Privacy Policy

Last updated: August 20, 2026

This Privacy Policy describes how MedicalAgentOS, Inc. (“MedicalAgentOS”, “we”, “us”) collects, uses, and protects information in connection with our AI workforce operating system for medical practices (the “Service”).

1. Information we process

We process two categories of information: (a) Account Data — information practices provide to create and administer their workspace, such as names, work emails, roles, and billing details; and (b) Customer Health Data — protected health information (PHI) that practices and their patients submit to the Service, which we process solely as a service provider / business associate on the practice's behalf and under a Business Associate Agreement (BAA).

2. How we use information

To provide, operate, secure, and support the Service.
To orchestrate AI agent workflows the practice has configured and authorized.
To meet legal, audit, and compliance obligations.
To improve non-clinical product functionality using de-identified, aggregated usage data.

We do not sell personal information. We do not use Customer Health Data to train foundation models.

3. AI processing

AI model calls are routed through our AI Gateway with explicit purpose, tracing, and tenant isolation. Model providers are contractually restricted from retaining or training on Customer Health Data. Clinical and high-risk outputs are drafts that require human review by authorized practice staff.

4. Sharing

We share information only with subprocessors listed in our Trust Center (each bound by data protection agreements and, where PHI is involved, BAAs), with the practice that controls the workspace, or as required by law.

5. Security

We maintain administrative, technical, and physical safeguards including encryption in transit and at rest, role-based access control, MFA, audit logging, and tenant isolation enforced server-side. See our Security page for details.

6. Retention and deletion

Customer Health Data is retained per the practice's configured retention policy and applicable law, and is deleted or returned upon termination in accordance with the BAA.

7. Your rights

Patients should direct requests regarding their health records to their practice, which is the data controller / covered entity. Account holders may contact privacy@medicalagentos.com to exercise applicable rights.

8. Contact

MedicalAgentOS, Inc. · Austin, TX, USA · privacy@medicalagentos.com