Privacy Policy

Introduction

Medically ("the Service") is a revenue-integrity platform for hospitals and health systems, developed and operated by SoftwareLogicsUSA Corporation ("Medically," "we," "us," or "our"). It reads clinical records and surfaces documentation, coding, denial, and appeal recommendations for review by our customers' qualified staff. We are committed to protecting the privacy, confidentiality, integrity, and security of the personal and health information entrusted to us.

This Privacy Policy covers four groups of people: visitors to medically.us; prospects, contacts, and job applicants who share information with us; Authorized Users of the Medically platform at our customers; and patients whose Protected Health Information ("PHI") our customers make available to the platform. It explains what we collect, how we use and share it, how long we keep it, and the choices you have, in compliance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), including the Privacy Rule, Security Rule, and Breach Notification Rule, and other applicable law.

Our roles. For website, marketing, careers, and platform account data, Medically decides how and why the data is processed. For PHI, Medically is a business associate: the hospital or health system (the "covered entity") controls the data and decides why it is processed, and we process it only under a Business Associate Agreement ("BAA") and the customer's instructions. Patients should direct questions about their health information to their healthcare provider.

1. Information we collect

We collect the following categories of information:

• Website and marketing information: when you request a demo, use the contact form, ask for a Business Associate Agreement, subscribe to updates, or use the Lost Revenue Calculator, we collect what you give us — typically your name, work email, organization, role, and message — along with the page and campaign the request came from.
• Careers information: if you apply for a role, we collect your name, contact details, résumé or CV, and anything else you include in your application.
• Platform account information: for Authorized Users, the name, work email, role, organization, and permissions your organization provisions, plus authentication and activity logs required for security and HIPAA audit controls.
• Customer Data, including PHI: clinical records and related data (such as notes, laboratory and imaging results, medications, orders, vitals, codes, claims, remittances, and denial letters) that a customer's EHR and other systems make available to the platform under a BAA, and the findings, scores, queries, dispositions, appeals, and audit records the platform generates from that data.
• Device and technical information: device type, operating system, browser version, IP address, performance logs, and similar technical data used to provide a secure and functional service. The website analytics in Section 9 are a narrower, separately described exception: they do not store your IP address.

2. How we use your information

We use information for the following purposes:

• To provide, operate, secure, support, and maintain the Service, including generating AI recommendations for our customers' review and maintaining the audit ledger customers rely on.
• To respond to demo, contact, BAA, and pricing requests and to communicate with prospects and customers about the Service.
• To evaluate job applications.
• To authenticate users, detect and prevent abuse, and meet HIPAA audit and security requirements.
• To measure and improve the Service, using aggregated, de-identified statistics (for example, precision and acceptance rates by finding type). We do not use PHI or other Customer Data to train machine-learning models, and reviewer decisions are not used as training data. Third-party AI providers we use operate under enterprise agreements that prohibit training on Customer Data.
• To send administrative notices such as security alerts, changes to terms, and service updates.
• To comply with legal and regulatory obligations, including HIPAA.

3. How we share your information

We do not sell personal information or PHI, and we do not share it with advertising networks or data brokers. We share information only as needed to operate the Service or as the law requires:

• Your organization: for Authorized Users, the customer that provisioned your account can see your activity in the platform, including the dispositions and reason codes you record.
• Subprocessors: vendors that help us run the Service — cloud hosting and storage, AI model providers operating under enterprise agreements, email delivery, and, where a customer enables electronic appeal submission, the customer's clearinghouse. Any subprocessor that handles PHI is bound by a BAA and by HIPAA. A current subprocessor list is available to customers on request.
• Our own systems: website analytics and customer-relationship records are kept in our own platform on Amazon Web Services in the United States, as described in Section 9.
• Business transfers: if Medically is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy and to any BAA.
• Legal compliance: where required to comply with law, a valid legal process, or a government request, or to protect the rights, safety, or property of Medically, our customers, patients, or the public.

4. Protected Health Information and our Business Associate obligations

As a HIPAA business associate, Medically enters into a BAA with each covered entity before any PHI is made available to the platform. Under the BAA and HIPAA we:

• Use and disclose PHI only to provide the Service to that customer, for our proper management and administration, and as the BAA and law permit — never for marketing, sale, or secondary use.
• Apply the minimum-necessary standard: the platform connects to the customer's EHR on a read-only basis, accesses only the data the task requires, and minimizes or masks direct identifiers before AI analysis wherever the task allows.
• Keep each customer's data logically isolated from every other customer's data.
• Do not retain PHI in the AI layer beyond the request that needed it, and never use PHI to train AI models.
• Maintain the administrative, physical, and technical safeguards the HIPAA Security Rule requires, and report security incidents and breaches of unsecured PHI to the customer within the timelines the BAA and the Breach Notification Rule require.
• Make PHI available to the customer so it can honor patients' rights of access, amendment, and accounting of disclosures, and return or destroy PHI at the end of the engagement as the BAA specifies.

5. Your rights regarding your information

Depending on who you are and where you live, you may have the following rights, which we honor to the extent applicable law provides:

• Access: request a copy of the personal information we hold about you.
• Correction: request that inaccurate or incomplete information be updated.
• Deletion: request deletion of your personal information, subject to legal and contractual retention requirements.
• Restriction and objection: request limits on how we process your information, including opting out of marketing email at any time using the link in any message or by writing to us.
• Data portability: request your information in a structured, machine-readable format.
• Non-discrimination: we will not treat you differently for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of on that front.

Patients: rights over PHI under HIPAA — access, amendment, and an accounting of disclosures — are exercised through your healthcare provider, the covered entity. If a request reaches us directly, we will forward it to the appropriate customer as the BAA requires. Authorized Users: some requests about platform account data must be routed through your organization, which controls your account.

To exercise any right, contact us using the details in the Contact section. We may need to verify your identity before acting on a request.

6. Data retention

We retain information only as long as needed for the purposes described in this policy and to meet legal, regulatory, and contractual requirements. Website and marketing records are kept while we have an active relationship or a legitimate reason to keep them. Careers information is retained for the recruiting cycle and for a reasonable period afterward unless you ask us to delete it sooner. Customer Data, including PHI and the audit ledger, is retained for the term of the customer agreement and returned or securely deleted afterward as the agreement and BAA specify, subject to any retention the law requires. When data is no longer needed, it is securely deleted or de-identified in line with HIPAA and industry standards. Section 9 describes retention for website analytics, which differs.

7. Data security

We implement administrative, technical, and physical safeguards to protect your information, including encryption in transit (TLS 1.2/1.3) and at rest (AES-256), role-based and least-privilege access, multi-factor authentication, comprehensive audit logging of access to PHI, secure U.S.-resident storage on hardened cloud infrastructure, and regular monitoring. Our security program is modeled on the HIPAA Security Rule and the SOC 2 Trust Services Criteria; a SOC 2 Type II audit is on our roadmap. Details are on our Security page. No system is perfectly secure; if we become aware of a breach affecting your information, we will notify you and the relevant authorities as the law requires.

8. Use of cookies and tracking technologies

Medically uses cookies and similar technologies to maintain session security, store preferences, and improve platform functionality. You may control these settings through your browser. Section 9 describes what this website itself stores and measures, which is browser storage rather than cookies.

9. Website Analytics and Session Recording

We measure how people use this website with our own software, on our own systems: which pages you open, how long you read, how far you scroll and how fast the page loaded. We also record the page as you see it — mouse, clicks and scrolling, played back like a video. That recording is anonymous: it is kept under its own random identifier with no name, no email and no link back to you, and it never captures what you type. Separately, if you arrived from a link in one of our emails, the measurements above are stored with your email address — but the recording is not.

Why we do this: to see which pages people find useful and how quickly the site loads, and — when a visit came from one of our emails — to note against that person's record in our own customer database that they read the site, so our team knows whether to follow up.

What we measure on every visit.

• Which pages you open on medically.us, and each page's title.
• The date and time each visit and each page view started and ended.
• How many seconds each page was actually visible on your screen, and the total for the visit.
• How far down each page you scrolled.
• Four page-load timings: time to first byte, first paint, largest paint and total load time.
• Your browser's user-agent line, stored exactly as your browser sends it, plus the device type, operating system and browser name we work out from it.
• The address of the page that linked you to us, including anything after the "?" in it.
• Which of our email campaigns brought you, when the visit began with a link in one of them.
• Our own judgement of whether the visit looks like an automated scanner rather than a person, worked out from how long it lasted, how many pages it touched and what your browser called itself. Visits we judge automated are kept, but left out of our reports.
• Four items in your browser's own storage, which are not cookies: a random identifier for this browser, kept until you clear this site's data; a random identifier for this tab, gone when you close it; a separate random identifier used only for the anonymous recording; and, if you arrived from one of our emails, the encrypted code from that link, kept for the rest of that tab.

The browser identifier is stored on every visit, including visits that carry no name. Once one visit from that browser carries your email address, the others can be connected to it. It does not expire on its own.

Your browser also sends its time zone and window size with these measurements. We throw both away — neither is stored. The recording itself does carry your window size, because it has to replay the page at the size you saw it; see below.

Outside of session recording, nothing else is collected: no clicks, no keystrokes, no mouse positions, no form contents.

Your IP address. Section 1 of this policy lists IP address among the technical data the Medically service collects. The website analytics described here are different: we do not store it. There is no field for it in the analytics database, and the code that stores the measurements never looks at it.

The only thing that touches it is a flood guard sitting in front of that code, which counts requests per address in memory for one minute at a time and then forgets them.

We do not work out where you are. No country, region or city is derived or stored.

Like any website, our web servers and content network see your IP address in order to send you the page, and may keep it in their own access logs. That is part of serving the site, not part of the analytics described here.

If you came from an email we sent you. Links to medically.us in our emails carry a short code. Your email address is encrypted inside that code with AES-256-GCM and only our own server holds the key, so the address itself is never in the web address, in your browser history or in a bookmark.

Our own script removes the code from the address bar as the page loads. It runs after the page's other scripts have already started, so those scripts can see that a code was present in the address, though they cannot read what is inside it. The code stops working 30 days after the email was sent; a click after that is not linked to you.

The code is also kept in your browser's storage for the rest of that tab and sent with each measurement, so pages you open later in the same tab are attached to your email address too.

While the code is valid we store your email address with the visit, and which campaign the link came from. If you forward one of our emails, whoever opens the link is recorded under the original recipient's address, not their own.

The click that brought you here is also an email-tracking event, which is separate from the site analytics above. Our email system records the IP address the click came from, your browser's user-agent line, which link you clicked and when. Opening one of our emails is recorded the same way, whether or not you click. If you are in one of our email campaigns, that event is added to the record of our correspondence with you, which the software that drafts our follow-up emails reads before writing to you again.

Session recording. We do not ask you first, and you should know that plainly. What we do instead is make the recording unable to identify you: it is stored under a random identifier created for that purpose alone, carrying neither the code from our email link nor the identifier we use for the measurements — so the two cannot be matched up, by us or by anyone with access to our database. Nobody at our company can open a recording and see whose it is.

A replay shows the page as it appeared on your screen — layout, text, images and every change to the page — along with your mouse movement, your clicks, your scrolling, your window size and each page you moved to, played back at your original pace. Every value you type into a field is replaced with dots before it leaves your browser, so the replay never contains what you wrote, and any part of a page we have marked sensitive is not captured at all.

A replay cannot show:

• What you type. Values in text boxes, text areas and dropdown menus are replaced with a row of asterisks in your browser, before anything is sent. We receive the asterisks, and therefore how many characters there were, but never the characters themselves.
• Anything drawn on a canvas element.
• The fonts your browser loaded.

A replay does show any text the site itself puts on the screen. If the page prints something back to you — for example the file name of a CV you attach on the careers page — that text is part of the page and appears in the replay, even though you typed none of it.

Recording is available on every page of medically.us, including the contact form, the careers application and this policy page. This section describes the medically.us website only; the rest of this policy covers the Medically service.

How to stop it. Turn on Do Not Track in your browser and no recording starts at all — see below. Clearing this site's data erases the random identifiers, so earlier visits can never be connected to later ones. Because a recording carries nothing that identifies you, we cannot find "your" recordings to delete them on request; if you want one removed, write to legal@medically.us with the day and rough time of your visit and we will do our best to locate it.

Do Not Track. If your browser sends a Do Not Track signal, session recording never starts and the recording software is never even downloaded to your browser. The measurements listed above still run: Do Not Track does not stop those, we do not currently offer a way to switch them off, and this site does not recognise Global Privacy Control signals.

How long we keep it:

• Everything measured above — pages, times, reading time, scroll depth, referring address, user-agent line, the identifiers, and your email address when the visit came from one of our emails — is kept indefinitely. Nothing expires it and nothing deletes it on a schedule.
• Session recordings are deleted automatically 90 days after they are made.
• A short index entry recording that a replay of your visit existed — which visit, when it started and ended, how many events it held and how large it was — is kept indefinitely, and outlives the recording itself.
• Email open and click records, including the IP address of a click, are kept indefinitely too.
• Section 6 of this policy describes our general retention practice. Apart from the 90-day limit on recordings, the data in this section is an exception to it and has no automatic deletion schedule.

Who has it, and where it lives. Measurements are sent from your browser to customerly.us — our own platform, not another company's analytics service — and stored there in our own database and our own file storage on Amazon Web Services in the United States. Despite the different address in your network tab, it is us.

Anyone signed in to our workspace can play back a recording, though none of them can tell whose it is. It is not limited to a smaller group of administrators, and our software does not record which team member watched; the audit logging described in section 7 does not currently extend to that. A recording plays through a temporary link to our storage, which works for 15 minutes and would work for anyone it was passed to in that time.

We do not sell or trade any of it, and we do not pass it to an advertising network or a data broker.

Google Analytics also loads on every page of this site. What it collects is governed by Google's privacy policy, not this one. Section 8 tells you that you can control cookies through your browser; note that what we store is browser storage rather than cookies, so cookie controls do not remove it — clearing this site's data does.

Deleting your data. Write to legal@medically.us and ask us to delete your website analytics data, and we will do it within 30 days. If you reached us from one of our emails, tell us the address we wrote to and we can find every visit linked to it. If you never came from one of our emails, your visits carry no name or address at all: the only handle is the random identifier your browser stores for this site as "cz_anon", which you can read from your browser's stored site data and send to us. Without it we cannot tell your visits from anyone else's. We may ask you to confirm that an email address is yours before deleting.

Asking us to stop emailing you stops the emails; it does not delete visits already linked to your address. Ask for deletion separately if you want both.

The rights in section 5 — access, correction, deletion, restriction and portability — apply to everything in this section. Use the same contact address.

If we ever change this so that a recording can be traced back to a named person, we will say so prominently and ask first, rather than rely on the notice in section 11.

10. Third-party websites

Our website and platform may contain links to third-party websites not operated by Medically. This Privacy Policy does not apply to those websites. We recommend reviewing each third-party site's privacy policy.

11. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect operational changes, regulatory updates, or improvements to the Service. We will post the revised policy here with a new "Last updated" date and, for material changes, give notice through the platform or by email where we have an address for you. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy. Changes to this policy do not override a signed Business Associate Agreement.

Contact information

If you have any questions, concerns, or requests related to this Privacy Policy or your personal information, or if you wish to exercise any of the rights described above, please contact us at:

• Email: legal@medically.us
• Mail: SoftwareLogicsUSA Corporation, Attn: Privacy, Katy, Texas, United States

Business Associate Agreement requests can be made through our contact form.

About Medically

Medically is a HIPAA-compliant revenue-integrity platform for hospitals and health systems. It reads the whole clinical record, surfaces documentation and coding findings in both directions with cited evidence and a defensibility score, drafts compliant physician queries and appeals, checks claims against payer rules before submission, and reports realized revenue — with a qualified person approving every change that touches a patient's record or a claim.