Privacy Policy

This policy covers the DOC MD website and the DOC MD apps for iOS and Android (together, the “service”). The operator is DOC MD, Inc., a Delaware corporation incorporated on October 15, 2026. The mailing address is 7405 Charmant Dr Unit 2001, San Diego, CA 92122. The service is offered in California, Washington, Nevada, Connecticut.

This policy is effective October 19, 2026. It is written to meet the California Online Privacy Protection Act (Business and Professions Code section 22575) and to describe how medical information is handled under the Confidentiality of Medical Information Act (Civil Code sections 56.06, 56.10, 56.101, and 56.36). Consumer health data for Washington, Nevada, and Connecticut is described in the separate Consumer Health Data Privacy Policy.

Questions: care@docmdapp.com.

The service collects these categories:

• Name, email address, and phone number if you add one
• A password, stored only as a hash
• Role (patient, clinician, or administrator) and, for a clinician, approval status, specialty, and credentials
• Consent records: the kind of consent, the version, the time, and your account id
• Health information you or your clinician enter: reason for a visit, symptoms, an AI triage summary, clinical notes, prescriptions, and reminder text generated from a fixed template
• Visit metadata: the people on the visit, specialty, time, status, and a join code
• A sign-in session id, and on mobile a bearer token

The service does not ask for a precise location, does not read GPS, and does not use advertising cookies. It does not use HealthKit or Health Connect.

DOC MD maintains medical information so a person can manage a condition and take part in a visit. Under Civil Code section 56.06(b), that can make DOC MD a provider of health care for the Confidentiality of Medical Information Act even when HIPAA does not apply. Medical information is kept confidential and is disclosed only as this policy describes.

Medical information is disclosed only for these purposes:

• To the independent treating clinician named when the visit is booked, after you consent to that sharing
• To MongoDB, which stores the account and chart
• To Vercel, which runs the website and API that read and write that chart
• To Amazon Chime, which carries live audio and video for a visit and does not receive a recording from DOC MD
• To Amazon Bedrock in DOC MD's AWS account, only when symptom triage or the support assistant is switched on. Until then, symptom text and support chat are not sent to an outside model. They are not sent to xAI.
• To Brevo or SendGrid, for an email you request, such as a reminder or an account message. Those messages use a fixed template. They do not include symptoms, notes, medications, or a diagnosis
• To AWS End User Messaging, only after you agree to text messages, for an appointment reminder, a visit notification, or an account security code. Those messages use a fixed template. They do not include symptoms, notes, medications, or a diagnosis. The sending number is +1 877-550-7420

Medical information is not disclosed for advertising. It is not sent to analytics. Server logs record an operation name and, at most, an error name or an HTTP status. They do not record symptoms, notes, medications, message text, or the body of an AI request or response. An access log may record that a chart or visit was opened, the action, and the account role. It does not copy the clinical contents.

The website sets one cookie:

• docmd_session, an httpOnly, SameSite=Lax cookie. It holds a random session id, not health information. It is marked Secure in production. If you leave Remember me unchecked, the browser drops it when the browser closes and the server expires the session after 8 hours. If you check Remember me, the cookie lasts 30 days and the server enforces that same limit.

The website also stores two items in this browser’s localStorage:

• docmd-auth, the signed-in profile (name, email, role, and consent flags) so the page can render after a refresh. It does not store the password or the session cookie.
• docmd-session, a local copy of visits, messages, and the last triage summary, which can include the reason, the symptoms, and the summary. That copy stays on the device. It is not sent to analytics.

The mobile app keeps the sign-in token in memory. If you check Remember me, the app also stores the token and the account profile (name, email, role, and id) for 30 days in the device secure store on iOS and Android, or in localStorage on the mobile web build. That stored profile is not health information.

DOC MD does not track you across other companies’ websites and does not respond to a browser Do Not Track signal for ordinary browsing, because the public pages do not do the cross-site tracking that signal is meant to stop. If product analytics is switched on later, a Do Not Track or Global Privacy Control signal is treated as a refusal and nothing is sent. Third parties are not authorized to collect personal information about your activity on other websites through the service. Vercel Web Analytics, described next, counts a page view on DOC MD’s own public pages only.

Vercel Web Analytics is loaded on public pages such as the home page, About, clinicians, refer, and these legal pages. It is not loaded on signed-in pages or on pages where health information is entered or shown, including patient, clinician, admin, account, visit, sign-in, and join-a-visit pages. Before a page view is sent, the query string and fragment are removed so a join code or other parameter is not included. The count can include the page path, the referring page, the browser, and a coarse country derived from the network address. It is not an advertising cookie, it is not used to sell information, and it is not used to geofence.

Product analytics through PostHog is not loaded. It stays off unless DOC MD has a signed business associate agreement, the feature is switched on in the environment, and you choose Allow. If it is on, it may count only coarse events such as sign-in. It does not receive names, email addresses, phone numbers, dates of birth, addresses, conditions, medications, or visit details. That choice, if you make one, is stored in this browser as docmd.analytics.consent. A cookie banner is not a HIPAA authorization.

The service does not load advertising scripts. It does not use a third-party crash reporter.

The service does not request device location. The browser permission policy disables geolocation. DOC MD does not geofence, including around hospitals, clinics, or other health facilities. Vercel Web Analytics on public pages may include a coarse country. That country is not used to draw a boundary or to target a health facility.

Live video is carried by Amazon Chime. Audio and video from the camera and microphone are sent so the people in that visit can see and hear each other. DOC MD does not save a recording of the visit in the account, and the product has no recording control. The app asks for the camera and microphone only for the visit. You can turn either one off during the call. A video token is issued only after the patient has consented to collection, to sharing, and to telehealth.

DOC MD sends text messages only if you check the separate text-message box. That box starts unchecked. It is not required to create an account or to use the service. A phone number is optional.

The messages are appointment reminders, visit notifications, and account security codes, such as a phone confirmation code or a password-reset code. Message frequency varies. Msg & data rates may apply. Reply STOP to opt out, or HELP for help. You can also withdraw text-message consent in Settings. For help, email care@docmdapp.com.

Texts are sent from +1 877-550-7420 through AWS End User Messaging SMS in us-east-1. They use a fixed template. They do not include symptoms, notes, medications, or a diagnosis. AWS applies STOP and HELP at the carrier. A STOP reply opts that number out of further texts from this sender, and DOC MD stops sending when the consent record is withdrawn.

Mobile information and SMS opt-in consent are not shared with or sold to third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties except the SMS provider that delivers the messages.

Account, consent, and visit information stays in the database while the account is open. Deleting a patient account removes that account and the visits, clinical notes, prescriptions, and reminders stored for it from the database the service uses. It also removes that account’s activity log, then writes a short deletion record with the account id, the time, and the fact of deletion. That record does not include a password, symptoms, notes, medications, or video.

Deleting a clinician account removes the account, that account’s reminders, and that account’s sessions. Notes and prescriptions already stored on a patient’s chart stay on that chart. Visits already stored for a patient stay on that patient’s account.

The application does not keep a second archive of deleted health information. It does not control how long a database vendor keeps its own backup media, and this policy does not promise that backup media is erased on a particular day.

In the iOS or Android app, open Settings and choose Delete account, then confirm. You can also email care@docmdapp.com from the address on the account and ask for deletion. Some records may have to be kept when a law that applies to them says so. The deletion record described above is the retention the software itself keeps. If you ask, we will tell you which categories, if any, a law requires us to keep.

Accounts are for people 18 or older. The registration form requires that attestation, and the server rejects a registration that does not include it. An adult account holder may arrange a visit that includes a child's health information. DOC MD will offer all specialties, including pediatrics, as our network grows. If you believe an account itself is for someone under 18, email care@docmdapp.com and we will delete it.

DOC MD does not sell personal information and does not share it for cross-context behavioral advertising.

DOC MD has not determined whether it is a HIPAA covered entity or a business associate. The AWS Business Associate Addendum is in place for the AWS account used by this service, effective October 17, 2026. It covers AWS End User Messaging SMS and Amazon Chime SDK Meetings. Business associate agreements with Vercel and MongoDB are not in place. Do not use the service for a real patient’s information until that decision is made and any required agreements are signed. This policy is not a Notice of Privacy Practices under 45 CFR 164.520. If DOC MD later becomes a covered health care provider, a separate notice will be posted.

The California Consumer Privacy Act may not apply to DOC MD. The current thresholds include annual revenue, volume of California residents, or revenue from sale or sharing, and a pre-revenue company that does not sell or share personal information will often fall outside them. This policy does not create a CCPA rights program.

Separate from CCPA, you can see visits, notes, and prescriptions in the service, and you can email care@docmdapp.com to ask for a copy, a correction of account information, or deletion. Clinical notes written by a clinician are part of that chart. A request to change clinical content is sent to the treating clinician, who decides the medical record. We will not discriminate against you for asking.

Email care@docmdapp.com to report a security concern. A written process for deciding whether a notice is required under HIPAA, the FTC Health Breach Notification Rule, the Confidentiality of Medical Information Act, or a state breach law is not implemented in the software. That decision is an operational step outside this policy.

If this policy changes, the new version will be posted on this page with a new date before the change is the version in effect. For a material change, DOC MD will also email the address on the account when the account has one. Where a law requires a fresh consent, the service will ask for that consent again and will not rely on this paragraph alone.

DOC MD, Inc.
a Delaware corporation (incorporated October 15, 2026)
7405 Charmant Dr Unit 2001
San Diego, CA 92122
care@docmdapp.com