Web-Based and Mobile Application Platform Privacy Policy
Last Updated: May 15, 2026
Introduction
Record Rx, LLC (“Record Rx,” “RecordRx,” “we,” “our,” or “us”) is committed to protecting your information. This Privacy Policy describes how we process information through Record Rx’s web-based and/or mobile application platform (the “Platform”), which includes the patient portal used by individuals whose records we coordinate and the referral source dashboard used by our commercial customers (such as personal injury law firms and life settlement firms). This Platform Privacy Policy supplements our general Privacy Policy and applies specifically to information processed through the Platform. To the extent of any conflict, this Platform Privacy Policy controls with respect to information processed through the Platform. As used in this Privacy Policy, “Personal Information” means any information that can be used to identify, or is reasonably linkable, directly or indirectly, to a specific natural person. Protected health information processed through the Platform on behalf of healthcare providers is governed by the Health Insurance Portability and Accountability Act (“HIPAA”) and the applicable Business Associate Agreement between Record Rx and the relevant covered entity, together with the Notice of Privacy Practices and HIPAA Authorization you signed at the time of your account creation. This Platform Privacy Policy does not modify any obligations of Record Rx under HIPAA or any Business Associate Agreement.
Information We Collect
We collect the following categories of Personal Information through the Platform:
Account information
- Your full legal name, email address and mobile phone number;
- Language preference and time zone (if applicable);
- Account credentials and security information;
- Where you are an authorized user of a referral source, your role and the referral source you represent.
Identification information (collected at HIPAA Authorization signing)
- Date of birth;
- Mailing address;
- Prior names or maiden name;
- Last four digits of your Social Security Number (where required by providers for records-release verification).
Workflow information
- Your referral source identifier and case or matter identifier;
- Your designated recipient of records under your HIPAA Authorization;
- Records-request status, including events received from our contracted tele-health network and our affiliated records-retrieval technology platform.
Records and related information
- Medical records retrieved from healthcare providers on your behalf and aggregated through the Platform, together with parsed and indexed data such as billing codes, diagnosis codes and dates of service.
How We Collect Your Personal Information
We collect information from you when you complete forms on the Platform, when you e-sign HIPAA and other consent documents, when you correspond with us (for example, by email or in-platform messaging) and when you report a problem with the Platform. We also receive information from third parties, including your referral source, healthcare providers (including providers in our contracted clinical network) and the affiliated technology platform that supports records retrieval. We need to collect Personal Information to provide the requested Platform services to you. If you do not provide the information requested, we may not be able to provide the Platform services. If you disclose any Personal Information relating to other people to us or to our service providers in connection with the Platform, you represent that you have the authority to do so and to permit us to use the information in accordance with this Platform Privacy Policy.
How We Use and Disclose Personal Information
Use
We use the Personal Information we collect through the Platform for the legal, contractual and business purposes associated with providing the Platform to you, including the following:
- Providing Platform functionality and fulfilling your requests, such as creating and arranging access to your account; capturing and storing executed HIPAA documents; coordinating telehealth appointments through our contracted clinical network; coordinating the retrieval, aggregation and delivery of medical records to authorized recipients; surfacing parsed and indexed records data in the patient portal and the referral source dashboard; and providing related customer service.
- Sending administrative information, such as account confirmations, workflow status notifications, security alerts and changes to our terms, conditions, policies and the Platform.
- Administering and protecting the security of the Platform, including authentication, troubleshooting data analysis and system testing.
- Performing data analysis to assess trends about Platform use and to improve the efficiency, design and functionality of the Platform.
- Performing audits, to verify that our internal processes function as intended and to address legal, regulatory or contractual requirements.
- Performing fraud prevention and security monitoring, for example, to detect and prevent cyberattacks or attempts to commit identity theft.
- Developing new products and services and enhancing, improving, repairing, maintaining or modifying existing products and services.
- Aggregating and/or anonymizing Personal Information for purposes that no longer identify you or any other individual.
We engage in these activities to manage our contractual relationship with you, to comply with a legal obligation and/or based on our legitimate interest.
Disclosure
Personal Information processed through the Platform may be disclosed to:
- Our third-party service providers, including web-hosting and infrastructure providers, data analysis providers, identity verification vendors, e-signature platforms, email and notification delivery providers, customer service providers and auditors. Where such service providers handle protected health information, they do so subject to Business Associate Agreements as required by HIPAA.
- Our contracted telehealth provider network, for purposes of conducting the telehealth evaluation that supports your records request.
- Our affiliated records-retrieval technology platform, for purposes of requesting, retrieving and storing your medical records from prior providers.
- The healthcare providers from whom records are requested, for purposes of authenticating your request and releasing your records.
- The recipients you have designated under your HIPAA Authorization, such as your attorney or life settlement broker, for purposes of receiving your completed records package.
Other Uses and Disclosures
We also use and disclose your Personal Information as necessary or appropriate, in particular when we have a legal obligation or legitimate interest to do so, including:
- To comply with a court order, law, regulation or legal process, including to respond to a government or regulatory request.
- To cooperate with public and government authorities, including to respond to a request or to provide information we believe is necessary or appropriate.
- To cooperate with law enforcement, including when we respond to law enforcement requests and orders or provide information we believe is important.
- For other legal reasons, including to enforce our terms and conditions or to protect our rights, privacy, safety or property and/or that of our affiliates, you or others.
- In connection with a sale or business transaction, including any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock.
Other Information
“Other Information” is any information that does not reveal your specific identity or does not directly relate to an identifiable individual. The Platform collects Other Information such as:
- Browser and device information;
- Platform usage data, including the pages and features you access and the time spent on them;
- Information collected through pixel tags and other technologies;
- Information that has been aggregated in a manner such that it no longer reveals your specific identity.
We may use and disclose Other Information for any purpose, except where we are required to do otherwise under applicable law. If we are required to treat Other Information as Personal Information under applicable law, we will treat it as Personal Information.
Transfer and Storage of Personal Information
Record Rx is headquartered in Babylon, New York, in the United States. Your Personal Information may be stored and processed in any country where we have facilities or in which we engage service providers and by using the Platform you understand that your information will be transferred to countries outside of your country of residence, including the United States, which may have data protection rules that are different from those of your country. In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in those other countries may be entitled to access your Personal Information.
Data Security
Record Rx is committed to protecting the Personal Information you share with us through the Platform. We seek to utilize a combination of reasonable security technologies, procedures and organizational measures, including end-to-end encryption of sensitive health information in transit and at rest, to help protect your Personal Information from unauthorized access, use or disclosure. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “How to Contact Us” section below.
Data Retention
We retain your Personal Information for the length of time needed or permitted in light of the purpose(s) for which it was obtained, as outlined in this Platform Privacy Policy, and/or in accordance with applicable law. The criteria used to determine our retention periods include:
- The length of time we have an ongoing relationship with you and provide the Platform to you (for example, while your account is active);
- Whether there is a legal obligation to which we are subject; and
- Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).
Records and related information processed in our capacity as a Business Associate are retained in accordance with the applicable Business Associate Agreement and HIPAA.
Your Rights
If you would like to request to access, correct, update, suppress, restrict or delete Personal Information, object to or opt out of the processing of Personal Information or if you would like to request to receive a copy of your Personal Information for purposes of transmitting it to another company (to the extent these rights are provided to you by applicable law), please contact us using the contact information at the end of this Platform Privacy Policy. We will respond to your request consistent with applicable law. In your request, please make clear what Personal Information you would like to have changed or whether you would like to have your Personal Information suppressed from our database. For your protection, we may only implement requests with respect to the Personal Information associated with the particular email address that you use to send us your request and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable. Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion. Your rights with respect to protected health information are governed separately by HIPAA and the Notice of Privacy Practices.
Changes to This Platform Privacy Policy
We may make changes to the Platform and, as a consequence, we will need to revise this Platform Privacy Policy to reflect those changes. We will post all such changes on our website, so you should review this page periodically. Any changes will become effective when we post the revised Platform Privacy Policy on our website.
How to Contact Us
If you have any questions or comments about this Platform Privacy Policy, please contact us at:
Record Rx, LLC
42 Deer Park Avenue
Babylon, NY 11702