Legal · Privacy Policy
Privacy Policy
Effective September 29, 2026 · Last updated September 29, 2026
This Privacy Policy explains how Medgentix ("Medgentix," "we," "us," or "our") collects, uses, discloses, and protects information when you visit medgentixhealth.com (the "Site"), request a demo, or otherwise interact with us. It also explains how we handle information on behalf of healthcare customers who use the Medgentix platform and its Agentic Agents (the "Services").
1. Two roles: website visitor data vs. patient data
Website and business contact data. When you browse our Site or contact us, Medgentix decides how that information is used. This Policy governs that data.
Protected Health Information (PHI). When a healthcare provider, practice, or health plan (a "Customer") uses our Services, we process patient information on the Customer’s behalf as a HIPAA Business Associate. That processing is governed by the Customer’s Business Associate Agreement (BAA) with us and by HIPAA, not by the marketing and analytics provisions of this Policy. Patients should contact their healthcare provider about how their PHI is used; we will route any request we receive to the appropriate Customer.
2. Information we collect
- Information you provide: name, work email, phone number, organization, role, number of providers, workflow challenges, and anything you include in demo requests, support tickets, or emails.
- Account information: for Customer users, login credentials, role, permissions, and audit-log activity.
- Automatically collected information: IP address, browser type, device identifiers, pages viewed, referring URLs, and approximate location, collected through cookies and similar technologies (see our Cookie Policy).
- Information from third parties: business contact details from event partners, referral partners, or publicly available professional sources.
3. How we use information
- Respond to demo requests, questions, and support needs
- Provide, secure, maintain, and improve the Services
- Model ROI and scope pilots for prospective Customers
- Send service, security, and administrative notices
- Send marketing communications, which you may opt out of at any time
- Detect, investigate, and prevent fraud, abuse, and security incidents
- Comply with legal obligations and enforce our agreements
We do not sell personal information, and we do not use PHI for marketing, advertising, or to train models shared across Customers.
4. How we share information
- Service providers who host, secure, analyze, or support our Site and Services, bound by confidentiality and, where PHI is involved, subcontractor BAAs
- Integration partners that a Customer directs us to connect (for example, an EMR, clearinghouse, or messaging provider)
- Professional advisors such as attorneys, auditors, and insurers
- Legal and safety disclosures when required by law, subpoena, or to protect rights, safety, and security
- Business transfers in connection with a merger, acquisition, or sale of assets, subject to this Policy and applicable BAAs
5. Data retention
We keep website and business contact information for as long as needed to fulfill the purposes above, typically no longer than 36 months after your last interaction, unless a longer period is required by law. PHI is retained and returned or destroyed according to each Customer’s BAA and instructions.
6. Security
We use administrative, physical, and technical safeguards designed to protect information, including AES-256 encryption at rest, TLS 1.2+ in transit, role-based access controls, single sign-on, continuous monitoring, and immutable audit logging. No system is perfectly secure; we will notify affected parties of incidents as required by law and by contract.
7. Your choices and rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information; to opt out of certain processing, including targeted advertising; and to appeal a decision about your request. Residents of California, Colorado, Connecticut, Virginia, Texas, and other states with comprehensive privacy laws may exercise these rights by emailing privacy@medgentixhealth.com. We will verify your request and will not discriminate against you for exercising your rights. You may unsubscribe from marketing emails using the link in any message.
We honor Global Privacy Control (GPC) signals as a request to opt out of sale or sharing where required by law.
8. Children
The Site and Services are intended for healthcare organizations and professionals. We do not knowingly collect personal information from children under 16 through the Site. PHI relating to minors is processed only on behalf of Customers under their BAAs.
9. International users
Medgentix is based in the United States and our Services are designed for U.S. healthcare organizations. If you access the Site from outside the U.S., your information will be processed in the U.S.
10. Changes to this Policy
We may update this Policy from time to time. We will post the revised version with a new effective date and, for material changes, provide additional notice.
11. Contact us
Privacy questions: privacy@medgentixhealth.com
Medgentix, Attn: Privacy Officer, [Company Mailing Address]
Legal · Terms of Service
Terms of Service
Effective September 29, 2026 · Last updated September 29, 2026
These Terms of Service ("Terms") govern your access to and use of the Medgentix website and, unless a separate written agreement applies, the Medgentix platform, Agentic Agents, Workflows, Open Connect (MCP), and related services (together, the "Services"). By using the Services, you agree to these Terms. If you use the Services on behalf of an organization, you represent that you have authority to bind that organization.
1. Enterprise agreements control
Most Customers use the Services under a signed Master Services Agreement, Order Form, and Business Associate Agreement. If those documents conflict with these Terms, the signed documents control.
2. The Services
Medgentix provides software that automates administrative, operational, and revenue-cycle work for healthcare organizations using specialized AI agents ("Agentic Agents") and deterministic automations ("Workflows"). Features, agent availability (including "Live" and "Pilot" designations), and integrations may change over time.
3. Not medical advice; clinical responsibility
The Services support administrative and documentation work. They do not provide medical advice, diagnosis, or treatment, and they are not a substitute for professional clinical judgment. Customers and their licensed clinicians remain solely responsible for all clinical decisions, for reviewing and signing any AI-drafted clinical documentation, coding, or orders before use, and for configuring appropriate human review and escalation rules.
4. Customer responsibilities
- Maintain the confidentiality of account credentials and promptly report unauthorized use
- Provide all notices to, and obtain all consents and authorizations from, patients and staff required by law, including for call recording, texting (TCPA), and AI disclosure
- Ensure you have the rights to connect third-party systems and share data with Medgentix
- Use the Services in compliance with HIPAA, applicable state law, payer rules, and these Terms
5. Acceptable use
You will not: (a) use the Services for unlawful, fraudulent, or deceptive purposes, including upcoding or false claims; (b) attempt to access data or systems you are not authorized to access; (c) reverse engineer, scrape, or copy the Services except as permitted by law; (d) interfere with or disrupt the Services’ integrity or security; (e) use the Services to send unsolicited communications in violation of law; or (f) use the Services to build a competing product.
6. Data and privacy
Our handling of personal information is described in our Privacy Policy. PHI is processed only as permitted by the applicable Business Associate Agreement. As between the parties, Customer owns Customer Data. Medgentix may use de-identified and aggregated data, created in accordance with HIPAA, to operate, secure, and improve the Services.
7. Intellectual property
Medgentix and its licensors own the Services, including all software, models, agent designs, templates, documentation, and the Medgentix name and logo. Subject to these Terms and payment of applicable fees, we grant Customer a limited, non-exclusive, non-transferable right to use the Services for its internal business purposes. Feedback you provide may be used by Medgentix without obligation.
8. Fees
Fees are set out in the applicable Order Form. Unless stated otherwise, fees are billed in advance, non-refundable, and exclusive of taxes. Pilot programs are provided on the terms stated in the pilot order.
9. Third-party services
The Services interoperate with third-party products such as EMRs, clearinghouses, payment processors, and communications providers. Medgentix is not responsible for third-party products, and your use of them is governed by their terms.
10. Warranties and disclaimers
Medgentix will provide the Services in a professional manner consistent with its documentation. EXCEPT AS EXPRESSLY STATED IN A SIGNED AGREEMENT, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE," AND MEDGENTIX DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. AI-GENERATED OUTPUTS MAY CONTAIN ERRORS AND MUST BE REVIEWED WHERE REQUIRED.
11. Limitation of liability
TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR LOST PROFITS OR REVENUE. EACH PARTY’S TOTAL LIABILITY WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER IN THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM, EXCEPT AS OTHERWISE PROVIDED IN A SIGNED AGREEMENT.
12. Indemnification
Each party will defend and indemnify the other against third-party claims arising from its breach of these Terms or violation of law, as further detailed in the applicable signed agreement.
13. Term and termination
These Terms apply while you use the Services. We may suspend access to protect the security or integrity of the Services or for material breach. Upon termination, Customer Data and PHI will be returned or destroyed as set out in the applicable agreement and BAA.
14. Governing law
These Terms are governed by the laws of the State of Delaware, without regard to conflict-of-law rules. The state and federal courts located in Delaware will have exclusive jurisdiction, unless a signed agreement provides otherwise.
15. Changes and contact
We may update these Terms by posting a revised version with a new effective date. Questions: legal@medgentixhealth.com · Medgentix, Attn: Legal, [Company Mailing Address]
Legal · HIPAA Notice
HIPAA Notice
Effective September 29, 2026 · Last updated September 29, 2026
Medgentix provides services to HIPAA Covered Entities, such as physician practices, health systems, and health plans, and acts as their Business Associate. This notice explains how we protect Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and their implementing regulations (together, "HIPAA").
Our role
We create, receive, maintain, and transmit PHI only on behalf of our Customers and only as permitted by HIPAA and each Customer’s Business Associate Agreement. We do not use or disclose PHI for our own marketing, we do not sell PHI, and we do not use PHI to train models shared across Customers.
For patients
If you are a patient, your healthcare provider (not Medgentix) is responsible for your Notice of Privacy Practices and for responding to requests to access, amend, or receive an accounting of disclosures of your health information. If you contact us with such a request, we will forward it to your provider promptly and support them in responding. When you speak with or message a Medgentix Agentic Agent on behalf of your provider, you will be told you are interacting with an automated assistant and may ask for a staff member at any time.
Safeguards we maintain
- Administrative: a designated Security Officer and Privacy Officer, workforce HIPAA training, annual risk analysis, sanctions policy, and vendor management with subcontractor BAAs
- Physical: hosting in SOC 2–audited data centers with controlled access
- Technical: AES-256 encryption at rest, TLS 1.2+ in transit, unique user IDs, SSO and MFA, role-based and minimum-necessary access, automatic logoff, and tamper-evident audit logs of every Agentic Agent action
- AI-specific: zero-data-retention agreements with model providers, PHI redaction where PHI is not needed, and human-in-the-loop review for clinical documentation and high-impact actions
Breach notification
If we discover a Breach of Unsecured PHI, we will notify the affected Customer without unreasonable delay, and no later than the timeframe set in the BAA (never later than 60 days after discovery), with the information the Customer needs to meet its own notification obligations.
Business Associate Agreements
A BAA is included with every paid plan. See our Business Associate Agreement page for a summary of key terms or to request a copy.
Contact our Privacy & Security Officer
privacy@medgentixhealth.com · security@medgentixhealth.com
Medgentix, Attn: HIPAA Privacy Officer, [Company Mailing Address]
Legal · Business Associate Agreement
Business Associate Agreement
Effective September 29, 2026 · Last updated September 29, 2026
Medgentix signs a HIPAA Business Associate Agreement (BAA) with every paid Customer, from single-location practices to enterprise health systems. There is no enterprise-only add-on. Below is a plain-English summary of our standard BAA. The executed agreement controls.
Key terms of our standard BAA
- Permitted uses and disclosures. We use and disclose PHI only to provide the Services, as required by law, or for our proper management and administration as permitted by HIPAA.
- Safeguards. We implement administrative, physical, and technical safeguards that comply with the HIPAA Security Rule.
- Minimum necessary. Agentic Agents access only the PHI needed for the configured task.
- Subcontractors. Any subcontractor that handles PHI signs a BAA with terms at least as protective as ours.
- Reporting. We report any use or disclosure not permitted by the BAA, any Security Incident, and any Breach of Unsecured PHI.
- Individual rights. We support the Customer in responding to patient requests for access, amendment, and accounting of disclosures.
- Books and records. We make our practices available to HHS for determining compliance.
- AI and model providers. PHI sent to large-language-model providers is covered by BAAs and zero-data-retention terms and is never used to train shared models.
- Return or destruction. At termination, we return or destroy PHI and certify destruction. Where that isn’t feasible, protections continue for as long as we retain it.
- Term. The BAA remains in effect for as long as we maintain PHI on the Customer’s behalf.
Using your own BAA
Enterprise Customers and health systems may propose their own BAA form. Our legal team reviews these routinely, and most are executed within five business days.
Request a BAA
Email legal@medgentixhealth.com with your organization’s legal name and signer, or ask during your demo. You can also book a demo and we’ll include the BAA in your pilot paperwork.
Legal · Cookie Policy
Cookie Policy
Effective September 29, 2026 · Last updated September 29, 2026
This Cookie Policy explains how Medgentix uses cookies and similar technologies on medgentixhealth.com. We never place advertising or analytics cookies inside the Medgentix platform where PHI is processed.
What are cookies?
Cookies are small text files stored on your device that help websites function, remember preferences, and understand how visitors use them. Similar technologies include pixels, local storage, and SDKs.
Cookies we use
| Category | Purpose | Can you turn it off? |
|---|
| Strictly necessary | Site security, load balancing, form submission, and remembering your cookie choice | No (required for the Site to work) |
| Analytics | Understanding which pages are useful so we can improve the Site | Yes |
| Marketing | Measuring campaign performance and showing relevant ads to business audiences | Yes |
Your choices
You can accept or decline non-essential cookies using our cookie banner, change your choice at any time with the cookie preferences link, and block or delete cookies in your browser settings. We honor Global Privacy Control (GPC) signals.
Contact
privacy@medgentixhealth.com
Legal · AI Transparency & Responsible Use
AI Transparency & Responsible Use
Effective September 29, 2026 · Last updated September 29, 2026
Medgentix’s Agentic Agents are powerful. We believe healthcare organizations and patients deserve to know how they work and where the limits are. These are the commitments we build into every agent.
Our commitments
- Disclosure. Patients are told when they are interacting with an automated agent, and can reach a human on request.
- Human in the loop. Clinical documentation, coding, orders, appeals, and other high-impact actions support mandatory human review. Customers configure escalation thresholds for every agent.
- Explainability. Every agent action records its reasoning in plain language, alongside an immutable audit trail.
- No clinical decision-making. Agentic Agents do not diagnose, prescribe, or make treatment decisions. Urgent clinical signals are escalated immediately to licensed staff.
- Data protection. PHI is never used to train models shared across Customers. Model providers operate under BAAs with zero data retention.
- Fairness and accessibility. We test agents across languages, accents, and patient populations, and we monitor for disparate performance.
- Accuracy monitoring. We continuously evaluate agent quality, and Customers can review performance metrics and flag errors.
- Compliance. Agents are designed to support HIPAA, TCPA, the No Surprises Act, CMS interoperability and prior-authorization rules, and applicable state AI-disclosure laws.
Report a concern
If you believe an agent behaved incorrectly or unfairly, email ai-safety@medgentixhealth.com. We review every report.
Legal · Accessibility Statement
Accessibility Statement
Effective September 29, 2026 · Last updated September 29, 2026
Medgentix is committed to making our website and patient-facing agent experiences accessible to everyone, including people with disabilities.
Our standard
We aim to conform to the Web Content Accessibility Guidelines (WCAG) 2.2 Level AA for this Site and for patient-facing interfaces such as intake forms, text messages, and web chat. Voice agents support adjustable pacing, repetition on request, and transfer to staff or relay services.
Measures we take
- Semantic HTML, keyboard navigation, and visible focus states
- Color-contrast checks on text and interactive elements
- Alternative text for meaningful images
- Patient communications in 50+ languages and at plain-language reading levels
- Accessibility review as part of new-feature releases
Feedback
If you encounter a barrier, contact accessibility@medgentixhealth.com. Tell us the page or feature and the assistive technology you use. We aim to respond within five business days.