Privacy Policy

This Privacy Policy explains how Quantix Care Management LLC ("Quantix Care Management," "we," "us," or "our"), the operator of Medhexa (the "Service"), collects, uses, discloses, and safeguards information when healthcare agencies, clinicians, office staff, and other authorized users ("you") access or use the Service.

We collect information in the following categories:

• Account information — name, email address, phone number, designation, employer/agency, and credentials you provide when an account is created.
• Patient care data — information entered by your organization into the Service in the course of coordinating patient care, which may include Protected Health Information ("PHI") as defined under HIPAA.
• Usage data — log data, device and browser information, IP address, and in-app activity such as messages sent, documents viewed, and features used.
• Communications — information you submit through contact forms, support requests, or free-trial sign-ups.

• To provide, operate, and maintain the Service, including patient group messaging, alerts, and reporting features.
• To authenticate users, enforce permissions, and maintain audit logs of access to patient data.
• To send account, security, and service-related notifications.
• To respond to support requests and free-trial or sales inquiries.
• To monitor, detect, and prevent fraudulent or unauthorized use of the Service.
• To improve and develop new features, informed by aggregated, de-identified usage patterns.

Where your organization uses Medhexa to create, receive, maintain, or transmit PHI on behalf of a covered entity, Quantix Care Management acts as a business associate and handles that information in accordance with a Business Associate Agreement ("BAA") and the HIPAA Privacy, Security, and Breach Notification Rules. Access to PHI within the Service is restricted to authorized members of a patient's care team, and every access to a patient record is logged for audit purposes.

If your organization requires a signed BAA before using the Service with PHI, contact us at support@medhexa.com.

We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the data we process, including encryption of data in transit and at rest, role-based access controls, two-factor authentication, and audit logging of access to patient records. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

We do not sell personal information or PHI. We may share information with:

• Other members of a patient's care team within your organization, as directed by your organization's use of the Service.
• Service providers (e.g. cloud hosting, messaging, and infrastructure providers) who process data on our behalf under appropriate confidentiality and security obligations.
• Regulators, law enforcement, or other parties where required by law, subpoena, or legal process.
• A successor entity in connection with a merger, acquisition, or sale of assets, subject to this Policy or a materially similar one.

We retain account and patient care data for as long as your organization's account is active and as needed to comply with legal, regulatory, and record-retention obligations applicable to healthcare data. Upon termination of an account, data is retained or deleted in accordance with your organization's agreement with us and applicable law.

Depending on your role and applicable law, you may be able to request access to, correction of, or deletion of certain information associated with your account by contacting your organization's administrator or Quantix Care Management directly. Requests involving PHI are handled in accordance with HIPAA and the policies of the covered entity that controls that data.

The Service uses cookies and similar technologies necessary to keep you signed in, remember preferences, and understand aggregate usage of the marketing site. You can control cookies through your browser settings; disabling them may affect parts of the Service.

The Service is intended for use by healthcare professionals and administrative staff acting on behalf of their organization. It is not directed to children, and we do not knowingly collect personal information directly from children.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and, where appropriate, through additional notice within the Service.

Questions about this Privacy Policy can be sent to support@medhexa.com, by phone at (865) 405-0941, or by mail to Quantix Care Management LLC, 1222 Shooting Park Road, Peru, IL 61354. You can also visit www.quantixcare.com.