We do not sell your health information. We share it only with the Providers, pharmacies, laboratories, payers and benefit providers involved in your care or your plan, and with the vendors we need to deliver the service - never for advertising. We do not use your health information to train AI models - ours or anyone else's. The only exceptions are disclosures that the law requires or permits without your authorization, described in the Notice of HIPAA Privacy Practices below.
Each vendor we use is bound by a written contract that requires it to act only on our instructions, keep your information confidential and secure, use it only to perform the service, and not sell or share it. Our AI vendors are bound by contracts that require zero retention of your information and prohibit using it to train any model. Vendors that handle protected health information also sign a Business Associate Agreement.
The Company uses third party providers to manage the data security for this site. All data is stored in encrypted format that meets standards defined by HIPAA (Health Insurance Portability and Accountability Act). All data transfer is executed using similar standards that meet or exceed HIPAA, and no data is transferred to users that do not have specific data access keys.
We take every reasonable precaution to protect your personal information including encryption and passwords.
Cookies are data stored on the user's hard drive containing information about the user's browsing history. Usage of a cookie is not linked to any personally identifiable information while visiting the Company's site.
Where your plan includes it, we offer an AI assistant ("the assistant") that can answer questions and help you use your benefits and our services - for example, explaining your plan, helping you find and schedule a visit, helping you set your preferred pharmacy, and guiding you through forms. We also use AI to translate certain engagement messages.
We retain medical records and related information - including your electronic medical record and AI chat conversations that contain health information - for a MINIMUM of seven (7) to ten (10) years, in accordance with federal and state healthcare record-retention requirements, and longer where the law requires (for example, records of minors and records tied to government health programs). We currently retain this information indefinitely unless you ask us to delete it and the law permits deletion.
The periods below are minimums - the least time we commit to keep each kind of record. They are not deadlines by which a record must be deleted.
| Category | Minimum retention |
|---|---|
| Medical records (electronic medical record, visit notes, orders, prescriptions) and AI chat conversations that contain health information | At least 10 years after the last date of service. For minors, the longer of 10 years after the last service or 7 years after the patient reaches the age of majority. |
| Recordings and transcripts of consultations and AI voice calls | At least 7 years |
| Billing, payment and claims records | At least 7 years after the transaction |
| HIPAA compliance records (authorizations, patient requests, accountings of disclosures, notices, policies) | At least 6 years from creation or from the date last in effect |
| Security and access audit logs | At least 6 years |
| Account and enrollment records | Life of the account plus at least 7 years |
| Support interactions (calls, tickets and non-clinical chats) | At least 3 years |
| AI chat conversations that contain no health information | At least 2 years |
| Marketing preferences and communication consents | At least 5 years after the consent ends |
| Website and app usage data that contains no health information | At least 13 months |
| Backups | Overwritten in the ordinary backup cycle after a record is deleted |
After the minimum period, we keep a record only for as long as it is reasonably necessary for one of these purposes: a legal, regulatory or contractual requirement; an actual or anticipated claim, audit, investigation or legal hold; continuity of care and patient safety; fraud prevention and security; or because the record cannot yet be deleted from backups or archives. Our Privacy Officer reviews each category at least once a year, and we delete or de-identify records that no longer serve one of those purposes.
You may ask us to delete information. We will delete what we are permitted to delete. Where the law requires us to keep a record, we will keep it for the required period only, limit its use to the purposes the law allows, and delete it when the requirement ends. Because HIPAA treats the medical record as a record we must maintain, a right to delete does not extend to records we are legally required to keep; you do, however, have the right to see, copy and correct them (see the Notice of HIPAA Privacy Practices).
Because we do not sell or share personal information, there is nothing for a Global Privacy Control (GPC) or Do Not Track (DNT) signal to opt out of, and we do not change how our site works in response to either signal.
You may submit a request to access, correct, delete, or limit the use of your personal information, or to exercise any other privacy right described in this Policy, online at https://www.accessadoctor.com, by calling 888-777-9528, or by writing to the Privacy Officer at 610 Elm St, Suite 800, McKinney, TX 75069.
Verifying your identity. Before we process an access, correction or deletion request, we will verify your identity using the email address and date of birth on your account.
When we respond. We respond within 45 days of receiving your request. If we need more time, we may extend that period by up to 45 additional days (90 days in total) and will tell you why before the first 45 days end. Requests about your medical records under HIPAA (access, amendment, accounting of disclosures) follow the timelines in the Notice of HIPAA Privacy Practices.
If we deny all or part of a privacy request, we will tell you why. If you live in Colorado, Connecticut, Virginia, Texas or another state that gives you a right to appeal, you may appeal the decision by contacting the Privacy Officer by any method above and including the word "Appeal." We will respond to your appeal in writing within the time your state's law allows (45 to 60 days, depending on the state) and explain the outcome. If we deny your appeal, you may submit a complaint to your state attorney general.
By using The Company's services, you signify your acceptance of this Privacy Policy, as stated. If you do not agree to this Policy, you should not continue to use our service. Should we make any changes to the Privacy Policy, we will post these changes prominently so users are always aware of what information we collect, how we use it, and under what circumstances, if any, we may disclose it. We recommend that you read this Privacy Policy each time you use The Company's website in case you missed our notice of changes to the Privacy Policy. Your continued use of the services and site following the posting of changes to these terms will mean you accept those changes.
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED, AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY AND REPORT ANY ISSUES, OR CONCERNS, TO THE COMPANY AT 610 Elm St, Ste 800, McKinney, TX 75069 with a copy to Provider, 610 Elm St, Suite 800, McKinney, TX 75069
Effective Date: October 15, 2026
The Health Insurance Portability & Accountability Act of 1996 (HIPAA) is a federal program requiring that all medical records and other individually identifiable health information used, or disclosed, by us in any form, whether electronically, on paper, or orally, are kept properly confidential. This Act gives you, the Patient, significant new rights to understand and control how your health information is used. HIPAA provides penalties for covered entities that misuse personal health information.
We have prepared this "Notice of HIPAA Privacy Practices" to explain how we as a Business Associate of the telemedicine provider are required to maintain the privacy of your health information and how we may use and disclose your health information.
We may use and disclose your medical records for each of the following purposes: treatment, payment, and health care operations. In every case we use, disclose and request only the minimum PHI necessary to accomplish the purpose (45 CFR 164.502(b)), except for treatment and where you or the law direct otherwise:
TREATMENT means providing, coordinating, or managing health care and related services by one or more health care providers.
PAYMENT means such activities as obtaining payment or reimbursement for services, billing or collection activities and utilization review. HEALTH CARE OPERATIONS include managing your Electronic Medical Record to facilitate diagnostic medical consultations with associated Providers, as well as conducting quality assessment review and service improvement planning activities, auditing functions, cost-containment analysis, and customer service. Health care operations do not include, and we do not permit, the use of your PHI (identifiable or de-identified) to train, fine-tune or improve artificial-intelligence or machine-learning models.
We may also create information from which all identifiers have been removed under 45 CFR 164.514(b). We do not distribute de-identified information to third parties to train AI models and do not use it to do so ourselves.
We may contact you to provide information about our services or other health-related services that may be of interest to you.
Any other uses and disclosures will be made only with your written authorization. You may revoke such authorization in writing and we are required to honor and abide by that written request, except to the extent that we have already taken actions relying on your authorization. We will obtain your written authorization before using or disclosing psychotherapy notes (except as HIPAA permits) or using or disclosing PHI for marketing, and we do not sell PHI. Nothing in any authorization or consent form you sign authorizes the sale of PHI or its use to train AI models.
AI tools may be used for treatment, payment and health care operations only, on the same basis as any other system that handles PHI, with the minimum necessary information, under access controls and audit logging. Decisions about your care are made by licensed Providers.
You have the following rights with respect to your protected health information, which you can exercise by presenting a written request to the Company:
If you believe your privacy rights have been violated, you may file a complaint with the Company or with the U.S. Department of Health and Human Services, Office for Civil Rights, online at www.hhs.gov/hipaa/filing-a-complaint, by phone at 1-877-696-6775, or by mail at 200 Independence Avenue S.W., Washington, D.C. 20201. We will not retaliate against you for filing a complaint.
Click here to view the Privacy Notice for California Residents
Click here to view the California Medical Board Notice to Patients
Our Responsible AI & HIPAA Privacy Notice explains what our AI assistant is and is not, what information it can use, our promises not to sell, share or train on your health information, how long chats are kept, and how to reach a person.
Click here to view the Responsible AI & HIPAA Privacy Notice