Privacy Policy

We collect information you provide directly to us, including:

• Professional credentials: Medical degree, university, specialty, license number, board certifications, and years of experience.
• Profile information: Full name, email address, profile photo, hospital or institution affiliation, and professional bio.
• Content you post: Posts, reels, medical case discussions, research publications, comments, and messages.
• Clinical tool inputs: Text, files, and data you submit to our Notes Assistant and other clinical documentation tools (e.g. note builder, ECG workspace, lab trend analyzer, calculators). These inputs must never contain identifiable patient information.
• Usage data: How you interact with features, posts you view, and engagement patterns.

• To verify your identity as a licensed healthcare professional.
• To provide and improve the MedGram platform and its features.
• To connect you with peers, mentors, and professional opportunities.
• To send notifications about activity relevant to you.
• To ensure safety, prevent fraud, and enforce our community guidelines.
• To comply with legal obligations.

MedGram requires verification of professional credentials to maintain the integrity of our network. Submitted credentials (license numbers, degrees, affiliations) are reviewed by our team solely for the purpose of verification and are stored securely. We do not sell or share your credential data with third parties.

We do not sell your personal information. We may share information in the following circumstances:

• With other users: Your public profile, posts, and professional details are visible to other verified MedGram members.
• Service providers and business associates: Trusted vendors who help us operate the platform (e.g., cloud hosting, analytics, transcription, and language model providers) under strict confidentiality agreements. Where a vendor may access, create, receive, maintain, or transmit protected health information (PHI) on our behalf, we enter into a signed Business Associate Agreement (BAA) as required under HIPAA before any PHI is shared.
• Legal requirements: When required by law, subpoena, or to protect the rights and safety of our users or the public.

MedGram is a professional networking platform, not a healthcare provider. We are not a HIPAA covered entity. Please do not share identifiable patient information on MedGram. All case discussions must be anonymized and de-identified in compliance with applicable healthcare privacy laws.

MedGram's Notes Assistant and related clinical tools help you draft documentation, analyze data, and generate educational content. These tools are provided for professional reference and educational purposes only, do not constitute medical advice, and must not be used with identifiable patient data. Content you submit to these tools may be processed by third-party providers under confidentiality obligations, and you remain solely responsible for verifying the accuracy of any generated output before clinical use.

Our Virtual Hospital, Grand Rounds, and medical case features present fictional or de-identified educational scenarios for training and engagement purposes. These simulations do not reflect real patients and are not a substitute for clinical training, supervision, or institutional credentialing requirements.

Publications, abstracts, and research content you upload are shared with the MedGram community as part of your professional profile. You are responsible for ensuring you hold the necessary rights to share any research content and that it complies with your institution's publication and data-sharing policies.

MedGram is designed to support responsible clinical collaboration while protecting patient privacy. Patient-identifying information must not be entered into features designated for de-identified clinical use. Users are responsible for ensuring clinical content is appropriately de-identified before submission.

Do not include: patient names, medical record numbers, dates of birth, phone numbers, email addresses, physical addresses, government or insurance identification numbers, identifiable patient photographs, or other information that could identify an individual.

MedGram automatically screens submissions to designated clinical tools for common identifiers and will block content that appears to contain patient-identifying information. This screening is a safeguard, not a guarantee, and you remain responsible for de-identifying all clinical content. Read our full HIPAA Compliance & Patient Protection policy and our Notice of Privacy Practices.

MedGram requests access to the following device capabilities only when you use the related feature. We never access these capabilities in the background or without your action.

• Camera: Used to capture photos and short videos when you create posts, reels, or stories for the community feed, and to photograph clinical images (such as ECGs, X-rays, or skin findings) for educational analysis in the Clinical Image Analyzer. The camera is activated only when you choose to capture content.
• Photo Library: Used to select existing photos or images from your device when attaching media to a post, updating your profile photo, or uploading an image to the Clinical Image Analyzer. We do not access, scan, or transmit photos you do not explicitly select.
• Microphone: Medgram requests microphone access only when you choose to activate the Clinical Scribe feature. The microphone is used to capture the clinical conversation for the purpose of generating clinical documentation. Audio is captured only while you are actively recording within Clinical Scribe, and the recording is never started automatically or at app launch. You must explicitly initiate recording each time.
• Notifications: Used to send you alerts about activity relevant to your account, such as replies to your posts, new direct messages, mentions, and content from channels you follow. You can manage or disable notifications at any time in your device settings.

MedGram does not request access to your device contacts, location, Bluetooth, Face ID, or HealthKit data. Invitations to colleagues are sent by email, and Medgram does not access, read, or upload your device's address book or contacts list. If a future update introduces an additional permission, we will update this policy and request your consent before enabling it.

We implement industry-standard security safeguards to protect your information, including:

• Encryption: All data is encrypted in transit using TLS and at rest in our databases and storage systems.
• Access controls: Role-based access controls limit data access to authorized personnel only. Users see only their own data and content they are permitted to view.
• Audit logging: We maintain audit logs of access to and activity within sensitive systems, and we review these logs regularly to detect and respond to unauthorized access.
• Regular security reviews: We conduct periodic security assessments and vulnerability scans to identify and remediate risks.

No method of transmission over the internet is 100% secure, and we encourage users to use strong passwords and protect their account credentials.

We retain your information for as long as your account is active or as needed to provide you services. You may request deletion of your account and associated data at any time by contacting us at contact@medgram.org.

Depending on your location, you may have the right to:

• Access, correct, or delete your personal data.
• Object to or restrict processing of your data.
• Request a portable copy of your data.
• Withdraw consent at any time.

To exercise these rights, contact us at contact@medgram.org.

MedGram is intended solely for healthcare professionals aged 18 and older. We do not knowingly collect information from individuals under 18. If we become aware that a minor has provided personal information, we will promptly delete it.

MedGram operates globally. By using our platform, you consent to the transfer of your information to the United States and other countries where our infrastructure is located. We comply with applicable international data protection laws.

We may update this Privacy Policy from time to time. We will notify you of significant changes via in-app notification or email. Continued use of MedGram after changes constitutes your acceptance of the updated policy.

MedGram is a professional network exclusively for verified healthcare professionals. All users must adhere to the following standards:

• No harassment or hate speech: Bullying, threatening, discriminatory, or abusive language toward any user is strictly prohibited.
• No misinformation: Sharing false, misleading, or unverified medical information that could endanger patients or colleagues is forbidden.
• No inappropriate content: Sexually explicit, graphic, or violent content is not permitted on MedGram under any circumstances.
• No spam or solicitation: Unsolicited commercial messages, pyramid schemes, or fraudulent promotions are prohibited.
• Patient privacy first: Never post identifiable patient information. All clinical case discussions must be fully de-identified.
• Respectful discourse: Professional disagreements must remain respectful. Personal attacks will result in account suspension.
• No impersonation: Impersonating another healthcare professional, institution, or organization is a violation of our terms.
• Consequences: Violations may result in content removal, account suspension, or permanent ban at the sole discretion of MedGram administrators.

If you have any questions or concerns about this Privacy Policy, please contact us:

• Email: contact@medgram.org
• Contact Form: Submit a request