Privacy & Health Data Notice (Pilot)
This notice explains in plain language how the Medx patient portal handles accounts, source medical records and DICOM, AI output, physician consultations, Case Manager coordination and clinical-trial matching. Health, genetic and some imaging data are sensitive personal information.
Draft date: 2026-09-17 · Version: 2026-09-17-pilot.13
Responsible entity and scope
This pilot uses “Noah Medical Link / Medx” as the product name. The controller/operator’s full legal name, registration number, registered and contact addresses, privacy lead and telephone number remain pending. A brand name is not a substitute for these details, which must be completed before production.
This notice covers patient registration, electronic records, source files, AI analysis and timelines, physician matching and remote consultation, Case Manager coordination and optional clinical-trial matching. External physicians, hospitals, public registries and third-party sites have their own privacy terms.
Information processed and its sources
- Account and identity: name or preferred name, email or mobile number, password hash, account status, registration time, secure session and consent versions;
- Health and source material: history, symptoms, examinations, laboratory, prescriptions, genetic, pathology, imaging reports, original DICOM, patient questions and free-text descriptions;
- Organized and generated material: browser-extracted/OCR text, structured records, timelines, condition summaries, treatment leads, physician and trial matches, physician Final Reports and human notes;
- Coordination records: case status, physician assignment, written/video type, proposed times, meeting link, consultation status, quality-control checklist, authorization and withdrawal records;
- File and security metadata: filename, type, size, SHA-256, upload time, IP/request time, browser information, and necessary error, abuse-prevention and key-action audit records;
- Sources include you, an authorized representative/staff member/physician, and public physician, hospital and clinical-trial registries. Indirectly obtained data should be used only for the stated purpose and within applicable access rights.
Purposes, required data and separate consent
Core purposes are to create and protect an account, store and organize submitted records, display a timeline, perform requested analysis or consultation, coordinate service, answer support requests, troubleshoot, prevent abuse and meet applicable obligations. Refusing information required for a core feature may prevent that feature; physician sharing, trial matching, remote imaging and international coordination should remain separately optional.
Health information is sensitive. Accepting this notice at registration does not replace any legally required separate consent. AI analysis, automatic timeline creation, ongoing sharing with a named physician, trial matching, disclosure to a study site or overseas recipient should each be explained and supported by verifiable authorization where required.
Depending on the jurisdiction and purpose, the basis may involve consent, contract, healthcare, legal obligation or legitimate interests. Each purpose must be assessed before production; mentioning a law in this notice does not mean Medx automatically complies with it.
Uploads, browser OCR and the automatic timeline
PDF and Word (.docx) text extraction and Chinese/English OCR for scanned PDFs and JPG/PNG images currently run mainly in the browser. Medx serves the OCR worker, runtime core and language models from the same origin, so the file does not need to be sent to an external OCR website. Extracted text and the source file are sent to the Medx server only after the user confirms saving. If external OCR is introduced, the recipient, scope and authorization must be updated before transmission.
In the current pilot, saving each record sends its title and body to the configured language model to extract dates and generate a one-sentence timeline summary. An internal care case is also created on upload. This automatic AI step is currently linked to “save record”; production should add a clear separate choice or a local rule-based path that does not call an external model.
An upload session that is not attached to a record normally expires after 24 hours. Final physical deletion still depends on a background cleanup job and configured grace period; the production notice must publish a verifiable maximum cleanup period.
AI and automated processing
General analysis may send record text, age, sex, the patient’s question and imaging-analysis output to the configured model. Timeline generation sends a record title and body. Trial-criteria extraction uses current account records, the latest analysis report, summaries and selected excerpts. These functions organize, summarize and produce discussion or matching leads; they do not make a diagnosis, prescription, enrollment decision or other final decision with significant effects.
Models can omit facts, hallucinate or reflect bias. You may ask a physician or staff member for human review and challenge a result. Medx should not rely solely on automation to deny service, set differential prices or make significant medical decisions.
Medx itself does not use patient material to train a general-purpose model, for marketing or for research unless a future use is separately explained and lawfully authorized. Whether an external model retains input, uses it for service improvement or invokes subprocessors must be verified against the actual contract and console settings; this draft does not promise that a vendor never retains or trains on data.
Source files, DICOM and imaging analysis
Imaging reports are treated as ordinary documents. Original DICOM may contain names, dates of birth, accession numbers, hospitals and device details in addition to pixels. ZIP uploads are repackaged so that only parse-valid, byte-unchanged DICOM instances are retained; the original ZIP container and non-DICOM entries are discarded. The DICOM Viewer reads source instances from a private imaging area after server-side authorization.
A record-library upload currently causes server-side metadata parsing and archival but does not automatically send pixels to a remote imaging model. If a remote imaging service is configured and enabled during AI analysis, the complete imaging file may be transmitted to it. De-identification assessment, recipient disclosure and any required separate authorization must be completed before production use.
Source documents and imaging are retained to trace OCR, structured records and reports back to their evidence. Viewing, downloading, sharing and deletion should be limited by ownership, consultation authorization and staff roles.
Physicians, Case Managers, consultations and quality control
Uploading a record currently creates a care case. For intake and quality control, authorized Case Managers can see a patient’s name, record count and AI/consultation status in an unassigned queue; after assignment they may process records, notes, physician matching and quality checks within their duties. Production should assess replacing pre-assignment names with anonymous case references and minimum metadata.
Written or video consultation processes the patient question, shared records, AI draft, physician selection, proposed times, meeting link, acceptance/rejection state and physician Final Report. A patient may choose a physician directly or request Case Manager matching only. A Case Manager proposal creates no consultation, record grant or physician access. The formal consultation and sharing scope are created only after the patient reconfirms the proposed physician, consultation format and records to share. A patient may ask the Case Manager to revoke subsequent sharing for an active consultation; physician access ends when the Case Manager executes that revocation. This notice cannot substitute for proof of authorization.
The current WebRTC device-check page tests the camera, microphone and peer-to-peer connection inside the browser; it does not upload or record audio or video. A real video provider will require a new disclosure of media routing, recipients, recording status and retention.
The system audits source downloads, sharing, authorization and some sensitive views/staff actions; it does not yet log every list view. Production must improve coverage and must not claim that every access is already logged.
Optional clinical-trial matching
Trial matching is off by default and runs only after patient activation. The current pilot processes all current records in the account (up to 500) and the latest analysis report, rather than only manually selected records, to derive condition, stage, treatment and biomarker criteria. Obvious direct identifiers are removed by rules, but that is not equivalent to anonymization.
The current live API search connects to ClinicalTrials.gov and sends only condition search terms and the selected geography. Age, sex, stage, biomarkers and treatment history are mainly used for Medx’s internal filtering and ranking. China CDE/NMPA and ChiCTR are currently manual-verification links, not automated full-database searches.
Medx stores the consent version/time, related records, criteria snapshot, candidate studies, public PI/site data, recruitment status, match reasons, patient notes and Case Manager workflow state. Contacting a Case Manager places the patient’s name, chosen study and note in an internal intake queue, but does not automatically send records to a study site. Any later external disclosure must be explained and authorized again.
Providers, storage locations and international transfers
Medx uses a controlled database and private object storage appropriate to the deployment environment for accounts, extracted text, structured records, reports, consultations, trial matching, audit data, source documents and imaging. Before live service, the regions, encryption, retention and access settings of the database, object storage and language-model service must be verified against the actual cloud environment, console settings and contracts, then disclosed here as verified information.
The production notice must maintain a current processor/recipient list for cloud database, object storage, language model, email/SMS, real video, imaging and security providers, identifying their name, role, data, purpose, location, retention settings and contact details. Medx does not sell health material or use it for unrelated advertising except if a future practice is specifically disclosed and lawfully authorized.
Sending identifiable records to an overseas physician, hospital, model, video or imaging service may be an international transfer. Before activation, Medx should identify the overseas recipient, country, purpose, method, data categories, period and rights channel, and complete applicable impact assessment, separate consent and security assessment, standard clauses, certification or another lawful mechanism.
Whether GDPR, French HDS, HIPAA or another framework applies depends on the user, operator, service targeting, healthcare relationship and contractual role. This page does not claim certification. If Medx processes PHI for a US HIPAA-regulated entity, an applicable BAA and corresponding controls would also be required.
CAC rules on cross-border data flows ↗
Cookies and browser storage
Sign-in uses an essential HttpOnly session cookie. The patient cookie can remain for up to 30 days, while the server session expires after 24 hours of inactivity. It is configured SameSite=Lax and Secure on production HTTPS.
localStorage currently stores only the language preference. The current version does not save or read complete AI analysis results in localStorage or sessionStorage; reports must be retrieved through the server API for the patient who is currently signed in. The app still removes analysis caches that may remain from an older version after successful sign-in, registration or sign-out, or when it detects no active session. If sign-out fails, it warns that the session may still be active. On a shared device, confirm that sign-out succeeded and close the tab when finished.
The current code has no advertising or behavioral-profiling analytics script. Before adding non-essential cookies, monitoring or marketing technology, Medx should update this notice and provide equally easy accept, reject and withdrawal controls where required.
Retention, archival and deletion
While an account is active, the pilot retains source files the user confirmed for archival, extracted text, structured records, timelines, AI reports, consultations and trial records. Temporary uploads normally expire after 24 hours; security logs, audits, database backups and object cleanup may follow different cycles. Production must publish a specific period or computable rule for every category.
After a deletion request or withdrawal, future processing and future sharing should stop. Material already lawfully processed, used to form a physician opinion, required for dispute/security audit, or still rotating through backups may be restricted and deleted later. Medx cannot promise immediate deletion from every backup.
Security measures and incident response
Current design measures include password hashing, server-side sessions, private object storage, role and ownership checks, least privilege, file-integrity hashes, configured transport encryption and audit of key actions. The production template requires HTTPS, RDS TLS and private OSS; database encryption at rest, key management, backup recovery, vendor settings and staff controls still require verification in the deployed environment.
No system is absolutely secure. If information is leaked, altered, lost or accessed without authorization, Medx should contain and investigate the event, preserve evidence, and notify regulators and affected people as required, including the categories involved, likely risk, mitigation and contact channel.
Your rights and how to make a request
Subject to applicable law, you may request information, access, a copy or export, correction, supplementation, deletion, restriction or objection; withdraw future-facing consent; close the account; obtain an explanation of automation; request human review; and complain to a regulator. Withdrawal does not invalidate earlier lawful processing and may make a feature unavailable.
The pilot does not yet provide complete self-service export, deletion and authorization-withdrawal controls. For now, email support@noahmedx.com with “Privacy request”; identity must be verified first. This is also the general support address. Before production, Medx must verify it, publish a dedicated privacy lead, response period, appeal route and applicable regulatory complaint channels.
Minors, representatives and policy changes
In China, information about a child under 14 is sensitive and requires guardian consent and a dedicated rule; other jurisdictions use different thresholds. The pilot does not yet verify age, guardianship or child-specific authorization, so minors must not register independently or upload real records. A representative must have lawful authority before submitting another person’s material.
If purposes, methods, data categories, providers, locations, periods or rights channels materially change, Medx will update the version/date, give prominent notice and renew consent where required. Enforcement that existing users have accepted the latest version is not yet implemented.
Pending items must be verified by product, security and qualified counsel for each service region. A general website privacy page does not replace provider notices, research informed consent, a separate international-transfer notice or a HIPAA Notice of Privacy Practices where one is required.
French CNIL: informing people about health-data processing ↗