How we handle your information.

1. Who we are

MediLink Health, Inc. ("MediLink", "we", "us") operates a referral and case-management platform that connects personal injury attorneys with vetted medical clinics. This policy covers our website, marketing pages, and the MediLink application.

2. Information we collect

Information you provide

• Account details — name, work email, role, organization, and credentials
• Clinic or firm profile data — specialties, locations, licensing, coverage
• Case data submitted by attorneys and clinics through the platform
• Communications you send to us (support, sales, security disclosures)

Information we collect automatically

• Device, browser, and usage data (IP, pages viewed, timestamps)
• Cookies and similar technologies used to keep you signed in and measure performance

Protected Health Information (PHI)

When clinics and firms upload PHI to coordinate a case, MediLink processes that data as a Business Associate under HIPAA. PHI is handled under the BAA you sign at onboarding and described further in our Compliance overview.

3. How we use information

• To provide, secure, and improve the MediLink platform
• To match referrals between attorneys and clinics
• To verify provider credentials and screen for sanctions
• To send service notifications and respond to support requests
• To comply with legal obligations and enforce our Terms

We do not sell personal information, and we do not use PHI for advertising.

4. How we share information

We share information only as needed to run the service:

• With the other side of a referral — clinic information is shared with attorneys reviewing matches, and vice versa, as needed to evaluate and accept a case.
• With service providers — cloud hosting, identity, analytics, and credentialing partners that operate under contractual confidentiality and security obligations.
• For legal reasons — to comply with valid legal process or to protect the rights, safety, and property of MediLink or its users.
• In a corporate transaction — in the event of a merger, acquisition, or sale of assets, subject to continued protection of your information.

5. Data retention

We retain account and case data for as long as your organization has an active MediLink account, plus the period required to satisfy contractual, audit, and legal obligations (typically 6–7 years for healthcare records, longer where state law requires it). Data is then deleted or de-identified.

6. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to certain processing. To exercise these rights, contact privacy@medilink.vip. If you are a patient and your information was uploaded by a clinic or firm, please contact that provider first — they are the covered entity that controls your record.

7. Security

MediLink uses encryption in transit and at rest, role-based access controls, continuous monitoring, and independent SOC 2 audits. Details are available on our Compliance page. No system is perfectly secure; if you believe your account has been compromised, contact security@medilink.vip immediately.

8. International users

MediLink is operated from the United States and serves U.S. attorneys and clinics. If you access the service from outside the U.S., you understand that your information will be processed in the U.S. under U.S. law.

9. Changes to this policy

We may update this policy from time to time. Material changes will be announced through the application or by email at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.

10. Contact

Questions about this policy? Email privacy@medilink.vip.