2. Information We Collect

2.1 Information You Provide

Visitors and Newsletter Subscribers:

• Email address (when you subscribe to updates)
• Name (optional, when provided)

Patients Submitting Consultation Requests:

• Full name
• Email address and phone number
• Country of residence
• Medical information you choose to share (description of your condition, symptoms, medical history, prior diagnoses, treatments)
• Specialist or specialty you are interested in
• Any documents or images you choose to attach

Specialists with Platform Profiles:

• Full name and professional title
• Photograph
• Specialty and clinical focus areas
• Professional credentials (medical license, board certifications, education, fellowships, memberships)
• Institutional affiliation
• Location (city, country)
• Languages spoken
• Professional links (LinkedIn, website)
• Biographical information
• Articles authored or contributed to MED.COM

2.2 Information Collected Automatically

• Usage Data: Pages visited, time on site, click patterns, search queries, referring URLs
• Device Information: Browser type and version, operating system, screen resolution, IP address (used in anonymized form for analytics)
• Cookies and Similar Technologies: See Section 9

2.3 Information from Third Parties

If you authenticate using Google or another single sign-on provider, we receive basic profile information (name, email) as authorized by you.

3. Medical Information Notice

When you submit a consultation request, you may share sensitive medical information. Please understand:

• MED.COM is not a healthcare provider. We do not provide medical advice, diagnosis, or treatment. Our role is to connect you with specialists.
• We are not a Covered Entity under HIPAA. While we apply reasonable medical-information safeguards, MED.COM is not subject to HIPAA in the same way a hospital or clinical practice is. Submissions are not protected health information ("PHI") in the regulatory sense.
• Information you share will be reviewed by MED.COM Editorial staff to ensure quality and routing, and then forwarded to the specialist you selected.
• Once forwarded, the specialist's handling of your information is governed by their own privacy practices and applicable medical confidentiality laws in their jurisdiction.
• Do not include emergency information. MED.COM is not for medical emergencies. If you have a medical emergency, contact local emergency services immediately.

4. How We Use Your Information

We use information to:

• Operate, maintain, and improve the platform
• Process consultation requests and route them to specialists
• Verify specialist credentials before publishing profiles
• Send newsletters and content updates (only if you subscribe)
• Personalize your browsing experience
• Analyze usage patterns and optimize platform performance
• Detect, prevent, and address technical issues or abuse
• Comply with legal obligations

5. Legal Bases for Processing (GDPR)

If you are in the European Economic Area, United Kingdom, or another jurisdiction with comprehensive data protection laws, we process your personal data on the following legal bases:

• Consent: For newsletter subscriptions, optional cookies, and submission of medical information
• Contract Performance: To deliver services you have requested (e.g., routing a consultation request)
• Legitimate Interests: To operate the platform, maintain security, analyze usage, and improve services — balanced against your rights
• Legal Obligations: To comply with applicable laws

6. International Data Transfers

MED.COM operates globally. Our hosting infrastructure is located in the United States.

If you are accessing the platform from outside the United States, your information will be transferred to, stored, and processed in the United States, which may have different data protection laws than your country of residence.

For transfers from the European Economic Area, United Kingdom, or Switzerland, we rely on:

• Standard Contractual Clauses approved by the European Commission
• Your explicit consent where required
• Other lawful transfer mechanisms

By using MED.COM, you acknowledge this transfer.

7. Sharing and Disclosure

We share information only in the following circumstances:

With Specialists:

When you submit a consultation request, the information you provide is shared with the specific specialist you selected.

With Service Providers:

We use trusted third parties to operate the platform:

• Cloud Infrastructure Provider — Platform hosting and infrastructure (United States)
• Resend — Email delivery for newsletters and notifications
• Google Analytics — Anonymized usage analytics
• Google AdSense — Advertising delivery and measurement (United States)
• Google — Optional sign-in authentication

These providers are bound by confidentiality and data protection obligations.

For Legal Reasons:

When required by law, court order, or to protect rights, safety, or property.

Business Transfers:

If MED.COM is involved in a merger, acquisition, or sale of assets, your information may be transferred. You will be notified of any such change.

We do not sell your personal information for money. When you consent to advertising cookies, our advertising partners (including Google) may collect and use information about your visits to our article pages to serve and measure advertisements. Under some laws, such as the California CPRA, this may be considered 'sharing' for cross-context behavioral advertising. You can opt out at any time as described in Section 9 and Section 11.

8. Data Retention

We retain information for as long as necessary to fulfill the purposes described in this policy:

• Account Information: Until you request deletion
• Consultation Requests: Up to 24 months from submission, then archived or deleted
• Specialist Profiles: As long as the specialist participates on the platform; up to 12 months after departure for record-keeping
• Newsletter Subscriptions: Until you unsubscribe
• Analytics Data: Up to 26 months in anonymized form
• Backup Records: Up to 90 days after deletion from active systems

Where law requires longer retention, we comply with that requirement.

9. Cookies and Tracking Technologies

MED.COM uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the platform to function (e.g., session management). Cannot be disabled.
• Functional Cookies: Remember your preferences (e.g., language).
• Analytics Cookies: Help us understand how visitors use the platform (e.g., Google Analytics). Anonymized.

Advertising Cookies: Used by Google AdSense and its third-party vendors to serve and measure advertisements on article pages. These cookies, including Google's advertising cookie, may collect data such as the pages you view and approximate location to deliver relevant ads and limit how often you see the same ad. Advertising cookies are set only after you provide consent through our cookie banner. Where you do not consent, or where required by law, only non-personalized ads are served. You can manage or opt out of personalized advertising at any time through Google Ads Settings (adssettings.google.com) and aboutads.info.

You can control cookies through your browser settings. Disabling certain cookies may affect functionality.

10. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive data at rest
• Access controls limiting who can view personal data
• Regular security reviews of our cloud infrastructure
• Logging and monitoring of access to consultation requests

However, no method of transmission or storage is completely secure. We cannot guarantee absolute security.

11. Your Rights

Depending on your location, you may have the following rights:

For All Users:

• Access information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and data
• Opt out of promotional communications

Additional Rights for GDPR/UK Users:

• Right to data portability
• Right to restrict processing
• Right to object to processing based on legitimate interests
• Right to withdraw consent
• Right to lodge a complaint with your supervisory authority

Additional Rights for California Residents (CCPA/CPRA):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt out of the sale or sharing of personal information, including sharing for cross-context behavioral advertising. We do not sell personal information for money; you may opt out of advertising-related sharing through our cookie banner or as described in Section 9.
• Right to non-discrimination for exercising your rights
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information

To exercise any right, contact us at the address in Section 14. We will respond within the timeframes required by applicable law.

12. Children's Privacy

MED.COM is not directed to children under 16. We do not knowingly collect personal information from children under 16.

If you believe a child has provided us information, contact us and we will delete it.

If you are a parent or legal guardian using MED.COM to seek medical information for a minor, you are responsible for any information you submit.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by:

• Updating the "Last Updated" date at the top of this page
• Posting a notice on the platform homepage
• Where required, sending email notification to registered users

Your continued use of MED.COM after changes take effect constitutes acceptance.

14. Contact Us

For privacy questions, requests, or complaints, contact:

MED.COM Data Protection Officer

Email: contact@med.com

Subject line: "Privacy Request"

For GDPR-specific inquiries, please include your country of residence so we can respond appropriately.