MedChartScan LogoMedChartScan
HomePrivacy Policy

Privacy Policy

MedChartScan Inc.

Last Updated: June 10, 2026

Welcome to MedChartScan Inc. (“MedChartScan,” “we,” “us,” or “our”). This Privacy Policy (“Privacy Policy”) explains how MedChartScan collects, uses, discloses, and otherwise processes personal data in connection with www.medchartscan.io (the “Website”) and our risk-adjustment, coding, and quality platform — including our in-EHR extension, coder workspace, audit and transparency module, and E/M coding module — and any other product, service, or application that references or links to this Privacy Policy (collectively, the “Services”).

This Privacy Policy does not address our privacy practices relating to MedChartScan employees, contractors, or other employment-related individuals after hire, nor data that is not subject to applicable data protection laws (such as de-identified or publicly available information).

1. Our Role in Processing Personal Data

Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.

This Privacy Policy describes our privacy practices where we act as the controller of personal data — for example, when you visit our Website, request a demo, sign up for our mailing list, or contact us directly.

This Privacy Policy does not cover or address how our customers process personal data when they use our Services, or how we act as a processor (or as a HIPAA business associate) on behalf of our customers. When we process personal data on behalf of our customers, we do so in accordance with their instructions and subject to restrictions set forth in our contracts with them, including our Business Associate Agreement and our Terms of Service. If you have an account with a MedChartScan customer (such as a medical group, health system, independent physician association, health plan, or coding agency) and you want to know how that customer processes your personal data, we recommend that you refer to that customer’s privacy notice and contact that customer directly. We are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers.

2. Protected Health Information

When our customers (which are typically medical groups, health systems, independent physician associations, health plans, coding agencies, and other healthcare organizations) upload patient documents to the Services or connect the Services to their electronic health record or other source systems, those documents and records may contain protected health information (“PHI”) as that term is defined under the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder (“HIPAA”). With respect to PHI, MedChartScan acts as a business associate of the relevant customer and our handling of PHI is governed by the Business Associate Agreement between MedChartScan and that customer, not by this Privacy Policy. Where a customer elects to grant a health plan or another third party access to records through the Services (for example, through our payer collaboration features), we provide that access at the customer’s direction and in accordance with the Business Associate Agreement. If you are an individual whose PHI is included in customer data, your rights with respect to that PHI are governed by HIPAA and by your relationship with the relevant healthcare organization, and you should direct any inquiries about that PHI to the healthcare organization that provided it.

3. Personal Data We Collect

The categories of personal data we collect depend on how you interact with us and our Services. We collect personal data you provide directly to us, automatically when you interact with the Website or other Services, and from other sources and third parties.

Personal Data You Provide to Us

  • Contact Information, including first and last name, phone number, email address, mailing address, job title, organization name, and communication preferences. We use this information primarily to fulfill your request or transaction, to communicate with you, to administer your account, to provide you with the Services, and to send you marketing communications in accordance with your preferences.
  • Account and Verification Information, including National Provider Identifier (“NPI”), the legal name of the healthcare organization on whose behalf you register, your title, and your authority to bind the organization. We use this information to verify your eligibility for the Services and to administer your account.
  • Payment Information, including (where applicable) billing name, billing address, and payment card information. Payment card information is collected and processed by our third-party payment processor and is not stored on MedChartScan’s systems.
  • Communications, including emails, support tickets, chat transcripts, recordings of calls (where permitted by law), and other communications you send to us. We use this information to respond to your inquiries, provide support, improve the Services, and comply with our legal obligations.
  • Marketing and Event Information, including information you provide when you request a demo or sign up for newsletters, events, webinars, or surveys, or when you respond to our marketing communications. We use this information to administer the relevant program, to communicate with you, and to inform our marketing activities.
  • Feedback, including comments, suggestions, ideas, and survey responses about the Services. We use this information to improve the Services and our business. As described in our Terms of Service, you grant us a perpetual license to use feedback you provide.

Personal Data Automatically Collected

We, and our third-party partners, automatically collect information about how you access and use the Services. We typically collect this information through cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies, logging technologies, and similar automatic data collection technologies. We may combine information collected automatically with other personal data we collect directly from you or receive from other sources.

  • Device and Network Information, including device type, manufacturer, model, operating system, IP address, browser type, internet service provider, and unique identifiers associated with you, your device, or your network. We may use third-party technologies that recognize when multiple devices are likely being used by the same individual.
  • Usage and Interaction Information, including the site from which you came, the site you go to when you leave the Services, how frequently you access the Services, whether you open emails or click links in them, browsing behavior, the pages you view, the content you interact with, and other actions you take on the Services.
  • Approximate Location, including general geographic location that we or our third-party providers may derive from your IP address. We do not collect precise location data through the Website.

Personal Data from Other Sources

We may receive personal data about you from other sources, including:

  • Employers and Colleagues. If you interact with the Services in connection with your employment, we may obtain personal data about you from your employer or another individual at your organization who has registered for the Services on behalf of the organization.
  • Service Providers. We engage service providers that perform services on our behalf, such as analytics providers, marketing providers, and customer-support providers, who collect personal data and share some or all of it with us.
  • Social Media and Other Public Sources. When you interact with us through social media, we may receive information from the social network in accordance with your privacy settings.
  • Inferences. We may generate inferences about you and your interests based on the other personal data we collect.

4. How We Use Personal Data

We use personal data we collect for the following purposes:

  • To provide and administer the Services, including to operate the Website, administer accounts, authenticate users, verify the eligibility of healthcare-organization customers, process payments, provide customer support and onboarding, and respond to inquiries.
  • To improve and develop the Services, including to monitor and analyze usage patterns, diagnose and fix technical issues, develop new features and services, and improve the security, performance, and functionality of the Services.
  • To communicate with you, including to send service-related notices, security alerts, account-related communications, and (where you have not opted out) marketing communications about MedChartScan products and services.
  • For marketing and advertising purposes, including to inform our marketing activities, deliver advertising on our Website and on third-party properties, and measure the effectiveness of our advertising.
  • To create aggregated or de-identified information that does not identify you and cannot reasonably be used to identify you. We may use such aggregated or de-identified information for lawful business purposes, including for analytics, benchmarking, security monitoring, and to improve the Services.
  • For security, fraud prevention, and legal compliance, including to protect the security and integrity of the Services, detect and prevent fraud and abuse, enforce our Terms of Service and other agreements, defend against legal claims, respond to lawful requests and legal process, and comply with applicable laws.
  • For business operations and transactions, including to facilitate corporate transactions such as mergers, acquisitions, financings, and reorganizations.
  • For any other purpose disclosed to you at the time of collection, or for which you have otherwise consented.

5. How We Disclose Personal Data

We disclose personal data in the following ways:

  • Service Providers. We engage third parties to perform services on our behalf in connection with the operations of our business and the Services. These service providers may include hosting and cloud-infrastructure providers, payment processors, communications providers, customer-support providers, analytics providers, marketing providers, professional advisors (such as lawyers, accountants, and auditors), and security and fraud-prevention providers. Service providers are permitted to access and use personal data only as necessary to perform services on our behalf. A list of the subprocessors we use to provide the Services is available to customers upon request.
  • Our Affiliates. We may share personal data with companies under common ownership or control with MedChartScan for purposes consistent with this Privacy Policy.
  • Marketing and Advertising Partners. We may share personal data with marketing and advertising partners to deliver advertising on our Website and on third-party properties, to measure the effectiveness of our advertising, and to communicate with you about the Services.
  • In Connection with a Business Transaction. We may disclose, transfer, or assign personal data in connection with a corporate divestiture, merger, consolidation, acquisition, reorganization, sale of all or part of our business or assets, financing, or similar transaction (or negotiations for such a transaction), including in the event of our bankruptcy, receivership, or insolvency.
  • To Comply with Law and Protect Rights. We may disclose personal data to law enforcement, government authorities, regulators, courts, and other third parties as we believe in good faith to be necessary or appropriate: (a) to comply with applicable laws or to respond to lawful requests and legal process; (b) to establish, exercise, or defend our legal rights; (c) to protect our rights, property, and safety, and the rights, property, and safety of our customers, our employees, or any other person; (d) to detect, prevent, or investigate fraud, security incidents, or other illegal activity; (e) to enforce our Terms of Service and other agreements; or (f) as otherwise required by applicable law.
  • With Your Consent or at Your Direction. We may disclose personal data to third parties or publicly with your consent or at your direction.

6. Artificial Intelligence

The Services use artificial intelligence and machine learning technologies to process documents and generate outputs, including suggested diagnosis codes, E/M codes, pre-visit summaries, and note-quality findings. We want you to understand our practices:

  • Third-party AI providers. We use third-party AI service providers to power certain features of the Services.
  • Outputs of the Services may contain errors. As described in our Terms of Service, outputs of the Services — including suggested diagnosis codes, E/M codes, and documentation findings — are intended to support, not replace, the independent clinical, coding, documentation, and billing judgment of qualified healthcare professionals. Outputs may contain inaccuracies and must be reviewed by a qualified clinician or coder before being relied upon or submitted to any payer.

7. Your Privacy Choices

Communication Preferences

You can opt out of marketing communications from us at any time. To opt out of marketing emails, click the “unsubscribe” link in any marketing email we send you, or contact us at support@medchartscan.io. To opt out of marketing text messages, reply STOP to any marketing text message you receive from us. Please note that you cannot opt out of service-related communications such as account-verification messages, transaction confirmations, and service updates, which are necessary for our relationship with you.

Cookies and Online Tracking

Most browsers allow you to remove or reject cookies. To do this, follow the instructions in your browser settings. Note that some features of the Website may not function properly if you disable cookies. You can opt out of Google Analytics by installing the browser plugin available at https://tools.google.com/dlpage/gaoptout. You can block our Website from setting cookies used for interest-based advertising by using a browser with privacy features or by installing browser plugins that block third-party cookies and trackers. Because these opt-out mechanisms are specific to the device or browser on which they are exercised, you will need to opt out on every browser and device you use.

Do Not Track and Global Privacy Control

Some browsers may be configured to send “Do Not Track” signals to the online services you visit. We do not currently respond to “Do Not Track” signals. We do honor Global Privacy Control (“GPC”) signals as required by applicable law. To learn more about GPC, visit https://globalprivacycontrol.org.

Your State Privacy Rights

Depending on your state of residence, you may have the following rights with respect to your personal data:

  • Right to Know / Access. The right to request that we disclose what personal data we have collected, used, and disclosed about you.
  • Right to Correct. The right to request that we correct inaccurate personal data we have about you.
  • Right to Delete. The right to request that we delete personal data we have about you, subject to certain exceptions (such as data we need to retain to comply with legal obligations or to provide the Services).
  • Right to Portability. The right to receive a copy of your personal data in a portable, readily usable format.
  • Right to Opt Out of certain processing, including the “sale” or “sharing” of personal data, targeted advertising, and certain profiling activities. You can exercise this right by (a) emailing us at support@medchartscan.io with the subject line “Privacy Rights Request,” (b) enabling the Global Privacy Control setting in your browser, or (c) using any “Your Privacy Choices” link we may make available on our Website.
  • Right to Non-Discrimination. The right not to receive discriminatory treatment for exercising your privacy rights.

You may exercise these rights by contacting us at support@medchartscan.io. We may need additional information from you to verify your identity before fulfilling your request. You may also designate an authorized agent to submit a request on your behalf in accordance with applicable law. We will respond to your request within the timeframe required by applicable law.

State Privacy Rights and Disclosures

California Residents. If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA/CPRA”), including the rights described in this Section 7. The categories of personal data we collect, the sources from which we collect it, the business and commercial purposes for which we use it, and the categories of third parties with whom we share it are described in Sections 3, 4, and 5 of this Privacy Policy. MedChartScan does not “sell” personal data within the meaning of CCPA/CPRA. To the extent MedChartScan “shares” personal data with third-party advertising or analytics partners within the meaning of CCPA/CPRA, you may opt out as described in the Right to Opt Out subsection above. We do not knowingly process the personal data of California residents under the age of 16 for sale or sharing. If you would like to exercise your CCPA/CPRA rights, please contact us at support@medchartscan.io. We will respond within 45 days, subject to permitted extensions under applicable law.

Residents of Other States. If you are a resident of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have additional rights under applicable state privacy laws, including the rights described in this Section 7 above. You may exercise these rights by contacting us at support@medchartscan.io. If we deny your request, you may have the right to appeal that decision; instructions for appealing will be included in our response to your request.

Washington Residents. If you are a Washington resident, you may have rights under the Washington My Health My Data Act (“MHMDA”) with respect to certain “consumer health data” that we collect outside of the HIPAA context. Most of the protected health information MedChartScan processes is governed by HIPAA and the Business Associate Agreement, and HIPAA-regulated data is exempt from MHMDA. To the extent we collect consumer health data subject to MHMDA (for example, in connection with the Website), you have rights to access, delete, and withdraw consent under MHMDA. To exercise these rights, please contact us at support@medchartscan.io.

Nevada Residents. If you are a Nevada resident, you have the right under Nevada law (NRS 603A) to opt out of the sale of certain personal information. MedChartScan does not sell personal information in the manner contemplated by Nevada law. If you have questions, please contact us at support@medchartscan.io.

8. Security

We employ technical, organizational, and physical safeguards designed to protect the personal data we collect. However, no security measures are perfect, and we cannot guarantee the security of your personal data. If we become aware of a security incident affecting your personal data, we will notify you in accordance with applicable law and our contractual obligations.

9. Data Retention

We retain personal data for as long as reasonably necessary to fulfill the purposes for which it was collected, in accordance with our legitimate business interests and applicable law. When determining the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, our purposes for processing the personal data, whether we can achieve those purposes through other means, and our legal, regulatory, tax, accounting, and contractual obligations.

Once retention of the personal data is no longer reasonably necessary, we will either delete or de-identify the personal data, or, if that is not possible (for example, because the personal data has been stored in backup archives), we will securely store the personal data and isolate it from further active processing until deletion or de-identification is possible. Retention of PHI is governed by the Business Associate Agreement, not by this section.

10. Third-Party Websites and Services

The Services may contain links to third-party websites, plug-ins, applications, and other services that we do not own or control. This Privacy Policy does not apply to those third-party services. To learn about the privacy practices of those third parties, please review their respective privacy policies.

11. Children

The Services are intended for use by healthcare organizations and their authorized workforce members and are not directed to children under 13. We do not knowingly collect personal data from children under 13. If we learn that we have collected personal data from a child under 13 without parental consent, we will delete it. If you believe we may have collected personal data from a child under 13, please contact us at support@medchartscan.io. Note that customer data may contain information about pediatric patients; that data is PHI governed by the Business Associate Agreement, not by this section.

12. Job Applicants

When you apply for a job with MedChartScan, we collect your business and personal contact information, professional credentials and skills, education and work history, and other information you provide in connection with your application. We use this information to facilitate our recruitment activities, process employment applications, monitor recruitment metrics, and respond to inquiries. We may also retain your information for purposes of considering you for future openings, and as otherwise necessary to comply with applicable laws, respond to legal process, protect our rights and property, and investigate or prevent violations of law or our policies. The terms of this Privacy Policy do not apply to personal data we collect about MedChartScan employees and contractors after their hire; that information is governed by our internal personnel privacy policies.

13. Users Outside the United States

MedChartScan is based in the United States and the Services are operated from and intended for use in the United States. If you access the Services from outside the United States, your information may be processed in the United States, where data protection laws may differ from those in your country of residence. We do not intentionally direct the Services to residents of, or knowingly process personal data of residents of, jurisdictions outside the United States.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice by updating the “Last Updated” date at the top of this Privacy Policy and, where appropriate, by sending email to your registered email address or by prominent posting on the Website. All changes are effective on the date of publication unless otherwise provided. Your continued use of the Services after the effective date of any change constitutes your acceptance of the revised Privacy Policy.

15. Contact Us

If you have questions or requests in connection with this Privacy Policy or other privacy-related matters, please contact us at support@medchartscan.io or by mail at MedChartScan Inc., One World Trade Center, Suite 49P, New York, NY 10007.