Privacy Notice

Effective date: 6 September 2026. Provider: Expy LLC, business address to be added. Privacy contact: privacy@expymed.com.

1. What this notice covers

This notice explains how MedTap handles information in its website, accounts, and clinic-connected intake service. When we handle patient information on behalf of a clinic, we act under our agreement with that clinic and applicable law. The clinic's own Notice of Privacy Practices explains its health information practices and rights. Our product notice does not override that notice or our Business Associate Agreement.

MedTap has two roles. When we handle information on behalf of a clinic, we act under our agreement with that clinic and applicable law. When you keep your own MedTap record and choose to reuse it at another practice, we hold that information for you, under our agreement with you. Information a clinic gives us does not become part of your own record, and your record is not shared with a practice unless you send it.

2. Information we handle

• Account and organization information: name, email address, login credentials handled by our authentication provider, practice identity, staff roles, and contact details you provide.
• Intake information: the patient and health information requested by the clinic's enabled forms, including contact details, relevant history, responses, and the documents or signatures submitted in the supported workflow. We do not ask for every possible category simply because the software could store it.
• Agreement and choice records: document versions, acceptance actions and times, signer's identity, clinic notice receipt or declined acknowledgment, and any enabled communication or sharing preferences.
• Service and security information: necessary device/browser, network and access information, errors, and audit events used to operate and protect the service. We configure these systems to avoid unnecessary clinical content in logs.
• Support and billing information: information you send for support and business subscription details for practices. Any payment provider and payment information it handles will be identified before paid checkout is enabled. Patient care bills are handled by the clinic.

Please use the secure service or the clinic's approved channel for medical details. Do not send health information in an ordinary support email when it is not needed.

3. Why we use it

We use information to create and secure accounts; collect and deliver the intake you request to the identified clinic; provide authorized access, records and copies; operate and troubleshoot the service; manage practice subscriptions; respond to requests; prevent misuse; and comply with applicable duties. We limit processing of clinic PHI to the purposes allowed by our agreements and law.

Under this proposed pilot policy, we do not sell health information, use it for targeted advertising, or use it to train general-purpose models. This statement must also be true of configured third-party services; it is not a substitute for reviewing their contracts and settings.

4. Who receives information

The clinic identified in your intake receives your submission, and its authorized staff may access it for their duties. MedTap personnel have access only as needed for authorized operations, support, or security responsibilities.

We use service providers for the enabled functions described in our service provider list, including covered hosting, storage, authentication, and related operations. Where required, we have business associate agreements or other appropriate contracts before those providers handle PHI. We do not claim that every product sold by a listed vendor is covered.

We may disclose information when required by law and in other circumstances permitted by applicable law and our clinic agreements. If the service is transferred to a successor, applicable confidentiality and PHI duties continue; a transfer is not permission to repurpose health information. We do not publish patient records for public browsing.

5. Your choices and requests

You can review the information and clinic shown before submitting intake. Contact the clinic promptly if a delivered clinical record needs correction. For access, amendment, or other requests concerning the clinic's medical record, use the clinic's privacy contact. We will direct requests we receive to the appropriate clinic and assist as required.

For your MedTap account information or account closure, contact privacy@expymed.com. We will verify identity proportionately, process applicable requests, and explain any exception. Deleting a login is different from deleting the clinic's medical record. We do not promise to erase information that must be retained or to recall copies already delivered lawfully.

Entering a phone number does not subscribe you to marketing or automatically opt you into text reminders. Any optional communication feature will present its purpose, provider, available controls, and applicable consent before enrollment. You may decline clinic notice acknowledgment; it is not permission for special uses of records.

6. Retention and security

We keep each category of information only for its documented service, security, contractual, or legal purpose, subject to applicable requirements. Our schedule is:

• Your own MedTap record: kept until you delete it or close your account. There is no expiry while your account is open.
• A clinic's records: kept for the life of that clinic's agreement, then returned or destroyed within the 60-day transition window, or over any longer period the clinic specifies in its order. The clinic decides how long its own medical record must be kept; we follow its instruction and do not shorten it.
• Account information: kept while your account is open and for 12 months after it closes, then deleted.
• Agreement and acceptance records: 10 years from the end of the agreement they evidence, because they are what proves what was agreed.
• Security and access logs: 12 months.
• Backups: expire on a rolling 35-day cycle, applied to both the clinic-held and patient-held stores.
• Deletion requests: acted on within 30 days of a verified request, with backup copies aging out within a further 35 days.

We explain lawful holds and other exceptions when responding to a request. Deleting your login is not the same as deleting a clinic's medical record.

Our patient-held record service is a consumer health service. If information in it is acquired without authorization, we will notify the affected people, the Federal Trade Commission, and where required the media, under the FTC Health Breach Notification Rule — in addition to any obligation we owe a clinic under our business associate agreement.

We use administrative, physical, and technical safeguards appropriate to the information and applicable obligations. No service can guarantee that all incidents will be prevented. When an incident triggers notice obligations, we follow applicable law and our clinic agreements.

7. Cookies, geography and age

The pilot uses browser storage and related technologies needed for sign-in, security, and app operation. Advertising trackers and session replay are excluded from the proposed patient workflow. Any later optional analytics must be assessed and disclosed before deployment; a generic cookie banner does not authorize sending PHI to a vendor.

The pilot serves the supported US launch area and adults acting for themselves. It is not offered for children to register themselves or for family/guardian accounts. If information is submitted outside that scope, contact us and the clinic so it can be handled appropriately. Our operating locations and provider processing locations are the United States.

8. Updates and questions

We will post a dated version and explain material changes before they apply, obtaining additional agreement or consent where required. Updating this notice does not override previous legal restrictions or the clinic's BAA.

Contact privacy@expymed.com or postal address to be added for questions or requests. The clinic's privacy notice provides its own complaint contacts. You may also contact the applicable regulator; this notice does not limit that right.

A dashed placeholder marks a detail that is not settled yet. Questions: support@expymed.com