HIPAA Compliance

The Health Insurance Portability and Accountability Act (HIPAA) is a United States federal law enacted in 1996 that sets national standards for the protection of individuals' medical records and other personal health information (PHI — Protected Health Information).

HIPAA establishes rules around:

• Privacy: Who can access and use health information
• Security: How electronic health information must be protected
• Breach Notification: What must happen when health data is improperly accessed
• Patient Rights: The rights individuals have over their own health data

HIPAA primarily applies to covered entities — healthcare providers, health plans, and healthcare clearinghouses — and their business associates who handle PHI on their behalf.

Because you choose to share your own medical information with us directly as a consumer, the HIPAA regulations governing covered entities do not technically apply to SmartMedReport in the same way they apply to your doctor or hospital.

However, we believe that the spirit of HIPAA represents the right way to handle health data, and we voluntarily design our service around its core principles:

• Collecting only the minimum information necessary
• Never selling or improperly disclosing health information
• Applying strong security safeguards to all data
• Being transparent about how your information is used
• Giving you control over your own data

We are committed to exceeding baseline privacy expectations — not just meeting the legal minimum.

When you upload a medical report, here is exactly what happens to your data:

• Upload: Your image is transmitted securely to our servers over an encrypted HTTPS connection.
• Analysis: The image is passed to our AI system for processing. The AI reads the image and generates a plain-language explanation.
• Immediate Discard: Your original image is discarded immediately after analysis is complete. It is never written to long-term storage.
• Result Saved: Only the text analysis result — the AI's explanation — is saved to your account. This allows you to access your report history from your dashboard.
• No Secondary Use: Your data is never used for advertising, sold to third parties, or used to train AI models without explicit consent.

We are committed to data minimization. The following types of information are never collected or stored by SmartMedReport:

• Your uploaded medical report images
• Your full name, date of birth, or government-issued ID numbers
• Your Social Security Number or national identification numbers
• Your health insurance information or policy numbers
• Your medical record numbers assigned by healthcare providers
• Your geographic location beyond what you voluntarily provide
• Biometric identifiers such as fingerprints or facial recognition data
• Payment card numbers or full billing details

We apply multiple layers of security to protect your data, consistent with HIPAA's Security Rule requirements for electronic PHI:

A core principle of HIPAA — and of our own data philosophy — is collecting only what is absolutely necessary to provide the service. SmartMedReport is designed with data minimization at its core:

• We only require an email address to create an account — no name, phone number, or address
• We do not ask for your medical history, diagnosis, or any health background
• We do not require you to identify which condition your report relates to
• The AI analyzes your uploaded image without needing any additional personal context from you
• Your saved report history contains only the AI-generated text — never your original image

This approach means that even in the unlikely event of a security incident, the amount of sensitive health information that could be exposed is deliberately kept to an absolute minimum.

While we take strong measures to protect your data, you also play a role in maintaining privacy when using SmartMedReport:

• Redact sensitive identifiers: Where possible, cover or redact your full name, date of birth, Social Security Number, or patient ID before uploading a report.
• Secure your account: Use a strong, unique password for your SmartMedReport account and do not share it with others.
• Use secure networks: Avoid uploading sensitive documents over unsecured public Wi-Fi networks.
• Log out on shared devices: Always log out of your account when using a shared or public computer.
• Keep your device secure: Ensure the device you use to access SmartMedReport has up-to-date security software.

If you are a healthcare professional, please be aware of the following:

• SmartMedReport is a consumer product and is not a certified medical device or clinical decision support tool
• Uploading patient records through SmartMedReport may implicate your organization's own HIPAA obligations and compliance requirements
• You should consult your organization's compliance and legal team before using any consumer AI tools with patient data
• We do not offer Business Associate Agreements (BAAs) at this time, as we are not operating as a business associate under HIPAA

For clinical-grade medical AI solutions, please consult certified healthcare information technology providers.

Although we are not technically a covered entity under HIPAA, we voluntarily commit to following breach notification best practices consistent with HIPAA standards:

• In the event of a security incident that may have exposed your personal information, we will notify affected users within 72 hours of becoming aware of the breach
• We will clearly describe what information was affected, what happened, and what steps we are taking to address the incident
• We will provide guidance on steps you can take to protect yourself
• We will cooperate with any applicable regulatory investigations

Given our architecture — specifically that medical images are never stored — the scope of any potential breach is significantly limited compared to services that retain health images and records.

Consistent with HIPAA's Patient Rights provisions and broader privacy law principles, we give you meaningful control over your data:

• Access: You can view all of your saved report analyses at any time through your dashboard
• Deletion: You can request deletion of your account and all associated data by contacting us at support@smartmedreport.com
• Correction: If you believe information in your account is inaccurate, contact us and we will review the request
• Portability: You may request a copy of your stored report history in a readable format
• Opt-out: You may stop using the Service at any time and request complete removal of your data

We will respond to all data rights requests within 30 days of receipt.

If you have questions about how SmartMedReport handles your health data, our privacy practices, or this HIPAA Compliance page, please reach out:

• Email: support@smartmedreport.com
• Website: smartmedreport.com
• Response time: We aim to respond within 2 business days

For additional information, please also review our Privacy Policy and Terms of Service.