Privacy Policy

At MedFiles.ai, the privacy of your medical data is our top priority. This Privacy Policy describes how we collect, use, store, and protect your personal information and health data.

1. Information We Collect

1.1 Account Information

• First and last name
• Email address
• Password (encrypted)
• Date of birth (optional)
• Country and language preferences
• Mobile phone number (optional; used for WhatsApp verification and, if you enable it, WhatsApp alert notifications)

1.2 Medical Data

• Medical documents you upload (prescriptions, lab results, images)
• MedFiles Inbox: emails received at your profile's @medfilesinbox.com address, including sender metadata and attachments. Items are shown for your review; approved attachments are imported into your records. If you enable trusted senders, matching emails may be auto-saved without per-message approval.
• Connected email and cloud storage accounts (optional): for the emails and files that look medical, the sender, subject, date, file names and what we detected, so you can review them; never the body of an email. See section 4.6.
• Emergency ID card: medical summary and emergency contacts you choose to expose via your emergency link or QR code (when you enable the feature)
• Medical profile information (blood type, allergies, medications)
• Document categorization and tags
• AI-generated analysis of your documents

1.3 Usage Information

• IP address and approximate location
• Device type and browser
• Pages visited and usage time
• Interactions with AI features

2. How We Use Your Information

We use your information to:

• Provide the Service: Store, organize, and display your medical documents
• MedFiles Inbox: Receive documents emailed to your profile addresses, review them, import approved attachments, and optionally auto-save messages from trusted senders you configure
• Connected accounts: find the medical records you already have in an email or cloud storage account you connect, show them to you and add the ones you choose
• AI Analysis: Classify documents, extract data, detect critical values
• Secure Sharing: Allow you to share documents with authorized professionals
• Emergency ID: Show a limited medical summary to anyone you give your emergency link or QR code to
• Communications: Send important notifications and service updates (email, in-app, push)
• Optional WhatsApp notifications (patients, web and mobile app): Utility alerts you opt in to, MedFiles Inbox and appointment reminders, sent to your account mobile number
• WhatsApp verification: One-time codes sent on WhatsApp to verify your mobile number when you add or change it
• Support: Respond to your inquiries and resolve technical issues
• Improvements: Analyze aggregated (anonymized) usage to improve the service
• Security: Detect and prevent fraud, abuse, and security violations

3. Legal Basis for Processing (GDPR)

If you are in the European Union or European Economic Area, we process your personal data under the following legal bases:

• Consent: When you create an account, accept AI consent for AI features, connect an email or cloud storage account, request WhatsApp phone verification, and enable optional services (for example, WhatsApp alert notifications); we may also ask you, when you create your account or when we update this policy, for separate and explicit consent to process your health data and to confirm that you are 18 or older
• Contract: To provide the service you request
• Legitimate Interest: To improve security and prevent fraud
• Legal Compliance: When required by law

4. Sharing Your Information

4.1 We NEVER Share with Third Parties for Marketing

We do not sell, rent, or share your medical data with advertising or marketing companies.

4.2 Sharing Controlled by You

• Doctors you are connected with: Only the documents you choose to share with them; connecting alone gives them no access
• Emergency ID link or QR: Only people you share the link with can view the limited profile summary you enable; you can deactivate the card anytime
• Healthcare professionals: Only those you authorize can view your documents
• Full control: You can revoke access at any time

4.3 Necessary Service Providers

We share minimal data with:

• Google Cloud Platform: Secure cloud file storage
• Google AI (Gemini): Classification on upload (name, category, folder, extraction of medical appointment when applicable depending on document type), document analysis, and chat, and deciding whether the emails and files from the accounts you connect are medical (see 4.6). See 4.3.1 below for details.
• Brevo: Transactional email delivery (verification, notifications)
• Twilio: WhatsApp phone verification (when applicable) and optional WhatsApp utility notifications (delivery only; medical document content is not sent in WhatsApp messages)
• Stripe (website): Secure payment processing for paid subscriptions on medfiles.ai (we do not store card data; Stripe handles payment information). To calculate the taxes that apply where you live, Stripe may ask for your billing address at checkout. Apple App Store and Google Play (mobile apps, when applicable): In-app purchases and subscription billing through the respective app stores.
• Cloudflare: Receives the email sent to your MedFiles Inbox address and forwards it to us, and protects the service against abuse
• Sentry: Error reports so we can find and fix failures in the website and the app (technical information only; document content is not sent)
• Meta (Facebook) Pixel: ad conversion measurement, only on our public pages and on the welcome page after sign-up, never on the pages where you manage your health information. See our Cookie Policy.
• Google Analytics, Google Ads, Meta Pixel and Metricool: visit and ad conversion measurement, only on our public pages and on the welcome page after sign-up, never on the pages where you manage your health information. See our Cookie Policy. If you accepted advertising cookies when you paid, each time a payment for your plan is charged we also tell Google Analytics the amount and the type of plan, without your email or any health information.

4.3.1 AI document classification, analysis and chat

When you upload documents we use AI to classify them: we send the content to Google Cloud (Gemini) to suggest name, category, folder, and to extract medical appointment when applicable (depending on document type). When you use AI document analysis or AI chat, we also send the document content (and your chat messages) to Gemini to generate the analysis or answer. If you connect an email or cloud storage account, we also use AI (Gemini) to decide whether each email or file you chose is a medical record, looking at its sender, subject, the beginning of the text, the names of its attachments and the first page of a PDF or a reduced image, as described in section 4.6. Nothing from those accounts is stored for that purpose. When a patient shares a document with their doctor, we also use AI (Gemini) to estimate how much attention it needs, so the doctor can prioritize; if the document does not have an AI analysis yet, its content is sent to Gemini for this. The patient does not see this estimate, and it is not a diagnosis. When a doctor or a patient asks for an AI summary of their conversation, the messages of that conversation are sent to Gemini to write it. When a doctor asks to translate the reason for an appointment that the patient wrote in another language, that text is sent to Gemini to translate it; the original is not changed. Content generated by AI is labeled as such in the app and in exported PDFs. Separate AI consent is required before most AI features; see Section 3 and our Terms. You can withdraw it at any time in Settings. When you withdraw it, the AI you ask for stops (document analysis, AI chat, AI summaries, questions to the AI about your health and finding records in a connected email account), and your doctors can no longer use AI on the documents you share with them, on your conversation with them or on the reason you wrote for an appointment. Classification on upload (name, category, folder, the text used for search, appointments and health values) keeps working, because it is how MedFiles organizes your records. AI analyses and summaries already saved are not deleted. MedFiles Inbox document processing follows the rules described in our Inbox documentation. This data is processed only for these features and is not used to train Google's public models. We use infrastructure and practices that align with HIPAA-style protection measures for health data. Google acts as our data processor under contractual safeguards consistent with this privacy policy.

All these providers are contractually obligated to protect your data and CANNOT use it for their own purposes.

In our mobile applications, subscription purchases are processed through the Apple App Store on iOS and through Google Play on Android; on our website, through Stripe. In the apps, plan prices are shown in the app and payment is handled by the app store. We do not store your card details on our servers; Stripe, Apple, and Google handle payment information according to their policies.

4.4 Optional WhatsApp notifications (patients)

If you are a patient and choose to enable WhatsApp notifications in MedFiles Settings (website or mobile app):

• Opt-in only: We send WhatsApp messages only after you explicitly enable them and accept the terms in Settings.
• We use the mobile number on your account to deliver utility messages (MedFiles Inbox alerts and appointment reminders).
• Messages contain a short utility text, a link to MedFiles, and limited metadata (for example, sender name or email subject for Inbox alerts, or appointment date and provider for reminders). They do not include attachment contents, diagnoses, or full document text.
• Delivery is handled by Twilio and WhatsApp (Meta) as service providers under contractual safeguards.
• You can turn off WhatsApp anytime in Settings or reply STOP to our WhatsApp number.
• WhatsApp preferences are managed in Settings on the website and mobile app. In-app and push notifications remain available separately.

4.5 Mobile phone numbers and WhatsApp verification

When you add a mobile phone number to your MedFiles.ai account, we may collect and use that number to send you a one-time verification code on WhatsApp. These messages are used only to verify that you own or control the phone number associated with your account.

• One WhatsApp message per request: we send a single verification code only when you tap Send verification code or request a new code.
• We do not sell, rent, or share mobile phone numbers or phone verification data with third parties or affiliates for marketing or promotional purposes.
• Verification is optional. If you do not request a code, no verification message is sent. Reply STOP on our WhatsApp sender number applies to optional alert messages (see section 4.4), not to one-time verification codes.
• WhatsApp verification messages from MedFiles.ai are authentication-only, not used for marketing or promotion, and do not include medical information.

4.6 Connected email and cloud storage accounts (optional)

You can connect an account to MedFiles to find the medical records you already have there (for example, an email account like Gmail or Outlook, or a cloud storage account like Google Drive or Dropbox). The providers you can connect are the ones available in MedFiles at the time, as shown in the app, and what MedFiles can do with a connected account (search it, show you what it found and add records to your account) depends on your plan. If you connect one, this is what happens:

• Access you give: you sign in with the provider of that account, never with us, and you give MedFiles permission to read that mailbox or the files in that storage account. We never see or store your password. We store the access key your provider gives us encrypted (AES-256), we use it only for this feature, and we delete it when you disconnect.
• Google accounts: if you connect Gmail, we ask Google for read-only access to your email (the gmail.readonly permission) and for the email address of that Google account (openid and email), so we know which account you connected. We use that access only to search your emails, look at the ones that may carry medical records and download the attachments you add to MedFiles. If you connect Google Drive, we ask Google for read-only access to your files in Google Drive (the drive.readonly permission). This access covers all of your Google Drive, so MedFiles could technically read any file there, but it doesn't: MedFiles doesn't look through the rest of your Google Drive or look for new files on its own. We use that access only to list the folders you open in MedFiles and to read the files and folders you choose to add, including what is inside the folders you choose. We don't use what we read for advertising and we don't sell it. MedFiles never sends, changes, moves or deletes anything in your Google account.
• Microsoft accounts: if you connect Outlook, with a personal Microsoft account (such as Outlook.com or Hotmail), we ask Microsoft for read-only access to your email (the Mail.Read permission of Microsoft Graph), for the basic information that tells us which account you connected (openid and email), and for permission to keep that access when you are not in MedFiles (offline_access), so a search can keep going on its own. We use that access only to search your emails, look at the ones that may carry medical records and download the attachments you add to MedFiles. We don't use what we read for advertising and we don't sell it. MedFiles never sends, changes, moves or deletes anything in your Microsoft account.
• Dropbox accounts: if you connect Dropbox, we ask Dropbox for read-only access to the files in your Dropbox (the files.metadata.read and files.content.read permissions) and for the basic information of your Dropbox account (account_info.read), so we know which account you connected. This access covers all of your Dropbox, so MedFiles could technically read any file there, but it doesn't: it only lists the folders you open in MedFiles and only reads the files and folders you choose to add, including what is inside the folders you choose. MedFiles doesn't look through the rest of your Dropbox or look for new files on its own. To decide whether a file you chose is medical we look at its name, its folder within what you chose (for a file you chose on its own, only the name of the folder it is in), its date and what it contains (the first page of a PDF, or the image reduced in size, without storing it), including with AI (Google Gemini) under the AI consent you accepted. For the files that look medical we keep that information and what we detected, so you can review them, and for the ones that don't, the name and the reason, so you can put one back in the list; a file is added to MedFiles only when you choose to import it. What you don't import is deleted after 30 days; for what you import, after 30 days we delete the folder name and keep the service, the file name and its date. We don't use what we read for advertising and we don't sell it. MedFiles never changes, moves or deletes anything in your Dropbox.
• OneDrive: if you connect OneDrive, with a personal Microsoft account (such as Outlook.com or Hotmail), we ask Microsoft for read-only access to the files in your OneDrive (the Files.Read permission of Microsoft Graph), for the basic information that tells us which account you connected (openid, email and User.Read), and for permission to keep that access when you are not in MedFiles (offline_access). This access covers all of your OneDrive, so MedFiles could technically read any file there, but it doesn't: it only lists the folders you open in MedFiles and only reads the files and folders you choose to add, including what is inside the folders you choose. MedFiles doesn't look through the rest of your OneDrive or look for new files on its own. To decide whether a file you chose is medical we look at its name, its folder within what you chose (for a file you chose on its own, only the name of the folder it is in), its date and what it contains (the first page of a PDF, or the image reduced in size, without storing it), including with AI (Google Gemini) under the AI consent you accepted. For the files that look medical we keep that information and what we detected, so you can review them, and for the ones that don't, the name and the reason, so you can put one back in the list; a file is added to MedFiles only when you choose to import it. What you don't import is deleted after 30 days; for what you import, after 30 days we delete the folder name and keep the service, the file name and its date. We don't use what we read for advertising and we don't sell it. MedFiles never changes, moves or deletes anything in your OneDrive.
• What we read: the emails with attachments from the period you choose, within what your plan allows, and, if you turn on the automatic search for new records, the ones that arrive after that. To decide whether an email is medical we look at the sender, the subject, the beginning of the message text (up to 2,000 characters, read without storing it) and the names of its attachments, including with AI (Google Gemini) under the AI consent you accepted. For the emails that may be medical, the AI also looks at what each PDF or image attachment contains (the first page of a PDF, or the image reduced in size) only to decide whether it is a medical record; we don't store what it sees. We may also read, on our servers, the text of the first pages of up to two PDF attachments of an email, without AI and without storing it, only to decide whether it may be medical; and the emails with attachments from a sender you already imported a document from are always treated as possibly medical. Only PDF and image attachments (JPEG, PNG, WebP or HEIC) can be added to MedFiles. When a document from an email is added to MedFiles, we also read the text of that email once, without storing it, and use AI (Google Gemini) to find an upcoming appointment; if there is one, we add it to your appointments for you to confirm or reject. From the last six months of the period you choose, we also look at emails without attachments whose sender, subject or first lines suggest a medical appointment (up to 300 per search) and, if you turn on the automatic search for new records, the new ones that arrive without attachments. For those, we read the text of the email once, without storing it, and use AI (Google Gemini) to find an upcoming appointment; if there is one, we add it to your appointments for you to confirm or reject, and the email is never added as a document. While you review, you can also open an email to read it: we get it from your email provider at that moment only to show it to you, and we don't store it. You can also view or download an attachment, or a file from a connected cloud storage account, before adding it: we get it from your provider at that moment, only to show it to you or give it to you, and we don't keep a copy. Images inside an email are not loaded unless you choose to show them; if you do, they are loaded from the sender's servers, which can then learn that you opened the email.
• What we keep: we never store the body of an email. For the emails that look medical we keep the sender, the subject, the date, the names of the attachments and what we detected in each one (for example, the type of record and whose it seems to be), so you can review them. A document is added to MedFiles when you choose to import it. If you turn on automatic import for that email account, a document from a new email is also added on its own when we are highly confident it is medical, your email provider verified the sender, and you already imported a document from that sender yourself. Either way, it is then a document of your account like any file you upload. For an email without attachments from which we added an appointment, we keep only the sender's address and the date of the email, linked to that appointment, until you disconnect that email account; never its subject or its text.
• Emails that don't look medical are not stored, except the ones whose attachments we looked inside and set aside as not medical: we keep them, with the reason, for 30 days, so you can put one back in the list. We only keep a technical mark that an email was already checked, without its sender, subject or content, so we don't check it again. These marks are kept if you disconnect and reconnect the same email account in the same MedFiles account, and are deleted if that email account is connected to a different MedFiles account or when you request the deletion of your MedFiles account.
• What you don't import is deleted after 30 days. For what you import, after 30 days we delete the subject and the names, and keep what shows where each document came from: the sender's address, who issued it, the date of the email and the names of its attachments.
• Senders: if you block a sender or choose to always see their emails, we keep that sender's address so you can see it and undo your choice in Settings. To learn from what you import and remove, we keep only a coded fingerprint of the sender's address, which can't be turned back into the address, with how many emails you imported and removed; never the subject or the content. This stays in your account, isn't shared with other accounts, is included when you download your data, and is deleted when you disconnect that email account or delete your MedFiles account.
• No one at MedFiles reads your email or the files from the accounts you connect, except with your explicit permission for specific messages or files (for example, when you ask us for help), when it is necessary for security (for example, to investigate abuse) or when the law requires it. We don't use them for advertising, we don't sell them, and we don't use them to train AI models.
• Who else receives them: we don't transfer what we receive from the accounts you connect to anyone else, except to the providers that run MedFiles for us, under contract and only as needed for this feature (Google Cloud, where it is stored, and Google Gemini, which helps classify it), when you choose to share a document yourself, or when the law requires it.
• MedFiles' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Read the Google API Services User Data Policy
• You can disconnect at any time in Settings. When you disconnect, we stop reading that account and delete the access key and what was waiting for your review; the documents you imported stay in your account. Without that key, MedFiles can no longer read that account. If the provider allows it, as Google and Dropbox do, we also ask it to revoke MedFiles' access; you can also remove that access yourself, for a Google account at https://myaccount.google.com/permissions, and for a Dropbox account in its connected apps, at https://www.dropbox.com/account/connected_apps. Microsoft doesn't let an app withdraw the access you gave it, so for a Microsoft account (Outlook or OneDrive) you remove it in your account settings, at https://account.live.com/consent/Manage. If you request the deletion of your MedFiles account, we disconnect all your connected accounts right away.
• Connected cloud storage: if you connect Google Drive, OneDrive or Dropbox, you give MedFiles read-only access to your files there. MedFiles never changes, moves or deletes anything in that account. We only open the folders you browse in MedFiles and only look at the files and folders you choose to add; we don't read or keep anything else from your account. To decide whether a file you chose is medical we look at its name, its folder within what you chose (for a file you chose on its own, only the name of the folder it is in), its date and what it contains (the first page of a PDF, or the image reduced in size, without storing it), including with AI (Google Gemini) under the AI consent you accepted. For the files that look medical we keep that information and what we detected, so you can review them, and for the ones that don't, the name and the reason, so you can put one back in the list; a file is added to MedFiles only when you choose to import it. What you don't import is deleted after 30 days; for what you import, after 30 days we delete the folder name and keep the service, the file name and its date. When you disconnect, we stop accessing that account and delete the access key and what was waiting for your review.

4.7 Organizations you are linked to

If you link your account to an organization in MedFiles (for example a laboratory, a clinic or an insurer), that organization can send you messages that appear in the Organizations tab of your Inbox, and a notification on your phone. Linking does not give the organization access to your documents or your health information, and it never will. To show you these messages and to protect you, we record when a message reached your Inbox, whether you opened it, whether you tapped its button, and whether you reported it or stopped receiving messages. The organization only sees totals for each message, and never for fewer than 10 people: it never learns who opened, tapped, reported or stopped receiving a message. You can stop promotional messages or all messages from an organization from any of its messages or in My organizations, and you can end the link at any time.

5. Data Security

We implement multiple layers of security:

5.1 Encryption

• In transit: HTTPS with TLS 1.2 or higher for all communications
• At rest: Encrypted files in Google Cloud Storage
• Passwords: Hashed with bcrypt (12 rounds)

5.2 Access Control

• JWT authentication with 30-day tokens
• Account security and activity audit logs
• Strict separation between users

5.3 Infrastructure

• Servers in Google Cloud Platform with distributed infrastructure
• Automatic daily backups
• Error monitoring and alerts
• Regular security updates

6. Data Retention

We retain your data as follows:

• Active account: While your account is active and you use the Service
• Documents in Trash: Up to 30 days after you delete a document, then permanent removal from active systems
• MedFiles Inbox while paused: emails that arrive while your Inbox is paused are held for 30 days without being opened, and are then deleted. During that time you can see who sent them and when.
• MedFiles Inbox over your document limit: emails that arrive with more documents than still fit within your plan's document limit are held for 30 days without being opened, and are then deleted. During that time you can see who sent them and when. They are added to your account only if you choose a plan before those 30 days end.
• Account deactivation: Your data remains stored; you can sign in again to reactivate (Settings → Deactivate or delete account)
• Account deletion request: 30-day grace period during which your account stays active and you may cancel the request
• After the grace period (when we process your request, on or shortly after the scheduled date): We deactivate your access to MedFiles (you will not be able to sign in, unlike temporary deactivation). Subscriptions billed on our website (Stripe), when applicable, are cancelled with Stripe and in our records. Subscriptions through the Apple App Store or Google Play are not cancelled by us from our servers, you must cancel them in your device account settings. We delete your personal data and documents from our active production systems as part of account closure; this may take additional time after access is deactivated.
• Connected accounts: what we found and you didn't import is deleted after 30 days; the access key to each account is deleted when you disconnect it or request the deletion of your MedFiles account.
• Found in your connected accounts during your trial: for what we found during your trial and you didn't import, the deletion period starts on the day your trial ends.
• Messages from organizations: kept while your account exists. If you delete your account, they are no longer linked to you and remain only as anonymous totals.
• Disaster-recovery backups: Encrypted database backups used only for infrastructure recovery are kept for 7 days, with point-in-time recovery over the same period, and are then rotated automatically. They are not a live account and do not restore access to the Service. Files you delete (including when you empty the trash or delete your account) are kept for up to 7 more days in protected storage, only so they can be recovered, and are then permanently removed.
• Security and activity logs: Activity logs (documents you opened, downloaded, shared or deleted, sharing and doctor connections, appointments, AI requests) are kept for up to 24 months and then deleted. Security logs (sign-ins, consents and changes to your account) stay linked to your account while it exists, so we can show you your account history and investigate any incident. When an account is deleted, these records are anonymized (they no longer identify you) and kept only as security statistics.

6.1 Account deactivation and deletion

Deactivation is temporary. You are signed out immediately; your documents and settings remain until you sign in again with the same credentials.

Deletion starts a 30-day grace period. You may keep using MedFiles and cancel the request before the deadline. If you do not cancel, we process your request when the grace period ends: access is deactivated and we delete your personal data from active systems as described above.

You may also request account deletion by emailing support@medfiles.ai from your registered address. We may process that request in approximately 24 to 48 business hours, subject to identity verification.

Export before deletion You can download a copy of your data from Settings → Deactivate or delete account → Export my data (same option in the mobile app under Account), or by emailing support@medfiles.ai. Patient accounts receive a ZIP with JSON metadata and medical document files. Doctor accounts receive a ZIP with account and professional profile data, plus copies of documents the doctor uploaded to their own account (credentials, verification); patients' medical files are not included.

7. Your Privacy Rights

You have the right to:

• Access: Request a copy of all your data
• Rectification: Correct inaccurate data
• Deletion: Delete your account and all associated data
• Portability: Export your data in structured format (JSON and ZIP with documents where applicable)
• Restriction: Limit the processing of your data
• Opposition: Object to certain uses of your data
• Revoke consent: Withdraw consent at any time

To export your data in the web app, go to Settings → Deactivate or delete account → Export my data. You can also email support@medfiles.ai.

To exercise these rights, contact us at support@medfiles.ai

8. International Data Transfers

We use Google Cloud infrastructure to provide the service. Your data, your files and their backups are stored in Google Cloud data centers in the United States. Some of the service providers we use may process data in other countries, under the safeguards described below.

For EU users and other jurisdictions: We ensure that all international data transfers comply with applicable regulations (GDPR, LGPD, etc.) through standard contractual clauses and adequate data protection safeguards.

9. Regulatory Compliance

• GDPR: General Data Protection Regulation (European Union)
• Health data safeguards: We apply HIPAA-aligned technical and organizational measures designed for protecting health information
• Local regulations: We comply with applicable personal data protection laws in your jurisdiction
• LGPD (Brazil): Lei Geral de Proteção de Dados

10. Cookies and Similar Technologies

We use cookies and similar technologies to improve your experience:

10.1 Essential Cookies

Necessary for the site to function (cannot be disabled):

• medfiles_auth_token: Keeps your session active (30 days)

10.2 Functional Cookies

Improve functionality by remembering your preferences:

• medfiles_language: Preferred language
• medfiles_active_profile: Selected active profile
• medfiles_hasSeenOnboarding: If you saw the initial tutorial

10.3 Local Storage and JWT

• Local Storage: User preferences, temporary form state
• JWT Tokens: Secure authentication with 30-day expiration

Manage Cookies: You can manage or delete cookies from your browser settings. If you disable essential cookies, some features will not be available.

11. Children's Privacy

MedFiles.ai requires users to be at least 18 years old. We do not intentionally collect information from children under 18 without parental consent. When you create an account, we may ask you to confirm that you are 18 or older.

Parents can create profiles for their minor children under their own account and have full control over that data.

12. Changes to this Privacy Policy

We may update this Privacy Policy occasionally. We will notify you of significant changes through:

• Email to your registered address
• Notification in the application
• Prominent notice on our website

13. Contact - Privacy and Data Protection

For privacy questions, to exercise your rights, or to report concerns:

• Email: support@medfiles.ai
• Form: Contact

We will respond to all privacy requests within 30 days.