Privacy Policy

01 Scope & who we are

This Privacy Policy explains how Med Foresight, Inc. (“Med Foresight,” “Company,” “we,” “us”), located at PO Box 187, Issaquah, WA 98027, collects, uses, and discloses information in connection with our website, marketing activities, and the Med Foresight clinical intelligence service (collectively, the “Services”).

This Policy covers:

• The marketing site (med4sight.com) — for clinicians, health-system decision-makers, investors, and partners;
• Patient Foresight Pro (PFP) — used by clinical staff at customer practices;
• The MedForesight Assist browser extension — the Google Chrome extension used by clinical staff alongside their practice's ModMed gGastro EHR. Section 5 describes the extension's data practices in full;
• Pilot deployments processing Protected Health Information under an executed Business Associate Agreement.

Med Foresight provides AI-assisted clinical intelligence tools to healthcare providers. When we provide Services to a healthcare provider customer (“Customer”), the Customer is the controller (and, where applicable, the HIPAA covered entity) of patient information, and Med Foresight acts as a processor / business associate. The Customer's own privacy notice — not this one — governs how that patient information is collected from individuals. Patients whose records are processed should contact their healthcare provider to exercise privacy rights.

This Policy applies directly to information we collect from visitors to our website, prospective customers, and the administrative and clinical users of our Services.

02 Information we collect

Marketing site visitors

When you contact us, request a demo, or otherwise communicate with us, we collect the identifiers you submit — typically name, work email, phone, organization, role, and any message content. We and our service providers also collect device and usage data — IP address, user-agent, referrer, pages viewed, time on page, approximate geolocation, and similar log information — together with cookies and similar technologies (see Section 13).

Product users (clinical staff)

• Account identifiers provisioned by the customer practice.
• Authentication information — the work email address and password a user submits to sign in, and the session token issued in return. Passwords are transmitted over TLS to verify a sign-in and are never stored by the browser extension in any form.
• User-generated content — questions a user types into the product's clinical chat, and the ratings and free-text comments a user submits as feedback on a generated summary.
• Product telemetry used to operate, secure, and improve PFP. The browser extension contains no analytics, crash-reporting, or advertising SDK of any kind (see Section 5).

Patient information (PHI)

PHI is processed only on behalf of customer practices under a BAA. Categories typically include demographic identifiers, encounter data, problem lists, medications, lab and imaging references, pathology reports, and clinical notes. PHI reaches Med Foresight by two routes:

• System integration — from the Customer's electronic health record via HL7/FHIR, where the Customer has configured it.
• The browser extension — a small set of identifying fields read from the EHR screen a signed-in clinician is already viewing in their own browser. Section 5 lists exactly which fields, and no others are read.

We process PHI only as permitted by the Business Associate Agreement (BAA) we have entered into with that Customer. See Section 3.

03 Protected Health Information

Med Foresight handles PHI in accordance with the Health Insurance Portability and Accountability Act (“HIPAA”), the HITECH Act, and the implementing regulations at 45 C.F.R. Parts 160 and 164 (“HIPAA Rules”), and in accordance with the BAA executed with the relevant Customer.

What we do with PHI

• Use it only for the Customer's stated purposes — operating the Services, generating chart summaries and clinical answers for the Customer's authorized users, and providing technical support.
• Do not sell PHI, and do not use PHI for advertising or marketing.
• Do not use PHI to train or fine-tune AI models used outside the Customer, except with the Customer's express written authorization in the BAA or a separate data-use agreement. See Section 7.
• Apply HIPAA Security Rule safeguards — administrative, physical, and technical — to all environments in which PHI is processed.
• Notify the Customer of any breach of unsecured PHI without unreasonable delay and in accordance with the timeframes in the applicable BAA and 45 C.F.R. § 164.410.

PHI is not used outside the contracted service except as permitted by the BAA and applicable law. Patients seeking access to, or correction of, their own records should contact the healthcare provider that holds the record — not Med Foresight. We will forward any patient request we receive to the relevant Customer and assist that Customer in responding.

BAA requests: email info@m4sight.com with subject line “BAA Request.”

04 How we use information

We use the information described above to:

• Respond to demo requests, sales inquiries, and support questions;
• Provide, operate, maintain, secure, monitor, and improve the marketing site, the PFP product, and the browser extension;
• Authenticate users, enforce access controls, and produce audit logs;
• Generate clinical summaries and answer clinical questions from a patient's own records, on behalf of the customer practice;
• Generate aggregated, de-identified analytics about product usage, and conduct internal research to improve the quality and safety of our Services;
• Communicate with prospective and existing customers about contracts, pilots, product updates, and security advisories;
• Comply with applicable laws, enforce our agreements, and protect the rights, property, and safety of Med Foresight, our customers, and others.

05 The MedForesight Assist browser extension

MedForesight Assist is a Google Chrome extension distributed to licensed healthcare organizations under contract with Med Foresight. It is not a consumer product. The only people who sign in to it are clinicians and clinical staff authorized by a customer practice.

What it reads, and from where

The extension operates only on browser tabs whose address matches the customer's ModMed gGastro EHR — https://*.ggastrocloud.com/* and https://*.gastro.modmed.com/*. It cannot read any other website, and it holds no permission that would let it observe a user's browsing elsewhere.

While a user is signed in and viewing a supported EHR screen, the extension reads the following fields from the page that user is already authorized to view:

• Patient name
• Medical record number (MRN)
• Date of birth
• Treating provider name
• Appointment date, time, and visit type

It reads no other content from the page. The extension only ever reads the EHR: it never modifies, submits, or deletes anything in the EHR, and never takes an action in the EHR on a user's behalf.

The extension also displays — but does not itself extract — clinical summaries and answers generated by the Med Foresight platform from records the platform already holds for that practice.

When it collects

Nothing is read, stored, or transmitted until a user signs in. Before sign-in the extension is inert. After sign-in, a read is triggered either by the user pressing capture in the extension's side panel, or, where the practice has enabled it, when the user opens a supported EHR screen.

What it does not collect

The extension does not collect, and contains no code capable of collecting:

• Browsing history, or the address or content of any page outside the two EHR domains named above;
• Keystrokes, clipboard contents, screenshots, camera, microphone, or location;
• Device fingerprints, advertising identifiers, or tracking cookies;
• Financial or payment information;
• Analytics, telemetry, crash-reporting, or advertising data of any kind. There are no third-party trackers in the extension.

Data stored on the user's device

The extension stores a limited amount of data locally in the browser so it can function between sessions. Everything it persists locally is encrypted at rest with AES-GCM-256 via the Web Crypto API, under a non-extractable key held in the browser's IndexedDB. The extension does not use plain browser localStorage or sessionStorage anywhere.

Stored locally: the session token, the user's settings, a local record of MRN-to-patient-name pairs read from the EHR, any summary feedback not yet delivered, and a local audit log. The audit log records an event name and timestamp only; any identifier in an audit entry is stored as an irreversible SHA-256 hash, never in readable form. The patient roster is held in memory only and is never written to disk.

The session token is held in session-scoped storage and discarded when the browser closes, unless the user opts in to “Remember me” — in which case only the token, never the password, is mirrored to encrypted storage and expires on its own (24 hours by default).

Local data is cleared when the user signs out, when the extension is uninstalled, or when the user clears extension data through Chrome.

Permissions, and why each is required

The extension requests no broad host access (<all_urls>) and no tabs permission. All communication uses HTTPS/TLS 1.2+, under a strict Content Security Policy that permits connections only to the endpoints above and forbids inline scripts and remote code execution.

06 Chrome Web Store Limited Use disclosure

MedForesight Assist's use of information received from Google APIs, and from a user's browser, adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically:

• Data is used only to provide or improve the single, user-facing purpose described in Sections 4 and 5.
• Data is not transferred to third parties except: (a) to the sub-processors named in Section 8, acting under contract on our behalf; (b) as necessary to comply with applicable law; or (c) as part of a merger, acquisition, or sale of assets, with notice to affected customer practices.
• Data is not sold, and is not used or transferred for advertising, marketing, targeting, or for determining creditworthiness or lending eligibility.
• No human reads the data, except: with the customer practice's explicit consent for a specific support request; where necessary for security purposes such as investigating abuse; or to comply with applicable law.

07 AI & model training

We do not use customer PHI to train or fine-tune third-party foundation models. When the product invokes a foundation model, the request is processed under contractual terms prohibiting training on customer inputs and outputs.

De-identified data may be used for internal evaluation, prompt engineering, and quality assurance. Aggregated telemetry may improve the product.

08 Sharing & subprocessors

We do not sell personal information. Information is shared only with sub-processors operating our infrastructure, contractually bound to confidentiality and security obligations. These are:

Beyond those sub-processors, we share information only with:

• The customer practice — data we hold on behalf of a Customer is returned to that Customer in line with the underlying contract and BAA;
• Professional advisors — auditors and legal counsel, under confidentiality obligations;
• Legal recipients — when required by subpoena, valid legal process, or applicable law, or to protect the rights, property, and safety of Med Foresight, our customers, and the public;
• Successors in mergers, acquisitions, or asset sales.

A current list of subprocessors that may process PHI is available to Customers under their BAA.

09 Security

Med Foresight implements administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of the information we process, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256) — including on the user's own device for data the browser extension stores locally;
• Role-based access controls and least-privilege provisioning;
• Multi-factor authentication for production system access;
• Continuous logging, audit trails, and security monitoring across product surfaces touching PHI;
• Network isolation, secrets management, and dependency monitoring;
• Regular vulnerability assessment and third-party security testing;
• Background checks and HIPAA training for personnel with PHI access;
• Documented incident response and breach notification procedures.

No system is perfectly secure and no security program can guarantee absolute security. We continuously evaluate our controls and update them as the threat landscape evolves. Customers are responsible for their own access controls, credential hygiene, and the security of the endpoints through which their authorized users access the Services.

10 Retention

We retain personal information for as long as needed to fulfill the purposes described in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements.

• Marketing site contacts — retained as needed for response and follow-up, then deleted on a rolling schedule (typically 24 months) unless opted into newsletters;
• Product account data — retained during the customer contract and a defined wind-down, then deleted or returned per BAA;
• PHI — retained per customer BAA and applicable record-retention requirements. On termination of the underlying agreement, Med Foresight will, at the Customer's direction, return or destroy PHI to the extent feasible, subject to limited exceptions permitted by the HIPAA Rules and the BAA;
• Audit logs and security records — minimum six (6) years per HIPAA requirements;
• Data stored locally by the browser extension — held on the user's own device only, and cleared on sign-out, on uninstall, or when the user clears extension data through Chrome. The local audit log is capped and older entries roll off automatically.

11 Your rights

Depending on where you live, you may have rights under applicable privacy laws — including the California Consumer Privacy Act (“CCPA”) as amended, and similar U.S. state privacy laws — to:

• Access personal information we hold about you;
• Correct inaccurate or incomplete personal information;
• Delete personal information, subject to legal-retention exceptions;
• Object to or restrict processing, and withdraw consent;
• Opt out of any “sale” or “sharing” of personal information (we do not sell or share personal information for cross-context behavioral advertising);
• Receive a portable copy of personal information;
• Lodge a complaint with a supervisory authority, and be free from retaliation for exercising any of these rights.

For marketing-site or product account data, contact us at Section 17. We respond within 30 days and may need to verify your identity before responding.

For patient health records held by Med Foresight on behalf of a Customer, please direct rights requests to the Customer healthcare provider — they remain the data controller and HIPAA covered entity for those records.

12 California residents (CCPA / CPRA)

California residents have rights including:

• Right to know & access — categories, specific pieces, sources, and purposes of collected personal information;
• Right to delete — subject to exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of sale or sharing for cross-context behavioral advertising;
• Right to limit use of sensitive personal information;
• Right to non-discrimination for exercising these rights.

We do not sell personal information and do not share it for cross-context behavioral advertising, and have not done so in the preceding twelve months.

Email info@m4sight.com with subject “CCPA Request” to exercise rights. Identity verification may be required; authorized agents may submit with proof.

PHI processed under HIPAA is exempt from the CCPA; those rights flow through your healthcare provider.

13 Cookies & analytics

Our marketing site uses a small number of strictly necessary cookies to function, and may use first-party analytics to understand how the site is used. We do not use third-party advertising cookies or cross-site tracking, and no behavioral advertising or sharing with ad networks occurs. You can control cookies through your browser settings; the site remains usable without them, though disabling strictly necessary cookies may prevent parts of it from working.

The browser extension uses no cookies and no analytics.

14 International transfers

Med Foresight operates and is headquartered in the United States, and the information we process is processed in the United States. If you access the Services, or provide information, from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. Appropriate safeguards, including standard contractual clauses where applicable, are used for transfers from jurisdictions requiring them.

15 Children's privacy

The marketing site, the product, and the browser extension are intended for use by healthcare providers and their authorized personnel, not by children. They are not directed to children under 16, and no one under 18 may use the browser extension. We do not knowingly collect personal information from children. Pediatric patient PHI is processed under a Customer's BAA with the same protections as other patient data, with the Customer healthcare provider acting as controller and applying its own privacy notice and consent processes.

16 Changes to this Policy

We may update this Privacy Policy from time to time as the product, infrastructure, or legal obligations change. The “Last updated” date above reflects the most recent revision. Material changes will be communicated through this marketing site and, where relevant, through the product or to customer practices by email or in-product notice. Continued use of the Services after a change becomes effective constitutes acceptance of the updated Policy.

17 Contact us

Questions, requests, or concerns about this Privacy Policy or our privacy practices can be sent to:

Med Foresight, Inc.
Attn: Privacy Officer
PO Box 187, Issaquah, WA 98027
Email: privacy@m4sight.com
General inquiries: info@m4sight.com
Phone: +1 425 802 3823

To request a Business Associate Agreement, email info@m4sight.com with subject line “BAA Request.”