Privacy Policy

Effective Date: July 31, 2026

Last Updated: September 24, 2026

This Privacy Policy ("Policy") describes how MedSystum ("Company," "we," "us," or "our") collects, uses, discloses, and protects information in connection with MedSystum, our medical claim reconciliation service, including the website located at medsystum.com and any related applications and services (collectively, the "Service"). By accessing or using the Service, you ("User," "you," or "your") consent to the practices described in this Policy.

Note: This is a placeholder policy provided for the initial release of the marketing website and does not constitute legal advice. It will be replaced with final, counsel-reviewed terms before general availability.

Section 1 — Definitions

"Personal Information" means any information that identifies, relates to, describes, or could reasonably be linked to you, including name, email address, IP address, and company details.

"Protected Health Information" ("PHI") means individually identifiable health information contained in the remittance data you submit, as defined under the Health Insurance Portability and Accountability Act ("HIPAA").

"Remittance Data" means the 835/ERA files and related claim, payment, and adjustment records you provide to the Service for analysis.

Section 2 — Information We Collect

2.1 Information You Provide Directly

• Audit request information: name, work email, company name, and the number of providers or clients.
• Remittance Data: 835/ERA files you upload for analysis, or that we retrieve from your clearinghouse's SFTP mailbox at your direction, which may contain PHI.
• Clearinghouse connection details: the SFTP host, username, and credentials (password or private key) you provide to connect a clearinghouse mailbox, which we store encrypted.
• Communications: information you provide when contacting us for support or questions.

2.2 Information Collected Automatically

• Usage data: pages visited, actions performed, and timestamps.
• Device information: browser type, operating system, IP address, and device identifiers.
• Server logs: request URLs, HTTP methods, response codes, and error messages.

Section 3 — HIPAA and Protected Health Information

We act as a Business Associate with respect to PHI contained in your Remittance Data. Before you transmit any PHI to us, we enter into a Business Associate Agreement ("BAA") that governs our permitted uses and disclosures of PHI. We use PHI solely to provide the Service — identifying underpayments and denied claims and producing your Recovery Report — and for no other purpose except as permitted by the BAA and applicable law.

Section 4 — Use of Information

• To provide, operate, maintain, and improve the Service.
• To analyze Remittance Data and generate Recovery Reports.
• To respond to audit requests and other communications.
• To detect, investigate, and prevent security incidents, fraud, and abuse.
• To comply with applicable legal obligations, including HIPAA.

Section 5 — Disclosure of Information

We do not sell, rent, or trade your Personal Information or PHI. We may disclose information to service providers who perform functions on our behalf under written agreements, and when required by law. Any disclosure of PHI is limited to what our BAA and applicable law permit.

Section 6 — Data Security

• Encryption of data in transit (TLS 1.2+) and at rest.
• Access controls limiting PHI to personnel who need it to provide the Service.
• Audit logging of access to Remittance Data.
• Retention and deletion practices consistent with our BAA.

Notwithstanding the foregoing, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security of your information.

Section 7 — Your Rights

Subject to applicable law, you may request access to, correction of, or deletion of your Personal Information. To exercise these rights, contact hello@medsystum.com with the subject line "Privacy Request." We will verify your identity and respond within thirty (30) days.

Section 8 — Do Not Sell or Share My Personal Information

MedSystum does not sell, rent, or share your Personal Information or PHI with third parties for their direct marketing purposes, and does not participate in data brokering activities. See our Do Not Sell or Share notice for details.

Section 9 — Contact Information

MedSystum
Email: hello@medsystum.com
Web: medsystum.com