HIPAA & security at Medfy

01How patient data and marketing data stay apart

Medfy handles two kinds of data, on two separate paths:

• Patient information (PHI) comes only from your practice’s own channels — website forms, the AI chat widget, the CRM and inbox, and appointments. It’s stored in separate, encrypted HIPAA databases in your practice’s region.
• Marketing data — website analytics, search performance, AI-visibility checks and ad results — is aggregate: counts of visits, clicks, calls and conversions. It contains no patient identities, so it can power your dashboard and ad optimization without touching PHI.

Patient data is always written to and read from your practice’s regional database. Account data — sign-ins, billing and settings — is kept in a separate database that holds no PHI.

02Business Associate Agreement

Medfy signs a Business Associate Agreement (BAA) with every practice. It sets out how we may use and disclose PHI — only to provide the Services to your practice — the safeguards we maintain, how we report incidents, and what happens to PHI if you leave. Where our Terms of Service and the BAA differ about PHI, the BAA controls.

To request a copy of our BAA, email hello@medfy.ai.

03Where your data is stored

Each practice is assigned a data region when it’s set up: the United States or Canada. Its patient information is stored in that region on Google Cloud, so a Canadian practice’s patient records are stored in Canada. To provide some features — AI chat answers, for example — patient messages are processed by our AI provider under appropriate agreements, which may be outside your region.

04Encryption

• TLS on every connection to Medfy — the portal, practice websites, forms and the chat widget.
• Encryption at rest for databases and file storage.
• Tokens for connected Google and Meta accounts are encrypted again by Medfy before they’re stored.

05Access controls and audit logs

• Role-based access: every team member has a role, and owners can invite or remove staff at any time.
• Access to patient records is written to an audit log.
• Medfy staff access patient information only when it’s needed to support your practice or keep the Services secure.
• Least-privilege service accounts: each part of the system can reach only the data it needs.
• Sign-in uses one-time email codes or Google sign-in, so there are no passwords to reuse or leak, and portal sessions expire after an hour without activity.

06The HIPAA AI chat widget

The optional chat widget ($49/month) answers patients on your website around the clock and captures new-patient requests into your CRM.

• It answers only from your practice’s own information — services, hours, locations, insurance — and is instructed never to give medical advice, diagnoses or dosing.
• It tells patients with an emergency to call 911 or go to the nearest emergency room, and it hands conversations to your team when needed.
• Conversations are stored with your other patient information in your regional HIPAA database and are covered by your BAA.
• Replies are generated by our AI provider under appropriate agreements. Chat conversations are never used for advertising.

07Advertising without patient data

Healthcare advertising has strict rules, and Medfy is built around them:

• Google, Meta and other ad platforms never receive patient information from Medfy.
• We don’t build remarketing audiences or target ads based on health information.
• Ads are optimized on aggregate results — clicks, calls, form submissions and spend — never on who a patient is.
• Ad copy is checked against Google’s and Meta’s healthcare advertising policies before we suggest it.

08Website analytics without third-party trackers

Practice websites hosted by Medfy are measured with Medfy’s own first-party analytics. It uses no cookies and no third-party trackers. IP addresses aren’t stored — a salted hash that rotates daily is used only for rate limiting — and when a visitor has Do Not Track or Global Privacy Control turned on, no visitor ID is created. Form fields are never read beyond whether a phone or email field was filled in.

If you add your own tags to your website — a Meta Pixel or Google Analytics, for example — keep them off pages where patients share health information, such as contact and booking pages. The free audit flags this risk.

09Subprocessors

These companies process data for Medfy. Subprocessors that handle patient information do so under appropriate agreements, including business associate agreements where HIPAA requires them.

The Privacy Policy explains how we handle personal information in general.

10What your practice is responsible for

• Use the HIPAA-covered features — forms, the chat widget, the CRM and inbox, appointments — for patient information, and keep it out of ad copy, content requests and ordinary email.
• Give each staff member the access their role needs, and remove it when they leave.
• Keep the email and Google accounts you sign in with secure.
• Run your own HIPAA program: your notice of privacy practices, policies and staff training.

11Request a BAA or report a security issue

To request our BAA, ask a security question or report a vulnerability, email hello@medfy.ai. When you report a vulnerability, include the steps to reproduce it, don’t access or change data that isn’t yours, and give us reasonable time to fix it before you disclose it. We’ll acknowledge every report.