Privacy Policy — Metrodora

Metrodora Labs, LLC, a limited liability company organized under the laws of the State of Delaware ("Metrodora," "we," "us"), provides an electronic medical record and practice-management platform (the "Service") to medical and surgical practices.

This Privacy Policy explains how we handle information in connection with our website and the Service.

Effective date: 2026-09-03 · Last updated: 2026-09-03

1. Read this first — two different data relationships, and this Policy governs only one

This is the most important thing on the page. Please do not skip it.

1.1 Patient health information — governed by HIPAA and a BAA, not by this Policy

When a medical practice uses the Service, that practice is the HIPAA Covered Entity. It holds the treatment relationship with the patient and it controls the medical record.

Metrodora is a HIPAA Business Associate. We create, receive, maintain, and transmit Protected Health Information ("PHI") only on the practice's behalf, and only as that practice's Business Associate Agreement ("BAA") and HIPAA permit. We do not use patient PHI for our own purposes. We are not the custodian of the medical record; the practice is.

Consequently, this Policy does not govern our handling of patient PHI. The BAA and HIPAA do. Where this Policy and an executed BAA could be read to differ with respect to PHI, the BAA governs.

1.2 Patients: exercise your HIPAA rights through your practice, not through us

If you are a patient, your rights under HIPAA — to access your records (45 CFR §164.524), to request an amendment (§164.526), to an accounting of disclosures (§164.528), and to request restrictions on use and disclosure (§164.522) — are exercised with the practice that treats you, not with Metrodora.

We are contractually unable to act on such a request directly. Under the BAA, if a request reaches us we forward it to your practice, and your practice decides. Sending your request to us instead of to your practice will only delay it. Contact your practice's office or Privacy Officer.

1.3 This is NOT a Notice of Privacy Practices

A Notice of Privacy Practices ("NPP") is a distinct legal document that a Covered Entity must give its patients under 45 CFR §164.520, describing how that practice uses and discloses PHI and what rights the patient has. It is the practice's obligation to its patients. This Policy is not one and does not substitute for one.

Metrodora's document content library ships an NPP template that practices may adopt, review, and issue under their own name — but issuing it, and standing behind it, remains the practice's responsibility. If you are a patient looking for an NPP, ask your practice.

1.4 What this Policy actually covers

This Policy governs the information we handle for ourselves, as a business:

• visitors to our website;
• prospective customers and people who contact us about the Service;
• staff users of the Service (a practice's clinicians and employees) — their account, authentication, and usage data.

2. Information we collect

2.1 Staff-user account information

Name, work email address, role, practice affiliation, and authentication data (a hashed password and/or a Google Workspace single-sign-on identity, plus multi-factor-authentication enrollment data). We never store a staff password in recoverable form.

2.2 Service usage and security logs

Application and infrastructure logs generated when the Service is used: timestamps, account identifier, IP address, browser/device characteristics, requested routes, and error events. We also maintain an access log of interactions with health information (see §6.3) — that log is a HIPAA security control, not a product-analytics tool.

2.3 Business contact information

Information you give us directly through a sales inquiry, support request, demonstration request, or email to us.

2.4 Customer Data, including PHI

Clinical and administrative information that practice staff (or patients, through practice-facing intake, scheduling, and portal features) enter into the Service. This is handled under the BAA — see §1.1. We do not decide what a practice puts into the Service, and we do not use it for our own purposes.

2.5 What we do NOT collect

We do not collect information about patients from third-party data brokers, and we do not buy, rent, or append third-party marketing data. We do not track visitors across other websites (see §8).

3. How we use information

• To provide, operate, secure, support, and troubleshoot the Service.
• To authenticate staff users and administer accounts.
• To detect, investigate, and respond to security incidents.
• To communicate with customers and prospective customers about the Service.
• To comply with law and to enforce our agreements.

PHI is used only as the BAA and HIPAA permit — to provide the Service to the practice, and for the limited management, administration, and legal-responsibility purposes HIPAA allows a Business Associate (45 CFR §164.504(e)).

We do not sell personal information or PHI — in identified, de-identified, or aggregated form, to anyone. We do not use PHI, or any patient information, for advertising or for marketing to patients.

4. Artificial intelligence features

The Service includes AI features — Echo (an ambient clinical scribe that transcribes a consultation and drafts a structured clinical note) and Metrodora AI (a grounded assistant over the practice's own data). We want to be precise about what this means for health information, because vagueness here would be its own kind of misrepresentation.

AI processing of health information does occur, and it happens under a BAA. Consultation audio and clinical text are processed by:

• AWS Transcribe Medical — speech-to-text; and
• AWS Bedrock (running Anthropic's Claude Haiku 4.5) — note drafting and assistant responses.

Both are AWS services, run in our AWS account in the US, and are covered by our executed BAA with AWS (§7). They are subcontractor Business Associates, flowed down as 45 CFR §164.502(e)(1)(ii) requires.

This customer data is not used to train foundation models. Amazon Bedrock does not use inputs or outputs submitted to it to train its models, and does not share them with model providers. Metrodora likewise does not train, fine-tune, or customize any model on customer data. Bedrock is used for inference only. That is a statement of present fact, not an aspiration — and if it ever ceases to be true, this section must change before the change ships.

Human oversight is architectural, not a policy promise. The AI proposes; it does not act. An AI-drafted note reaches the patient's chart only after a clinician reviews it field-by-field and signs it. An AI-proposed action reaches the record only after a human confirms it. No AI output is auto-sent to a patient.

AI output is not a clinical decision. Drafted notes and assistant answers are advisory and require professional review. The treating clinician remains responsible for the record.

5. De-identified data

Our BAA with each practice expressly authorizes us to de-identify PHI and to use the resulting de-identified data for our own purposes, including to develop, evaluate, and improve our products, models, and features. That express grant is required — a Business Associate may not de-identify PHI unless the BAA says so (45 CFR §164.504(e)(2)(i)(B)) — and it is stated in the BAA rather than only implied here. Properly de-identified data is not PHI and is outside the Privacy Rule (45 CFR §164.502(d)(2)).

To be accurate about the present state rather than the contractual right:

• We do not operate a de-identification pipeline today. This is a reserved right that the software does not yet exercise. We will not describe a capability we have not built.
• We use the Safe Harbor method. HIPAA permits two ways to de-identify. We rely on Safe Harbor (45 CFR §164.514(b)(2)): we remove all eighteen categories of identifiers listed in that section — including names, addresses below state level, all dates more specific than a year, ages over 89, contact details, and record and account numbers — and we must have no actual knowledge that what remains could identify someone. We do not rely on Expert Determination (§164.514(b)(1)), and we will not do so unless we first obtain a documented determination from a qualified expert and tell the practice. We will not treat data as de-identified unless it actually meets this standard.
• We will not attempt to re-identify de-identified data or to contact any individual using it, and we will not sell it.
• Clinical photographs are treated as categorically different. A full-face photograph is itself one of HIPAA's 18 identifiers (45 CFR §164.514(b)(2)(i)(Q)); it cannot be de-identified under Safe Harbor without destroying the image. We claim no right to train on patient photographs, and no such capability exists in the product.

We may publish aggregated, non-identifying metrics about the Service (for example, average time to sign a note) provided no practice, patient, or clinician is identifiable and the cohort is large enough that identification is not reasonably possible.

6. Security

We maintain administrative, physical, and technical safeguards designed to meet the HIPAA Security Rule and the New York SHIELD Act (N.Y. Gen. Bus. Law §899-bb). The specific controls below are the same ones we commit to contractually in §22 of our BAA — the two documents are deliberately identical, so that a customer's contract and this public statement cannot drift apart.

6.1 Technical controls

• Encryption of health information in transit and at rest using industry-standard algorithms. Databases and object storage are encrypted at rest with customer-managed keys.
• Multi-factor authentication for administrative and remote access.
• Role-based access control, applied on a least-privilege basis.
• Logical separation of each customer's data, enforced in the database itself (row-level security scoped to the practice) rather than only in application code.

6.2 Organizational controls

• Workforce security training on commencement and annually thereafter.
• A written risk assessment, reviewed not less than annually.
• Written incident-response and breach-notification procedures.
• Every subcontractor that can touch PHI is under an executed BAA before PHI reaches it (§7).

6.3 Logging

Access to electronic health information is logged, and those access logs are retained for not less than twelve (12) months. Separately, general application and infrastructure logs are retained for 30 days — these two retention periods are different on purpose and should not be confused.

6.4 What we do not claim

Metrodora does not currently hold SOC 2, HITRUST, or an AT-C 315 HIPAA compliance attestation, and this Policy should not be read to imply any independent certification of our security program. We say so plainly because the absence of a certification is a fact a customer is entitled to know, and because implying one we do not have would be worse than not having it.

No system is perfectly secure. We cannot and do not guarantee that unauthorized access will never occur.

7. How we share information — subprocessors

We share information with service providers only as needed to run the Service. Every subprocessor that can create, receive, maintain, or transmit PHI on our behalf has an executed BAA with Metrodora before any PHI reaches it.

7.1 Subprocessors that handle PHI (all under executed BAAs)

7.2 Pending — not connected, and gated on a BAA

Electronic prescribing. We have chosen an e-prescribing vendor (corrected 2026-08-20 — this used to say we were still selecting between ScriptSure and DoseSpot). The vendor is not connected to the Service today, its contract is not yet signed, and it will not be enabled until a BAA with it is executed. This Policy will be updated to name the vendor once that contract is signed.

7.3 Vendors we use that never receive health information

We host a separate internal operator console used to administer the platform. It runs on Vercel (hosting) and Neon (database). That system is architecturally prevented from receiving PHI — the two applications cannot import each other (a build check enforces this), and data crossing between them is limited to explicitly enumerated non-health fields. Because those vendors do not receive PHI, no BAA is required for them. If that ever changed, they would require BAAs before the change shipped.

7.4 Vendors no longer in the health-information path

Daily.co (telehealth video, replaced by Zoom), Sentry (error monitoring, replaced by AWS CloudWatch), and Photon Health (e-prescribing sandbox — which only ever received synthetic test data, never real patient information) are no longer used in connection with health information.

7.5 Other disclosures

• Legal and safety: when required by law, legal process, or to protect rights, safety, or the integrity of the Service. Where a legal demand seeks PHI, we notify the practice unless prohibited from doing so, because the practice — not Metrodora — is the party entitled to respond.
• Business transfers: in a merger, acquisition, or sale of assets, information may transfer to the successor, which remains bound by this Policy and by the BAA. Our commitment never to sell PHI or de-identified data is intended to bind successors.
• We do not disclose information to advertisers or data brokers.

8. Cookies and analytics

We do not run third-party analytics, advertising, or cross-site tracking on the Service. No Google Analytics, no advertising pixels, no session-replay tooling, no behavioral tracking. This is verified against the application's source code, not assumed — the application has no such dependency.

The Service sets only strictly necessary cookies: an authentication session cookie so you stay signed in, and security tokens that protect against cross-site request forgery. These cannot be disabled without breaking sign-in.

Because we set no advertising or analytics cookies, we do not display a consent banner and we have nothing to opt out of. We do not respond to Do Not Track signals, because we do not engage in the cross-site tracking those signals address.

9. Data retention and deletion

PHI: retention, return, and destruction are governed by the BAA, not by this Policy. On termination, and at the practice's election, we return PHI in a commercially reasonable machine-readable format or destroy it, with a limited carve-out for routine backup and disaster-recovery media, which cannot feasibly be selectively purged and which remain protected by the BAA until they expire in the ordinary retention cycle.

Staff-user account data: retained while the account is active. When a practice deactivates a user, we retain the account record as needed to preserve the integrity of the audit trail — a HIPAA requirement, since deleting a user would orphan the record of what that user did.

Logs: access logs to health information, not less than 12 months; general application and infrastructure logs, 30 days (§6.3).

Business contacts: retained while relevant to the relationship and for a reasonable period afterward for legal and business-record purposes.

An honest limitation: we have not implemented an automated, calendar-driven purge for every category of non-PHI business data, and we are not going to publish a schedule we do not enforce. Where no period is stated above, we retain information for as long as it is needed for the purposes described in this Policy or as law requires. If you want your business-contact information deleted, ask us (§13) and we will do it.

10. Your choices and rights

Patients: see §1.2. Your HIPAA rights run through your practice.

Staff users: you may access and correct your account information in the Service, or ask us. Adding, disabling, or removing a staff account is controlled by your practice's administrator, because your practice — not Metrodora — decides who may access its records.

Website visitors and business contacts: email privacy@metrodora.ai to ask what business-contact information we hold about you, to correct it, to delete it, or to unsubscribe from our messages.

10.1 State and international privacy laws — what does and does not apply

We would rather say this plainly than pad the page with rights nobody here has:

• New York SHIELD Act — applies. See §11.
• HIPAA — applies to PHI, through the practice and our BAA. See §1.
• CCPA/CPRA (California) — does not currently apply to us. We are a business-to-business company that does not meet any CCPA applicability threshold, and PHI handled under HIPAA is in any event exempt from the CCPA (Cal. Civ. Code §1798.145(c)). We are not making CCPA disclosures because doing so would misdescribe our situation.
• GDPR / UK GDPR — does not currently apply to us. We do not offer the Service in the EU/EEA/UK and do not monitor the behavior of people there.
• Other state privacy laws (e.g. Connecticut, Colorado, Texas, Washington My Health My Data) — we do not currently meet their applicability thresholds. Most also exempt PHI handled under HIPAA.

If any of these becomes applicable — because we grow, or because a customer practice treats patients in another state — we will update this Policy and provide the required disclosures before, not after.

11. Breach notification

New York SHIELD Act (N.Y. Gen. Bus. Law §899-aa). If private information of a New York resident is acquired without authorization, we will notify affected individuals and the required New York authorities in the most expedient time possible and without unreasonable delay, consistent with the needs of law enforcement and of determining the scope of the incident. We also maintain the reasonable safeguards §899-bb requires — the same controls listed in §6.

HIPAA. Where the incident involves PHI, the practice (the Covered Entity) makes the breach determination and issues patient notifications, not Metrodora. Our obligation runs to the practice: we notify the practice in writing promptly on discovery, and in no case later than 30 calendar days, with the information 45 CFR §164.410 requires, and we cooperate with the practice's notification obligations.

We report other security incidents affecting electronic PHI to the affected practice within five business days, excluding the continuous background of routine, unsuccessful events (port scans, failed logins, and similar automated noise), which are reported in the aggregate on request.

12. Additional disclosures

12.1 Consumer messaging channels carry no health information

The Service can connect a practice's Instagram, Facebook Messenger, and WhatsApp accounts for scheduling and marketing conversations. These channels carry no PHI by design. We hold no BAA with Meta, and none of these channels may be used for clinical information. Anything a patient sends through them travels over Meta's platform under Meta's own terms and privacy policy, which we do not control. Patients should not send health information through social messaging.

12.2 Telehealth

Video visits run on Zoom under our executed Zoom BAA, on a HIPAA-enabled Zoom plan. A visit is recorded only where the practice's own workflow and consents provide for it; whether to record, and what to tell the patient, is the practice's decision. Where the AI scribe is used during a telehealth visit, §4 applies.

12.3 Children

The Service is a professional tool for medical practices and is not directed to children, and we do not knowingly collect personal information from children through our website. A minor patient's information in the Service is PHI belonging to the practice's record and is governed by the BAA, HIPAA, and applicable state law on minors' health information — not by this Policy.

12.4 Where data is processed

The Service is operated in the United States, in AWS's US East (Ohio) region. We do not transfer PHI outside the United States.

12.5 Links to other sites and services

The Service and our website link to, or connect with, sites and services we do not operate — a practice's own website, a payment or financing provider, a video visit, a practice's social messaging accounts, and the government reference sites we link to rather than reproduce. Those services are governed by their own terms and privacy policies, not by this one, and we are not responsible for their content or their privacy practices. Following such a link takes you outside the Service.

Two of those links are deliberate design decisions rather than conveniences, and are worth stating here:

• Consumer social messaging (§12.1) sits outside our BAA boundary on purpose and carries no health information.
• Public-health and government publications are linked, never embedded. Those pages are revised continually, and a copy hosted here would go stale without saying so.

13. Changes to this Policy, and how to reach us

We may update this Policy. If we make a material change — in particular any change to §4 (AI), §5 (de-identified data), §7 (subprocessors), or §9 (retention) — we will update the "Last updated" date and notify customer practices directly, in advance where we reasonably can. We will not make a material change quietly.

Contact:

• Privacy questions: privacy@metrodora.ai
• Mail: Metrodora Labs, LLC, 920 Park Avenue, 17C, New York, NY 10028
• Patients: please contact your practice — see §1.2. We cannot act on a HIPAA request directly.