Privacy Policy

1. Introduction

MedFlo AI is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our healthcare admissions automation platform.

2. Information We Collect

Personal Information

We may collect personal information that you provide directly to us, including but not limited to:

• Name, email address, and contact information
• Organization and facility information
• Account credentials
• Payment and billing information

Protected Health Information (PHI)

As a Business Associate under HIPAA, we process Protected Health Information on behalf of covered entities (skilled nursing facilities, nursing homes, and post-acute care facilities). Our AI-powered platform extracts and processes the following types of PHI:

• Referral Documents: History & Physicals (H&Ps), medication lists, insurance cards, discharge summaries
• Clinical Data: 47+ data points including patient demographics, primary diagnoses (ICD-10 codes), oxygen requirements, weight bearing status, high-cost medications, therapy needs, dietary restrictions, psychiatric capabilities, and bariatric requirements
• Insurance Information: Payer details, coverage verification, eligibility status, in-network information, Medicare/Medicaid details
• Background Screening Results: Sex offender registry checks, state criminal background checks, OIG exclusion list results, Medicaid exclusion data
• Census and Occupancy Data: Facility bed availability, patient admission status, payer mix information

Usage Information

We automatically collect certain information about your device and usage patterns, including:

• IP address and browser type
• Pages visited and features used
• Date and time of access
• Referring website addresses

3. How We Use Your Information

We use the information we collect to provide our AI-powered admissions automation services for post-acute care facilities:

• Automated Referral Processing: AI document intelligence extracts 47+ clinical data points from referral documents in under 10 seconds
• Insurance Verification: Real-time connections to insurance provider databases to verify coverage, eligibility, benefits, and in-network status
• Compliance Background Screening: Automated compliance checks via NSOPW (sex offender registry), state criminal databases (NY DCJS), HHS LEIE (OIG exclusion list), state Medicaid exclusion lists, and SAM.gov
• EHR Integration: Bidirectional data synchronization with PointClickCare and other electronic health record systems, including document uploads and patient demographic transfers
• Census Analytics: Real-time occupancy tracking with 7-day forecasting and payer mix optimization
• Facility Matching: Match referrals to appropriate facilities based on oxygen capacity, psychiatric capabilities, bariatric equipment, therapy requirements, and clinical grid compatibility
• SMS Notifications: Send automated text messages for patient communication and status updates
• Service Operations: Process transactions, maintain user accounts via Firebase Authentication, and provide platform functionality
• Analytics and Improvement: Analyze usage patterns to improve AI accuracy, optimize processing speed, and enhance platform performance
• Communication: Send updates, security alerts, support messages, and compliance notifications
• Legal Compliance: Fulfill legal obligations under HIPAA and other healthcare regulations, enforce our terms of service

4. Information Sharing and Disclosure

We may share your information in the following circumstances:

• With your consent: We share information when you explicitly authorize us to do so, such as when you approve pushing referral data to PointClickCare
• EHR Integration Partners: We share patient data with PointClickCare and other configured EHR systems via secure API connections for the purpose of admissions processing and census management. Our integrations support bidirectional syncing and document uploads.
• Background Check Providers: We share limited patient information with NSOPW (National Sex Offender Public Website), state criminal background check services (e.g., NY DCJS), HHS LEIE (OIG exclusion list), Medicaid exclusion databases, and SAM.gov for compliance screening purposes
• Insurance Verification Services: We connect to insurance provider databases to verify patient coverage and eligibility in real time
• SMS Service Providers: We share phone numbers and message content with our SMS notification service to send automated patient communications
• Cloud Infrastructure: We use Firebase (Google) for authentication services and secure cloud storage. Firebase acts as a Business Associate under our HIPAA compliance program
• Business transfers: In connection with a merger, acquisition, or sale of assets, we may transfer your information to the acquiring entity
• Legal requirements: When required by law, court order, or government regulation, or to protect our rights, safety, and property
• Business Associates: We execute Business Associate Agreements (BAAs) with all third parties that process PHI on our behalf, as required under HIPAA

5. Data Security

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. This includes encryption, access controls, regular security assessments, and staff training. However, no method of transmission over the Internet is 100% secure.

6. HIPAA Compliance

For covered entities and business associates, we maintain compliance with the Health Insurance Portability and Accountability Act (HIPAA) and related regulations. We execute Business Associate Agreements (BAAs) as required and implement appropriate safeguards for PHI.

7. Your Rights and Choices

You have certain rights regarding your personal information:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information, subject to legal obligations
• Opt-out: Unsubscribe from marketing communications
• Data portability: Request a copy of your data in a portable format

8. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations. When information is no longer needed, we securely delete or anonymize it.

SMS Consent Records: In accordance with the Telephone Consumer Protection Act (TCPA), we retain SMS consent records for a minimum of 4 years. This includes records of opt-in consent, opt-out requests, and message delivery logs.

9. SMS Privacy

When you enroll in our SMS notification service, we collect and use your information as follows:

• Information Collected: Phone number, name, facility affiliation, and notification preferences.
• Use of Information: Your phone number is used solely for delivering requested SMS notifications related to patient referrals, case manager messages, and system alerts.
• Data Protection: All SMS data is encrypted and stored in HIPAA-compliant systems.
• Third-Party Sharing: We DO NOT share your phone number or SMS data with third parties for marketing purposes. We only share data with our SMS service provider to deliver messages.
• Your Rights: You can opt-out anytime by texting STOP or contacting manager@medfloai.com.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect usage information and improve our services. You can control cookies through your browser settings.

11. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the effective date.

13. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at: