Consumer Health Data Privacy Policy

This is the consumer health data privacy policy of DOC MD, Inc., a Delaware corporation incorporated on October 15, 2026, 7405 Charmant Dr Unit 2001, San Diego, CA 92122. It applies to consumer health data collected through the DOC MD website and the iOS and Android apps from consumers in Washington, Nevada, and Connecticut, and DOC MD uses the same controls for California. It is a separate document from the Privacy Policy.

It is written for Washington’s My Health My Data Act (RCW 19.373), Nevada SB 370 (NRS 603A.400 through 603A.550), and Connecticut’s consumer health data rules (including General Statutes section 42-526). DOC MD does not claim a HIPAA exemption. HIPAA status is not decided, and these controls apply in the meantime.

DOC MD does not sell consumer health data. DOC MD does not geofence.

• Symptoms and the reason for a visit, as you enter them
• An AI triage summary produced from those symptoms
• Clinical notes on your chart
• Prescriptions, including the medication, dose, instructions, and pharmacy if one is entered
• The fact that you sought a visit, the clinician’s name, the specialty, the time, and the status
• Consent records for collection, sharing, and telehealth: version, time, and your account id. Text-message consent is stored the same way and is not health information

Reminder messages use a fixed template. They say that a visit is coming up and tell you to sign in. They do not include symptoms, notes, or a diagnosis. The service does not collect precise location as consumer health data.

• To schedule and hold the visit you request with the clinician named at booking
• To show the chart to you and to that clinician
• To run the symptom check or in-visit assistant when you submit text to it
• To send a reminder you request
• To keep the account secure and to record the consents described here

Consumer health data is not used for advertising, is not sold, and is not used to draw a geofence.

• You
• The independent treating clinician named when you book, when that clinician writes a note or a prescription
• You, when you type a support question or a symptom note. A model summary is produced only after symptom triage is switched on, and then only by Amazon Bedrock in DOC MD's AWS account. It is not sent to xAI.

DOC MD shares consumer health data only with:

• The treating clinician named at booking, after you give the separate sharing consent
• MongoDB, which stores the chart
• Vercel, which runs the application that reads and writes the chart. Vercel Web Analytics does not receive it
• Amazon Chime, which carries live audio and video during a visit. DOC MD does not send Amazon Chime a saved recording
• Amazon Bedrock, only when symptom triage or the support assistant is switched on. Support chat is not sent through the website host

Brevo or SendGrid may receive an email reminder template and your email address. AWS End User Messaging may receive a text reminder template and your phone number, and only after you agree to text messages. Those messages do not include symptoms, notes, medications, or a diagnosis. Live video uses Amazon Chime. DOC MD does not share consumer health data with advertisers, data brokers, or social networks.

Mobile information and SMS opt-in consent are not shared with or sold to third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties except the SMS provider that delivers the messages.

The AWS Business Associate Addendum is in place, effective October 17, 2026, for AWS End User Messaging SMS and Amazon Chime SDK Meetings. Business associate agreements with Vercel and MongoDB are not in place.

DOC MD does not sell consumer health data. There is no sale to opt out of, because no sale occurs.

Collection and sharing are separate consents. At registration both boxes start unchecked. The server stores each granted consent with version 2026-10-16, the time, and your account id. Health information cannot be entered, and a visit that contains it cannot be created, until both consents are on the account. You can grant or withdraw them later in Settings on the website (Account) and in Settings in the app. Withdrawal stops further collection and sharing. It does not by itself delete information already stored. Deletion is a separate request, described below.

Telehealth consent is also separate. It is stored the same way and is required before a video visit starts. The text is on the Telehealth Informed Consent page.

DOC MD does not geofence.

The service does not use location to draw a boundary around a health care facility or any other place, does not use that kind of boundary to message you, identify you, or collect data, and does not ask the device for GPS. The website tells the browser not to grant geolocation.

You can exercise these rights as follows:

• Access. Sign in and open Visits, Records, and Prescriptions. For a copy by email, write to care@docmdapp.com with the subject “Consumer health data request.” We will use the email on the account to confirm it is you.
• Deletion. In the app, open Settings and choose Delete account, then confirm. You can also email care@docmdapp.com with the subject “Delete my consumer health data.” Deleting a patient account removes the account and the visits, notes, prescriptions, and reminders stored for it from the active database, then keeps only a short deletion record with the account id and the time. Details are in the Privacy Policy.
• Withdraw consent. Open Settings on the website or in the app and withdraw collection, sharing, or telehealth consent. The withdrawal time is stored on that consent record. Health information and video visits stay blocked until you grant the required consents again.

An authorized agent may email care@docmdapp.com with proof of authority. We will not discriminate against you for making a request.

DOC MD, Inc.
a Delaware corporation (incorporated October 15, 2026)
7405 Charmant Dr Unit 2001
San Diego, CA 92122
care@docmdapp.com