidents, or unlawful activity
• Enforce our agreements or policies

Business Transfers

If MedVault is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar business transaction, information may be transferred as part of that transaction, subject to applicable law and any required notices.

7. Health Data Breach Notification

MedVault takes the security of personal health information seriously.

If MedVault experiences a security incident involving health information, we will investigate the incident and determine whether notification is required under applicable federal or state law.

Depending on the circumstances and applicable law, this may include obligations under the Federal Trade Commission's Health Breach Notification Rule, state data-breach laws, or other applicable requirements.

Where required by law, MedVault will notify affected individuals and applicable governmental authorities within the required timeframe and in the manner required by law.

The FTC's Health Breach Notification Rule applies to certain vendors of personal health records and related entities that are not covered by HIPAA and requires notification following certain breaches involving unsecured, individually identifiable health information.

8. HIPAA and Healthcare Privacy

MedVault is designed as a personal health information organization and record-keeping service.

MedVault does not represent or market itself as "HIPAA certified."

Whether HIPAA applies to information processed through MedVault depends on the circumstances, including the relationship between MedVault, healthcare providers, health plans, and other organizations.

If an individual independently chooses a health application that is not a HIPAA covered entity or business associate to receive health information, HIPAA may not govern the information once it is transferred to that application. HHS explains that the applicability of HIPAA depends in part on whether the app is acting on behalf of a covered entity or business associate.

MedVault is not intended to replace the privacy obligations of healthcare providers, health plans, or other organizations that are independently subject to HIPAA.

MedVault may nevertheless be subject to other federal, state, or international privacy and data-protection requirements depending on how the App is used and where users are located.

Nothing in this Privacy Policy is intended to represent that MedVault is exempt from any applicable privacy or data-protection law.

9. Your Choices and Privacy Rights

Depending on where you live and applicable law, you may have rights regarding your personal information.

MedVault generally allows you to:

• Add, edit, and delete information stored in your account
• Choose whether to upload documents
• Choose what information is included in transfer packets or emergency summaries
• Request deletion of your account and stored information
• Request information about how your information is handled
• Contact MedVault with privacy questions or requests

To make a privacy request, contact us using the information provided below.

We may need to verify your identity or account ownership before completing certain requests.

Some privacy rights may be subject to exceptions or limitations under applicable law.

10. Data Retention and Deletion

MedVault retains information for as long as reasonably necessary to provide the App, maintain your account, provide requested services, maintain security, comply with legal obligations, or fulfill other legitimate operational purposes.

You may delete individual records or request deletion of your account through available App functionality or by contacting us.

When information is deleted, we will remove it from our active systems in accordance with our applicable deletion procedures.

Information may remain temporarily in secure backups or disaster-recovery systems until those systems are overwritten or securely deleted.

Certain information may also be retained when reasonably necessary for:

• Compliance with legal obligations
• Security purposes
• Fraud prevention
• Dispute resolution
• Accounting or financial recordkeeping
• Enforcement of agreements
• Other purposes permitted or required by law

Deletion from MedVault does not necessarily result in immediate deletion from systems operated independently by third-party service providers where retention is required for legitimate technical, legal, security, or contractual purposes.

11. Children's Privacy

MedVault is not directed to children under 13.

We do not knowingly collect personal information from children under 13.

If you believe a child under 13 has provided personal information to MedVault, please contact us so that we can investigate and take appropriate action.

If applicable law requires a higher minimum age for use of the App, that requirement will apply.

12. Third-Party Services and Links

MedVault may rely on third-party services to provide certain functionality.

Third-party services may have their own privacy policies, terms, security practices, and data-retention practices.

This Privacy Policy describes how MedVault handles information within our control. It does not govern the privacy practices of third parties that operate independently of MedVault.

We encourage you to review the privacy practices of third-party services before providing information directly to those services.

13. Your Responsibility for Information You Store

MedVault provides tools for organizing information that you choose to enter or upload.

You are responsible for reviewing information stored in your account, including information extracted from uploaded documents.

You are also responsible for reviewing information before sharing it with healthcare providers, facilities, family members, emergency contacts, or other recipients.

MedVault does not independently verify the accuracy, completeness, or current status of information you enter, upload, or share.

14. Medical Disclaimer

MedVault is a personal health information organization and record-keeping tool.

MedVault is not a medical device and does not provide medical advice, diagnosis, or treatment.

Information displayed in MedVault should not be considered a substitute for professional medical advice, diagnosis, or treatment.

Automated document extraction and organization may contain errors or omissions. Important medical information should be verified against the original medical record or with an appropriate healthcare professional.

If you are experiencing a medical emergency, contact emergency services or seek immediate medical attention.

15. Data Transfers and Geographic Processing

MedVault and its third-party service providers may process and store information in locations where MedVault or its service providers maintain facilities or infrastructure.

Depending on the services used, information may be processed in the United States or other jurisdictions.

Privacy and data-protection laws may differ between jurisdictions. Where required by applicable law, MedVault will take appropriate measures relating to the transfer and processing of personal information.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When we make changes, we will update the "Last Updated" date at the beginning of this Privacy Policy.

If we make material changes to how we collect, use, disclose, or protect personal health information, we may provide additional notice through the App, by email, or by other appropriate means when required or appropriate.

Your continued use of the App after an updated Privacy Policy becomes effective constitutes acknowledgment of the updated policy to the extent permitted by applicable law.

17. Contact Us

If you have questions about this Privacy Policy, your personal information, or a privacy request, please contact:

MedVault Support Email: admin@speedy-health-vault-sync.com Website: https://speedy-health-vault-sync.com App: https://speedy-health-vault-sync.base44.app