EZMedical – Privacy Policy

Last Updated: November 1, 2025

EZMedical (“EZMedical,” “we,” “our,” or “us”) is committed to protecting the privacy and security of personal and medical information, including Protected Health Information (PHI) as defined by HIPAA. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform, websites, mobile apps, or communication channels.

1. Scope of This Policy

This Policy applies to all data processed by EZ-Medical AI, including:

Patient and provider information submitted through EZ-Medical AI
PHI processed under a Business Associate Agreement (BAA)
Data entered manually or imported via integrations
Website analytics and device information
Support communications

2. Information We Collect

2.1 Summary Table of Information Collected

Category	Examples	Source	Includes PHI?
Patient & Provider Information	Names, emails, phone numbers, DOB, demographics, appointments, forms, insurance details, documents	You, Your Practice, Integrations	Yes
Identifiers & Account Data	Login credentials (hashed), IP address, MFA logs, clinic name	User	No
Commercial / Transaction Data	Subscription plan, billing history, payment tokens	User / Payment Processor	No
Internet & Device Data	Browser type, OS, cookie IDs, audit logs	System / Browser	No
Support Submissions	Chat messages, emails, attachments, call recordings	User	May Contain PHI
Integration Data	EHR/PMS sync data, insurance eligibility data	Third-party systems	Yes

2.2 We Do NOT Collect

Biometric identifiers
Facial recognition data
Voiceprints or fingerprints
Advertising profiles based on PHI

3. How We Use Information (Including HIPAA)

3.1 Usage Purposes Table

Purpose	Data Used	Legal Basis (GDPR)	HIPAA Basis
Account creation & authentication	Identifiers	Contract	Permitted Use
Scheduling, reminders, patient workflow	PHI, Identifiers	Contract	Treatment / Operations
Forms & clinical workflow tools	PHI	Contract	Treatment / Operations
Insurance eligibility & claims	PHI	Legal Obligation	Payment Activities
Security & auditing	Device data, logs	Legitimate Interest	Security Rule
Platform improvement	De-identified analytics	Legitimate Interest	De-identified Only
Marketing (non-PHI only)	Identifiers	Consent	PHI Excluded