IMPORTANT HEALTH INFORMATION NOTICE: MCA IS A BUSINESS-DEVELOPMENT AND INFRASTRUCTURE COMPANY, NOT THE TREATING MEDICAL PROVIDER. GENERAL WEBSITE FORMS, EMAIL, TEXT MESSAGES, AND SALES CALLS ARE NOT PATIENT PORTALS. DO NOT SEND MEDICAL RECORDS OR OTHER SENSITIVE HEALTH INFORMATION THROUGH A GENERAL INQUIRY CHANNEL.
MED CLINICS AUTHORITY LLC, doing business as Med Clinic Authority ("MCA," "Company," "we," "us," or "our"), respects privacy and is committed to handling personal information responsibly. This Privacy Notice explains how we collect, use, disclose, retain, and protect personal information and describes choices that may be available to you.
This Notice applies to medclinicauthority.com and related pages, forms, scheduling tools, checkout pages, dashboards, communications, and online features that link to this Notice (collectively, the "Site"), as well as business inquiries, strategy calls, onboarding, projects, accounts, and services provided by MCA. By using the Site or providing information to MCA, you acknowledge the practices described here.
1. Scope and Important Boundaries
1.1 This Notice applies when MCA determines why and how personal information is processed for its own website, sales, contracting, payment, project, security, marketing, and business operations.
1.2 This Notice does not replace the privacy notice, notice of privacy practices, patient consent, or terms of a medical practice, independently licensed healthcare provider, pharmacy, manufacturer, fulfillment company, payment processor, client-owned supplement store, or client-owned telehealth brand. Those organizations may collect information directly under their own notices and legal responsibilities.
1.3 When MCA processes personal information solely for a business client, MCA acts as a service provider, contractor, processor, or business associate, as applicable. In that role, the client determines the purposes of processing, and its privacy documents and service agreement govern the data. Requests about that data should normally be directed to the client first.
1.4 If a separate master services agreement, statement of work, order form, business associate agreement, data processing addendum, or other written agreement (a "Service Agreement") applies, that agreement controls to the extent it expressly conflicts with this Notice.
2. Personal Information We Collect
2.1 Identifiers and contact information. We may collect your name, business name, title, mailing address, email address, telephone number, account identifiers, signature, and social-media or professional profile information.
2.2 Business and professional information. We may collect information about your company, practice, brand, professional role, licenses or credentials you choose to provide, target market, products, services, states of operation, treatment categories, business goals, audience, budget, timeline, current vendors, and desired infrastructure.
2.3 Inquiry, account, and transaction information. We may collect form responses, consultation and appointment details, proposals, contracts, order history, subscription status, invoices, payment status, customer-support history, onboarding answers, selected products, project approvals, and account activity. Payment-card information is generally collected directly by a payment processor. MCA may receive transaction identifiers, payment status, billing contact details, and limited card information such as card type and last four digits, but does not intend to receive full card numbers through ordinary Site forms.
2.4 Communications. We may collect emails, text messages, chat messages, call details, voicemails, support requests, survey responses, feedback, and other communications. Calls or virtual meetings may be recorded or transcribed for quality, training, documentation, and service delivery when permitted by law and after any required notice or consent.
2.5 Project and content information. We may collect brand names, logos, photographs, testimonials, website content, label content, product selections, workflows, files, credentials or access permissions, and other materials you ask us to use in performing services. You should provide only information you are authorized to share.
2.6 Device, Internet, and usage information. When you use the Site, we and our service providers may collect Internet Protocol address, browser type, device type, operating system, language, referring page, pages viewed, links clicked, approximate location inferred from IP address, date and time, session information, conversion events, and cookie or similar technology identifiers.
2.7 Security and fraud information. We may collect login events, access logs, authentication data, device signals, suspected-fraud indicators, communications metadata, and information needed to protect the Site, accounts, MCA, clients, patients, and other persons.
2.8 Sensitive information. We do not ask you to submit Social Security numbers, government identifiers, full payment-card data, medical records, laboratory results, diagnoses, prescriptions, or patient information through general Site forms, email, SMS, chat, or sales calls. If an approved service workflow requires sensitive information, we will identify the approved system and any applicable agreement. If you voluntarily submit sensitive information through an unapproved channel, we may delete it, restrict it, return it, or move it to an approved environment when reasonably possible.
3. Sources of Personal Information
We may obtain personal information from:
3.1 You, including through Site forms, calls, messages, checkout, scheduling, onboarding, contracts, files, approvals, and account use.
3.2 Your company, employer, authorized users, representatives, business partners, professional advisers, or other persons acting for you.
3.3 Service providers and platforms that support hosting, CRM, scheduling, communications, payments, analytics, advertising, security, collaboration, file storage, and project delivery.
3.4 Referral partners, events, public business records, professional directories, social networks, and other lawful public or commercial sources.
3.5 MCA clients when we perform services on their behalf, subject to the applicable Service Agreement and client instructions.
4. How We Use Personal Information
MCA may use personal information to:
4.1 Provide, configure, support, secure, and improve the Site, accounts, projects, and services.
4.2 Respond to inquiries; schedule and conduct strategy calls; evaluate fit, feasibility, scope, and risk; prepare proposals; and communicate about a potential or active engagement.
4.3 Process orders and payments; administer subscriptions; send receipts, invoices, notices, and service messages; maintain business records; and collect amounts due.
4.4 Develop brands, websites, storefronts, labels, customer or patient journeys, CRM systems, automations, telehealth infrastructure, provider or pharmacy coordination workflows, and other contracted deliverables.
4.5 Authenticate users, manage permissions, detect fraud or abuse, troubleshoot, monitor performance, protect systems, preserve evidence, and respond to security events.
4.6 Personalize Site content, measure traffic and conversions, understand how visitors use the Site, analyze business performance, and improve marketing and services.
4.7 Send marketing communications where permitted, manage preferences, and suppress future marketing after an opt-out.
4.8 Train personnel, document decisions, perform quality assurance, enforce agreements, resolve disputes, conduct audits, obtain professional advice, and comply with legal, tax, accounting, insurance, and regulatory obligations.
4.9 Create aggregated, deidentified, or statistical information that is not reasonably linkable to an individual and use it for lawful business purposes.
5. Cookies, Analytics, and Similar Technologies
5.1 The Site may use cookies, pixels, tags, scripts, local storage, session replay, call tracking, and similar technologies. These tools may remember preferences, keep forms and sessions working, measure Site use, identify errors, attribute leads, evaluate campaigns, prevent fraud, and support advertising or remarketing.
5.2 You may be able to control cookies through your browser or a cookie-preference tool made available on the Site. Blocking some technologies may affect Site functionality. Browser settings generally apply only to that browser and device.
5.3 Some browsers offer a Do Not Track signal. Because there is not a uniform industry response, the Site may not respond to Do Not Track. Where applicable law requires recognition of an opt-out preference signal, such as Global Privacy Control, MCA will process a signal that it receives in a legally required and technically supported manner.
6. How We Disclose Personal Information
MCA may disclose personal information for the purposes described in this Notice. A disclosure does not necessarily mean that the recipient may use the information for its own purposes.
6.1 Service providers and contractors. We may disclose information to companies and individuals that provide hosting, CRM, communications, scheduling, payment processing, analytics, advertising, security, professional services, file storage, collaboration, software, support, design, development, and project services.
6.2 Client-service participants. At your direction or as needed for a contracted project, we may disclose relevant information to your authorized team members and to potential or approved platform vendors, manufacturers, distributors, fulfillment providers, payment processors, independently licensed provider organizations, pharmacies, laboratories, consultants, or integration partners. Each recipient may conduct its own onboarding and determine whether to accept an engagement.
6.3 Professional advisers and insurers. We may disclose information to attorneys, accountants, auditors, consultants, banks, insurers, and other advisers when reasonably necessary to operate, protect, or evaluate our business.
6.4 Legal, safety, and compliance recipients. We may disclose information when we reasonably believe disclosure is required by law, subpoena, court order, regulatory request, professional obligation, or legal process, or is needed to protect rights, safety, security, patients, consumers, MCA, clients, or other persons.
6.5 Business transactions. Information may be reviewed or transferred in connection with a financing, reorganization, merger, acquisition, sale of assets, due diligence process, bankruptcy, or other business transaction, subject to appropriate confidentiality and legal requirements.
6.6 At your direction or with consent. We may disclose information when you request, direct, authorize, or consent to the disclosure.
6.7 Aggregated or deidentified information. We may disclose information that is not reasonably linkable to an individual, subject to applicable law and contractual restrictions.
7. Sale, Sharing, and Targeted Advertising
7.1 MCA does not knowingly sell personal information for monetary consideration. MCA may allow analytics, advertising, or social-media partners to collect limited device identifiers and Internet activity to measure engagement, attribute leads, or advertise services. Some state laws may characterize this activity as a "sale," "sharing," or processing for targeted advertising even when no money is exchanged.
7.2 Where applicable, you may request to opt out of sale, sharing, or targeted advertising by using a privacy-choice mechanism made available on the Site, by submitting a request through the Site's contact form, or by calling (561) 861-2121. We do not knowingly sell or share for cross-context behavioral advertising the personal information of anyone under 16.
7.3 MCA does not use or disclose sensitive personal information for the purpose of inferring characteristics about an individual except as permitted by law or with legally required consent.
8. Health Information, HIPAA, and Consumer Health Data
8.1 MCA is not presented as the treating medical provider. General Site activity and business-development information are not automatically protected by the Health Insurance Portability and Accountability Act ("HIPAA"). HIPAA applies only when the legal definitions and relationships are satisfied.
8.2 If MCA creates, receives, maintains, or transmits protected health information on behalf of a HIPAA covered entity or business associate, the parties must identify their roles, use approved systems, and enter a business associate agreement when required. MCA will process protected health information within the scope of the applicable agreement and client instructions. A reference to a HIPAA-supporting or HIPAA-ready technology does not, by itself, make a customer or workflow compliant.
8.3 Certain states regulate consumer health data more broadly than HIPAA. MCA's general business forms are not intended to collect information about an individual's health condition, treatment, diagnosis, medication, procedure, precise location near a healthcare facility, or attempt to obtain healthcare. Do not submit that information unless MCA has expressly provided an approved intake process and any required health-data notice and consent.
8.4 When a separate consumer health data privacy notice is required for a particular service, that notice will describe the health data collected, sources, purposes, disclosures, and applicable rights. This general Notice does not serve as a healthcare provider's HIPAA Notice of Privacy Practices.
9. Artificial Intelligence and Automated Tools
9.1 MCA may use artificial-intelligence-enabled or automated tools to route inquiries, summarize or transcribe communications, draft business content, assist support, analyze Site or campaign activity, detect risk, and improve operations. Outputs may be incomplete or inaccurate and may be reviewed or corrected by people.
9.2 General-purpose AI tools are not approved channels for patient records or protected health information. MCA will use specialized or contractually approved environments when a Service Agreement permits AI or automation to process regulated information.
9.3 MCA does not use an automated tool as the treating clinician and does not make independent medical diagnoses, prescribing decisions, or treatment decisions. Such decisions belong to appropriately licensed healthcare professionals exercising independent clinical judgment.
10. Payments
10.1 Online payments may be processed by Stripe or another payment provider. The payment provider collects and processes payment credentials under its own privacy terms and security obligations. MCA receives information needed to confirm and administer the transaction.
10.2 Do not send full payment-card information through email, SMS, chat, a general form, or a recorded call. Use only the approved checkout or invoice-payment channel.
11. Email, Text Messages, Calls, and Marketing Choices
11.1 If you provide an email address or telephone number, MCA may contact you about your inquiry, appointment, order, account, project, or services. Transactional or relationship communications may continue where permitted even after you opt out of marketing.
11.2 Marketing consent is not a condition of purchase. You may unsubscribe from marketing email by using the unsubscribe link. You may revoke marketing-text consent by replying STOP or by another reasonable request. For text help, reply HELP or call (561) 861-2121. Message frequency varies, and message and data rates may apply.
11.3 If you provide a telephone number, you represent that you are the subscriber or customary user of that number and will notify MCA if it changes. Opt-out records may be retained to honor your preference and demonstrate compliance.
12. Data Retention
12.1 MCA retains personal information only for as long as reasonably necessary for the purposes described in this Notice, including to manage an inquiry or relationship, deliver and support services, maintain project and transaction records, enforce agreements, resolve disputes, protect security, satisfy legal, tax, accounting, insurance, and regulatory obligations, and maintain required opt-out or suppression records.
12.2 Retention depends on the type and sensitivity of the information, the relationship, client instructions, applicable limitation periods, contractual requirements, backup and deletion cycles, and whether the information is needed for an active claim, audit, investigation, or legal hold. MCA may retain aggregated or deidentified information where permitted by law.
12.3 Information processed for a client is retained and deleted according to the Service Agreement, client instructions, applicable business associate agreement or data processing addendum, platform functionality, backup cycles, and law. Clients are responsible for exporting records they must legally retain before service access ends.
13. Security
13.1 MCA uses administrative, technical, and physical safeguards designed to protect personal information in a manner appropriate to its nature, sensitivity, use, and MCA's role. Safeguards may include access controls, authentication, vendor review, secure transmission, monitoring, backups, workforce practices, and incident response.
13.2 No Internet transmission, email, text message, platform, or storage system is completely secure. MCA cannot guarantee absolute security. You are responsible for safeguarding credentials, devices, accounts, and copies of information in your possession and for promptly reporting suspected unauthorized account use.
13.3 If MCA determines that a security incident requires notice under applicable law or contract, MCA will provide notice to affected persons, clients, regulators, or other required recipients as applicable to MCA's role.
14. Your Privacy Rights and Choices
14.1 Depending on where you reside and subject to legal exceptions, you may have the right to request access to or confirmation of personal information, obtain a copy, correct inaccuracies, delete information, opt out of sale, sharing, targeted advertising, or certain profiling, limit certain uses of sensitive information, withdraw consent, or appeal a denied request.
14.2 To submit a privacy request, use the contact form at https://medclinicauthority.com/start-here, call (561) 861-2121, or mail the request to the address in Section 21. Clearly state that the request concerns privacy and identify the right you wish to exercise.
14.3 MCA may verify your identity and authority by matching information you provide with MCA records and may request additional information where reasonably necessary. If an authorized agent submits a request, MCA may require proof of authorization and may verify your identity directly, as permitted by law. MCA will use verification information only to process the request.
14.4 MCA may deny or limit a request where permitted by law, including when identity cannot be verified, an exception applies, MCA must retain information, the request would adversely affect another person's rights, or MCA processes the information solely for a client. MCA will not unlawfully discriminate against you for exercising a privacy right.
14.5 If MCA denies an appealable request, you may appeal by using the same contact method and stating "Privacy Appeal." MCA will provide any further complaint information required by applicable law.
15. Additional Information for California Residents
15.1 The categories of personal information MCA may have collected during the preceding 12 months include identifiers; customer-record information; commercial information; Internet or other electronic-network activity; approximate geolocation; audio, electronic, visual, or similar information; professional or employment-related information; inferences drawn from other information; and sensitive personal information if voluntarily submitted or required through an approved workflow.
15.2 MCA collects these categories from the sources described in Section 3 and uses them for the purposes described in Section 4. MCA may disclose them to the recipient categories described in Section 6 for business purposes. MCA does not knowingly sell personal information for money. The analytics and advertising disclosures described in Section 7 may be considered sale or sharing under California law.
15.3 California residents may have rights to know, access, correct, delete, and obtain specific pieces of personal information; to opt out of sale or sharing; to limit certain uses of sensitive personal information; and to receive equal service and price, subject to exceptions and MCA's legal applicability. Requests may be made as described in Section 14.
15.4 MCA uses and retains each category only as reasonably necessary and proportionate for the disclosed purposes, taking into account the criteria in Section 12. MCA does not knowingly sell or share personal information of consumers under 16.
15.5 California's Shine the Light law may allow a resident with an established business relationship to request information about certain disclosures for direct marketing. MCA does not disclose personal information to third parties for their own direct marketing in the manner contemplated by that law without permission.
16. Client Data and Privacy Requests
16.1 MCA clients may use MCA-configured systems to collect information from their own leads, customers, or patients. The client is responsible for its notices, consents, legal basis, collection practices, instructions, access controls, retention rules, and response to individual rights requests.
16.2 If MCA receives a request concerning data it maintains solely for a client, MCA may direct the requester to that client and may assist the client as required by contract or law. MCA cannot independently fulfill a request that would conflict with a client's lawful instructions or another person's rights.
17. Children's Privacy
17.1 The Site and MCA's business-development services are intended for adults and are not directed to children under 13. MCA does not knowingly collect personal information online from a child under 13 through the Site. If you believe a child has provided such information, contact MCA so the matter can be reviewed.
17.2 MCA's services are not offered for purchase by persons under 18. A client-operated healthcare or supplement service that serves a minor must use appropriate parent or guardian authorization, age-specific consent, and privacy procedures.
18. Third-Party Sites and Services
18.1 The Site may link to third-party websites, social networks, scheduling tools, checkout pages, platforms, provider organizations, pharmacies, manufacturers, fulfillment companies, or client brands. MCA does not control their independent privacy practices. Review the notice presented by the organization that collects your information.
18.2 A link, integration, introduction, or coordinated workflow does not make MCA responsible for another organization's privacy, security, clinical, payment, manufacturing, or fulfillment practices.
19. International Users
19.1 MCA is based in Florida, United States, and the Site is directed primarily to the United States. If you access the Site from another country, your information may be processed in the United States or another jurisdiction where MCA or its service providers operate, which may have different privacy laws.
19.2 Do not submit regulated international patient data or engage MCA for international processing without a written Service Agreement addressing the applicable jurisdiction, roles, transfer mechanism, and safeguards.
20. Changes to This Privacy Notice
20.1 MCA may update this Notice to reflect changes in practices, technology, services, contracts, or law. The revised version will be posted on the Site with an updated Last Updated date. Material changes will apply prospectively after posting or after any additional notice or consent required by law.
20.2 A website update does not amend a signed Service Agreement, business associate agreement, or data processing addendum unless that agreement expressly permits the update.
