1. Overview
MedFlow AI, Inc. operates as a data processor on behalf of hospital customers (the data controller). We process Protected Health Information (PHI) strictly to deliver the services described in our Master Services Agreement and BAA.
Legal · Privacy
Privacy Policy
Last updated June 25, 2026. Plain-English commitments for how MedFlow AI handles personal and health data.
HIPAA · GDPR · ISO 27001 aligned
Independently audited annually. SOC 2 Type II report available under NDA.
2. What we collect
Account data (name, work email, role), telemetry needed to keep the service reliable, and the clinical and operational data your hospital chooses to store in MedFlow AI.
3. How we use it
We use customer data only to provide, secure, and support the service. We never sell customer data. We do not use PHI to train general-purpose models.
4. Data residency
Hospitals choose a primary region (EU, US, India, UAE, Singapore, or Australia). All PHI is stored and processed within the chosen region; cross-region replication is opt-in.
5. Retention
Customer data is retained for the life of the contract plus a 30-day grace period. After grace, data is securely destroyed and a destruction certificate is issued.
6. Subject rights
Hospitals act as the controller for patient subject rights (access, rectification, erasure, portability). We assist customers in fulfilling such requests within statutory timelines.
7. Contact
Privacy questions: privacy@medflow.ai. EU representative and DPO contact details are available on request.
Onboard in under 4 weeks
Ready to modernize your hospital operations?
Schedule a 30-minute walkthrough tailored to your specialty mix, bed count, and billing model.
No card required
Live data sandbox