Introduction
Tabula Medica ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our patient health record application.
Information We Collect
- Personal Information: Name, email address, date of birth, and contact information provided during account registration.
- Health Information: Medical records, lab results, medications, allergies, vital signs, immunization records, and other Protected Health Information (PHI) imported from connected healthcare providers via SMART on FHIR and Fasten Health integrations.
- Usage Data: Information about how you interact with the application, including pages visited, features used, and accessibility preferences.
- Device Information: Browser type, operating system, and device identifiers used to optimize your experience.
How We Use Your Information
- To provide and maintain our healthcare data aggregation services
- To process and display your health records from connected providers
- To provide AI-powered health insights, medication explanations, and evidence-based health information
- To communicate with you about your health data and account
- To improve our services and develop new features
- To comply with legal obligations and healthcare regulations
Data Protection & Security
- All Protected Health Information (PHI) is encrypted at rest and in transit using AES-256-GCM encryption
- We maintain strict role-based access controls and comprehensive audit logging
- We comply with HIPAA (Health Insurance Portability and Accountability Act) regulations
- HIPAA-aligned safeguards; SOC 2 Type II audit planned
- Regular security assessments and penetration testing are conducted
- All data transmissions use TLS 1.2 or higher encryption
HIPAA Compliance
Tabula Medica is designed to comply with the Health Insurance Portability and Accountability Act (HIPAA). We implement administrative, physical, and technical safeguards to protect your Protected Health Information (PHI), including:
- Encryption of all PHI at rest and in transit
- Access controls limiting PHI access to authorized personnel only
- Audit trails tracking all access to and modifications of PHI
- Business Associate Agreements (BAAs) with all third-party service providers who handle PHI
- Regular risk assessments and security training
Data Sharing & Third Parties
We do not sell your personal or health information. We may share your information only in the following circumstances:
- Healthcare Providers: With your explicit consent, to facilitate care coordination
- Service Providers: With trusted partners who assist in operating our platform, subject to strict data protection agreements
- Legal Requirements: When required by law, regulation, or legal process
- Emergency Situations: To protect the health and safety of individuals in emergency circumstances
Your Rights
You have the following rights regarding your personal and health information:
- Access: View and download a copy of all your personal and health data
- Correction: Request correction of inaccurate or incomplete information
- Deletion: Request deletion of your data, subject to legal retention requirements
- Portability: Export your health data in standard formats (FHIR, C-CDA)
- Restrict Processing: Request limitations on how your data is used
- Withdraw Consent: Revoke consent for data processing at any time
- Accounting of Disclosures: Request a record of how your PHI has been shared
Data Retention
We retain your personal and health information for as long as your account is active or as needed to provide services. Health records are retained in accordance with applicable state and federal medical record retention laws. You may request deletion of your account and associated data at any time through the Privacy Center in the application.
Children's Privacy
Tabula Medica is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will take steps to delete it promptly.
International Users
If you are accessing Tabula Medica from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States. By using our services, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the application after changes are posted constitutes your acceptance of the revised policy.
Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us: