Privacy Policy & Terms of Use

1. Who we are and what this policy covers

Medcio is a clinical-records and research platform for doctors. This policy explains what information we hold about you (the doctor or assistant using Medcio) and about the patients whose records you enter, how we protect it, and the choices you have.

For patient records, you (the doctor) decide what is recorded and why. Medcio stores and processes those records only on your behalf and only to provide the service to you.

2. Information we collect

• Account information: your name, email address, phone number, specialty and workspace name.

• Clinical records you enter: patient identifiers (such as name and record number), demographics, diagnoses, procedures, pathology, outcomes and follow-up.

• Security information: sign-in times, IP address, browser type and an audit trail of actions inside your workspace, used to keep accounts safe.

3. How we use information

We use your information only to run Medcio for you: to store and display your records, generate your reports, secure your account and answer your support requests.

We never sell your data or your patients’ data. We do not use patient records for advertising or for our own research, and we do not share them with anyone without your explicit permission — unless the law requires it.

4. How we protect data

• Encryption in transit: all data between your device and Medcio travels over encrypted HTTPS (TLS) connections.

• Passwords are never stored in readable form; we keep only a one-way Argon2 or bcrypt hash.

• Every workspace is isolated: each query is restricted to your own workspace, and assistants only get the permissions you grant.

• Repeated failed sign-ins are blocked, sessions close automatically after 30 minutes of inactivity, and forms are protected against cross-site request forgery.

• The platform administrator manages accounts only and has no access to clinical records in the normal use of the service.

5. Research exports

Report PDFs and research datasets are de-identified by default: patient names and record numbers are removed and replaced with study IDs. An identifiable export exists only for the doctor’s internal use and is clearly marked.

Publishing research based on your records remains your responsibility, including ethics approval and patient consent where required.

6. Sharing and storage

Data is stored with our hosting provider, which processes it only to run our servers. Servers may be located outside your country. We do not otherwise share data with third parties.

7. Keeping and deleting data

Your records stay in your workspace until you remove them. Patient records are archived first and can then be deleted permanently from the archive. You can ask us to close your account and delete its data at any time.

8. Your choices and rights

You can view, correct and export your data from within Medcio, withdraw permissions you gave an assistant, and request deletion of your account. Patients who want to exercise their rights should contact their doctor, who controls their record.

9. Cookies

Medcio uses only essential cookies: one to keep you signed in and one to remember your language. Small preferences (such as a dismissed tip) are stored in your browser. There are no advertising or tracking cookies.

10. Using Medcio responsibly

By using Medcio you confirm that you are a licensed health professional (or their authorised assistant), that you have the right to record the patient information you enter, and that you will keep your sign-in details private. Medcio is a record-keeping and analysis tool; it does not give medical advice, and clinical decisions remain yours.

11. Changes to this policy

If we change this policy in a meaningful way we will update the version below and ask you to accept it again before you continue.

Questions about privacy can be sent through the support contact on the Medcio website.