Privacy Policy & Data Architecture

1. How Client-Side De-Identification Works

When a clinical chart note is pasted or loaded into MedFill:

1. In-Browser Tokenization: A local JavaScript engine running directly on your computer scans for the 18 HIPAA Safe Harbor identifiers (patient names, dates of birth, policy IDs, phone numbers, and addresses).
2. Local RAM Substitution: The identifiers are mapped to anonymous tokens (e.g. {{PATIENT_NAME_1}}) in your browser's volatile RAM.
3. De-Identified Transmission: Only the de-identified clinical narrative and tokens are sent to our language processing engine. Under 45 CFR § 164.514, de-identified data is not Protected Health Information.
4. In-Memory Re-Hydration: Once the structured clinical draft is returned, your browser replaces the tokens with the true patient identity in local memory.
5. Client-Side PDF Generation: Document PDFs are rendered and stamped locally on your computer using your CPU. The completed, signed document is never sent to our servers.

2. Information We Collect

We collect only the minimum necessary data to maintain clinician accounts and process subscription billing:

• Clinician Account Data: Name, provider title (e.g. MD, DO, NP), NPI number, clinic contact address, and billing email.
• Usage Metrics: Monthly encounter count for subscription tier metering.
• Audit Provenance: SHA-256 cryptographic hashes of generated documents (containing zero patient text) to record completion timestamps.

3. Third-Party Sub-Processors

4. Local Storage on Your Device

MedFill utilizes your browser's local storage (localStorage) to persist:

• Your encrypted clinician signature stamp image.
• Your workflow preferences and interface state.
• Your completed feedback dismissals.

This data resides exclusively on your workstation and can be cleared at any time by clearing your browser cache.