Who we are and what this policy covers
Medfy provides AI marketing for medical practices: practice websites that we host on the practice’s own domain; the Medfy portal at portal.medfy.ai, with a CRM, inbox, analytics and marketing tools; a free marketing audit; automated SEO; AI-visibility checks; and optional Google Ads management, Meta ads management and a HIPAA AI chat widget. Together, these are the “Services”. “Medfy”, “we” and “us” mean the company that provides them.
We handle information in two roles:
- Information we decide how to use — your Medfy account, billing, the free audit, our emails and this website. We’re responsible for it under this policy.
- Information we process for a practice — patients’ messages, form submissions and appointments, and visits to the practice’s website. We handle it on the practice’s behalf: as its business associate under HIPAA, and as its service provider (processor) under other privacy laws. The practice’s own privacy notice applies, and our use is limited by our agreement with the practice, including the Business Associate Agreement (BAA).
If you’re a patient of a practice that uses Medfy, see Patient information. Our Terms of Service and HIPAA & security page explain the rest of how we work.
Information we collect
Account and practice information
When you create an account or set up a practice, we collect your name, email address and, if you add it, your phone number, plus your role and the practice details you give us or that we take from your current website — such as the practice name, specialty, address, hours, providers, services, logo and website content.
You sign in with a one-time code sent to your email or with Google sign-in; Medfy doesn’t use passwords. With Google sign-in, Google shares your basic profile — name, email address and profile picture — and we keep your name, email address and Google account ID to create and secure your account.
Billing information
Payments are processed by Stripe. Stripe collects your card details directly; we receive your billing contact details, your plan and add-ons, and payment status — never your full card number.
Free marketing audit
When you request a free marketing audit, we collect the website address and your email address, plus any practice details you add: practice name, specialty, city, state or province, and country. We also record how you found us — the referring website, the page you landed on and any campaign (UTM) tags — and keep a one-way hash of your IP address to limit abuse. Cloudflare Turnstile checks that the request comes from a person.
To run the audit, we fetch the practice’s public website and look up public information about it, such as its Google Maps listing, reviews and social profiles. We also ask AI assistants the kind of questions patients ask — “who’s the best family doctor in Austin?” — to see whether they mention the practice.
Patient information processed for practices
Practices use Medfy to receive and manage information from patients through their website forms, the AI chat widget, the CRM and inbox, and appointment booking. This can include names, contact details, appointment details, messages and any health information patients choose to share. We handle it as described in Patient information (PHI).
Connected Google and Meta accounts
If a practice connects Google or Meta accounts, we receive the data described in Google user data and Meta data.
Usage and device information
When you use the portal, our servers record technical information such as IP address, browser type, the pages and features you use, and timestamps, to keep the Services secure and working. Access to patient information is logged. On medfy.ai, Google Analytics collects usage information — see Cookies and similar technologies.
Communications
When you email us or ask for support, we keep your messages and contact details so we can help you.
How we use information
- To provide the Services — build and host practice websites, run SEO and AI-visibility checks, show dashboards and reports, manage ads when an ads add-on is active, and answer patient chats when the chat widget is on.
- To create content with AI — our AI providers draft website content, articles, ad copy and images, analyze marketing data and answer patient chat questions. Practices review AI-generated medical content before it’s published, unless they choose automatic publishing.
- To run the free audit — measure the website, email you a link to the report and keep the report so you can come back to it. Medfy staff may follow up by email about your results.
- To communicate with you — sign-in codes, reports, notifications, receipts and important changes to the Services. We may also send account holders occasional product news, which you can opt out of at any time.
- To bill you and keep the records that tax and accounting law require.
- To keep the Services secure — authentication, rate limits, bot checks, fraud and abuse prevention, and investigating incidents.
- To improve the Services — using aggregated or de-identified information about how features are used. We don’t use patient information or Google user data to train generalized AI models.
- To comply with the law and enforce our Terms of Service.
Patient information (PHI)
Protected health information reaches Medfy only through a practice’s own channels: its website forms, the AI chat widget, the CRM and inbox, and appointments. We treat it differently from everything else:
- Kept apart. It’s stored in separate, encrypted HIPAA databases in the practice’s region — the United States or Canada — not with account, analytics or marketing data.
- Used only for the practice. We process it only to provide the Services to that practice, as our Business Associate Agreement with the practice allows.
- Never for advertising. We never use patient information for advertising, never sell it and never send it to Google, Meta or any other ad platform. Marketing data — website analytics, search and ad performance — is aggregate and contains no patient identities.
- Limited access. Only the practice’s authorized users, and Medfy personnel who need it to support the practice or keep the Services secure, can access it, and that access is logged.
If you’re a patient: the practice you dealt with controls your information. To see, correct or delete it, contact the practice directly. If you contact us instead, we’ll pass your request on to the practice.
More detail is on our HIPAA & security page.
Google user data
Practices can connect Google accounts in the portal, under Settings → Integrations. Connecting is optional, happens on Google’s own consent screen, and Medfy never sees your Google password. We ask only for the access each product needs:
| Google product | Permission (scope) | What Medfy does with it |
|---|---|---|
| Google Search Console | webmasters | Reads your website’s search performance — queries, clicks, impressions and average position — for your dashboard and SEO work, and submits your website’s sitemap so Google finds new pages. |
| Google Analytics | analytics.readonly | Reads website traffic and conversions — sessions, sources and events — for your reports. Read-only: we don’t change your Analytics settings. |
| Google Ads | adwords | Reads campaign performance — clicks, impressions, conversions and spend. With the Google Ads management add-on, makes the changes you approve or allow within your guardrails, such as negative keywords, budget pacing and new ads. |
| Google Business Profile | business.manage | Reads your listing details and performance — calls, direction requests and website clicks. Medfy doesn’t edit your listing. |
| Your Google account | openid email | Identifies which Google account is connected. |
Scopes are shown without their https://www.googleapis.com/auth/ prefix. Signing in to the portal with Google is separate from these connections and uses only your basic profile.
How we use it
Only to provide and improve the features you see in Medfy — dashboards, reports, the weekly brief, recommendations, and the SEO and ads management you’ve turned on. In particular:
- We don’t use Google user data for advertising, including retargeting, personalized or interest-based ads. Managing your own Google Ads campaigns, at your direction, is the feature you connect Google Ads for.
- We don’t sell Google user data.
- We don’t use Google user data to develop, improve or train generalized AI or machine-learning models.
- We transfer it only when needed to provide those features — to the subprocessors that host and run Medfy, including our AI providers, acting on our instructions — to comply with the law, or as part of a merger, acquisition or sale of assets, after notifying you.
- People at Medfy don’t read it unless you ask us to (for example, in a support request), it’s needed for security (such as investigating abuse), it’s required by law, or it has been aggregated and anonymized for internal operations.
Storage, retention and deletion
OAuth tokens are encrypted at rest and used only by our servers; Google user data is stored on Google Cloud. We keep imported performance data while your account is open, so your reports can show trends.
When you disconnect Google, we delete the stored tokens and ask Google to revoke Medfy’s access (unless the same Google account is still connected to another practice on Medfy). Data already imported stays in your reports until you ask us to delete it or close your account. You can also remove Medfy’s access at any time from your Google Account’s third-party connections page. To have Google user data deleted, email privacy@medfy.ai.
Limited Use disclosure. Medfy’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Meta (Facebook and Instagram) data
Practices can connect Facebook and Instagram through Facebook Login. Connecting is optional, and you choose the ad account and Pages Medfy works with. We request:
| Area | Permissions | What Medfy does with it |
|---|---|---|
| Ads | ads_read ads_management business_management | Reads ad performance — impressions, clicks, conversions and spend. With the Meta ads add-on, creates and manages the ads you approve or allow within your guardrails. |
| Facebook Pages | pages_show_list pages_read_engagement read_insights | Lists your Pages and reads their followers, posts and insights for your reports. |
instagram_basic instagram_manage_insights | Reads your Instagram profile and insights for your reports. |
We use Meta data only to provide these features. We don’t sell it or use it to build advertising profiles, and Medfy never sends patient information to Meta. Access tokens are encrypted at rest. When you disconnect, we delete the stored tokens and remove Medfy’s permissions from your Facebook account; you can also remove Medfy in your Facebook settings. To delete data we received from Meta, follow How to delete your data.
How long we keep information
- Account and practice information — for as long as your account is open and we provide the Services. After an account is closed, we delete or de-identify it, except what we must keep to meet legal obligations (such as billing records required by tax law) or because of a legal hold.
- Free audit reports — kept so the person who requested the audit, and the practice once it signs up, can view the report. Ask us and we’ll delete it.
- Patient information — kept, returned or destroyed as set out in the BAA with the practice.
- Connected-account data — as described in Google user data and Meta data.
- Security logs — for as long as needed to protect the Services and investigate incidents.
You can ask us to delete your information at any time — see How to delete your data. We’ll delete it unless we must keep it to meet a legal obligation or because of a legal hold.
How we protect information
- Encryption in transit (TLS) and at rest.
- Patient information in separate, regional HIPAA databases.
- Role-based access for practice users, and audit logs of access to patient information.
- Access tokens for connected Google and Meta accounts encrypted at rest.
- Least-privilege service accounts, so each part of the system reaches only what it needs.
No system is perfectly secure. If an incident affects your information, we’ll notify you — and the practices involved — as the law and our agreements require. To report a security issue, email hello@medfy.ai.
Your rights and choices
Depending on where you live, the law gives you rights over your personal information. You can ask us to:
- Access the personal information we hold about you, and receive a copy in a portable format.
- Correct information that’s inaccurate or incomplete.
- Delete your information.
- Stop marketing emails — reply to one or contact us. Service emails, such as sign-in codes, reports and billing notices, are part of using the Services.
- Withdraw consent where we rely on it — for example, by disconnecting a Google or Meta account.
California residents
Under the California Consumer Privacy Act, as amended by the CPRA, you can ask to know what personal information we collect, use and disclose; to delete or correct it; and to opt out of its sale or sharing. We don’t sell personal information or share it for cross-context behavioral advertising, and we use sensitive personal information only for purposes the law permits. We won’t discriminate against you for exercising your rights. You may use an authorized agent; we may ask the agent for proof of authority and verify your identity.
Canada
Under PIPEDA and applicable provincial privacy laws, you can ask to access and correct your personal information and withdraw your consent, subject to legal and contractual limits. If you’re not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.
Making a request
Email privacy@medfy.ai from the address on your account, or the one you used for an audit. We’ll verify the request and respond within the time the law requires — generally within 30 days. Patients asking about information a practice holds should contact that practice (see Patient information).
How to delete your data
- To end Medfy’s access to connected accounts, disconnect Google or Meta under Settings → Integrations in the portal. You can also remove Medfy from your Google Account or your Facebook settings.
- Email privacy@medfy.ai with “Delete my data” and the email address you use with Medfy. Say whether you want everything deleted or only part of it — for example, an audit report or the data from one connected account.
- We’ll confirm the request, delete the information — except what we must keep by law or under a practice’s BAA — and tell you when it’s done.
Where information is processed
Medfy serves practices in the United States and Canada. Patient information is stored in the practice’s own region. Account information and marketing data are stored on Google Cloud in North America, and some subprocessors — for AI processing, email and payments, for example — process information in the United States. To provide certain features, such as AI chat answers, patient information may be processed by subprocessors outside the practice’s region, under appropriate agreements.
If you’re in Canada: information processed in another country is subject to that country’s laws and may be accessible to its courts and authorities. We protect it with contracts and the security measures described above.
Children’s privacy
The Services are for healthcare practices and their staff, and medfy.ai isn’t directed to children under 16. We don’t knowingly collect personal information directly from children under 16. Patient information that a practice — a pediatric practice, for example — manages through Medfy is handled for that practice under its BAA. If you believe a child has given us personal information, contact us and we’ll delete it.
Changes to this policy
We update this policy as Medfy changes; the date at the top shows the latest version. If we make a material change, we’ll tell account holders by email or in the portal before it takes effect.
Contact us
Questions about this policy or your information: privacy@medfy.ai. Anything else: hello@medfy.ai.