Patient Portal Privacy Notice

MedRegis Patient Portal — Privacy Notice

DRAFT v0.5 — not for publication — for review only

About this notice

The MedRegis Patient Portal (the "Portal") is provided by MedRegis Inc. ("MedRegis", "we", "us", "our"). This notice explains what we do with information about you when you use the Portal, and what rights you have. It is written for you, the patient.

This notice covers the Portal. It does not cover your medical records. Those are held by the clinic or clinics that treat you. Your clinic decides what goes into your record, what is shared with you, and how long it is kept. Section 10 explains where to take a question about your records.

This notice is separate from the agreement between MedRegis and your clinic, and does not form part of it.

1. Two different things happen in the Portal

Some of the information in the Portal is ours to look after. Most of what you see in it belongs to your clinic. The difference matters, because it decides who you ask when you want something done.

Information we hold in our own right

When you create a Portal account, we collect and hold:

your name and contact details

your login credentials

your National ID number

your Portal connection code

a record of your sign-ins to the Portal

the record of which clinics you are connected to

the record of profile shares you have made

Under data protection law we are responsible for the information above, we decide how it is handled, and you can ask us about it directly.

Information we handle on your clinic's instructions

Everything you see in the Portal that comes out of your clinic's record — your date of birth, appointments and clinician names, vitals, laboratory and imaging results, allergies, family history, procedures, vaccinations, diagnoses, medications and prescriptions, and any consultation notes, summaries, documents, forms or post-visit instructions your clinic chooses to share with you — is your clinic's record. We display it because your clinic uses our system to keep that record. The same applies to information you submit through the Portal once it reaches your clinic's system.

Your clinic decides what is recorded, what is shared with you, and how long it is kept. We do not decide any of that. We do not sell your information, and we do not use your clinic's records to make decisions about you.

We may use the records held in the Service to produce population-level statistics — figures about health trends across large numbers of patients, combined in a way that cannot be traced back to you and does not identify your clinic.

2. Your National ID

We ask for your National ID number when you create your Portal account.

We use it for one purpose. When a clinic enters your connection code, the number is checked against the identity details already held in that clinic's record, so that the right record is connected to the right person. We do not use it for anything else, and we do not disclose it to anyone except for that check. It is held in encrypted storage.

If your National ID is wrong, you can correct it yourself in your Portal account at any time before a clinic connects to you. Once a clinic has connected, the number can no longer be changed in the Portal, because it is what matches your Portal account to that clinic's record.

If it needs correcting after that, contact us at privacy@medregis.com. We will correct it once we have confirmed who you are, and you should ask your clinic to correct its own record as well so that the two match.

[FLAG — process not yet designed] The post-connection correction route is the case Portal handoff §6 item 10 covers, and it is still undesigned: proof required, who approves, how the change is logged, and whether the clinic side is corrected in the same step. Publishing this paragraph commits us to a route that has to work. The pre-connection half needs nothing — the patient does it themselves.

3. Connecting to a clinic

Your Portal shows you a connection code. You give that code to your clinic, and the clinic enters it. The code is checked against the identity details in the clinic's own record, so two things have to match before a connection is made. Your code changes each time it is used, so a code that has already been used cannot be used again.

You can be connected to more than one clinic. Each clinic sees only its own connection to you. No clinic can see which other clinics you are connected to, unless you choose to share your profile with a clinician — see section 4. We hold the overall record of your connections, and we do not disclose it to your clinics.

4. Sharing your profile with another clinician

You can share your profile with a clinician at another clinic that uses MedRegisEHR. The share is to that named clinician, not to the clinic as a whole — only the clinician you send it to can view it. It is read-only, it lasts for a period you choose, and you can end it at any time.

A clinician you share with can see which clinic each part of the information came from. If you would rather a clinician did not know that you attend a particular clinic, take that into account before you share.

Be clear about what ending a share does. It stops further access from that point onwards. It does not undo access that has already happened: anything the clinician has already read, written down, or copied into their own records stays with them, and we cannot retrieve it. Share deliberately, and end a share when you no longer need it.

The record of the shares you have made stays in your Portal after a share has ended, so that you can see who you shared with and when. That record is visible to you only. It is removed if you close your Portal account.

5. What we send you by email

We send you emails to let you know when there is something new in the Portal. Those notifications do not contain clinical information, with one exception: where your clinic sends you post-visit instructions, the instructions appear in the body of the email itself.

Email is not a secure channel, and a message sits in an inbox we do not control. Keep your email account secure, do not share access to it, and tell your clinic promptly if your email address changes or if you think someone else has gained access to it.

[FLAG — describes today, changes on ship] When the conditional post-visit-instructions change ships (Portal handoff §6, item 5), this section is replaced with a shorter one: notifications contain no clinical information where you have a Portal account.

6. Information about other people

Your clinic's record, as shown to you in the Portal, may include health information about your relatives where family history has been recorded, and it shows the names of the clinicians involved in your care. That information is part of your clinic's record and is shown to you on your clinic's instructions.

7. Where your information is held

The Portal runs on cloud infrastructure located in the United States, and information in it is processed and stored there. We engage each of our providers under written data protection terms, and we apply the protections described in section 8 wherever the information is held. The providers we use for the Service are listed in the MedRegis Privacy Policy and the Data Processing Addendum at medregis.com.

8. Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:

unique login credentials for each Portal account

encryption of information in transit and at rest

access controls that limit our personnel to what their role requires

a record of sign-ins to each Portal account

Your password is yours alone. Do not share it, and do not let anyone else use your account. If you think someone else has used your account, tell us at privacy@medregis.com. No method of transmission or storage is entirely secure, but we work to protect your information and to respond promptly to security events.

9. Why we are permitted to hold this information

We rely on the lawful bases available under the Data Protection Act, 2019-29 of Barbados (the "Act"), including the performance of our agreement with you when you create and use a Portal account, our legitimate interests in keeping the Portal secure and preventing misuse, and compliance with our legal obligations. Where your clinic's records are displayed to you, your clinic is the controller of those records and relies on its own lawful basis.

[FLAG — counsel-gated] The National ID, the record of which clinics you are connected to, and the record of shares you have made are the sensitive element of this processing (both records reveal that an identifiable person is a patient of, or has sought care from, a named clinic). The specific condition relied on for that element is on the counsel list at DPA 3.4 priority and is deliberately not asserted here. If counsel advises that explicit consent is required, a consent step is needed in the signup flow and a sentence is added to this section — a flow change as well as a wording change.

10. Asking for something to be done

About your medical records — ask your clinic.

Access to your medical records, correction of something recorded in them, or deletion of anything in them, is a matter for the clinic that holds them. Contact the clinic directly. We will support your clinic in responding, but we cannot change a clinic's record and we will not do so without the clinic's instruction.

About your Portal account — ask us.

Your Portal account is ours to answer for. Contact us at privacy@medregis.com to get a copy of your account information, to correct it, or to see your sign-in history. We will not send you back to your clinic for any of these.

Disconnecting from a clinic and closing your account are done by you, in your Portal — see section 11.

11. Disconnecting from a clinic, and closing your account

You can do both yourself, from within your Portal.

Disconnecting from a clinic removes that clinic's link to your Portal, so its records stop being displayed to you. The clinic will see that the connection has ended. Disconnecting does not remove or change the records that clinic holds about you, which remain the clinic's.

Closing your Portal account removes the account, its connections, and the record of the shares you have made. Your medical records are not affected: each clinic keeps its own record of your care, and your clinic remains responsible for it. Section 12 explains what happens to the record of your sign-ins.

[FLAG — confirm shipped] This section describes self-service disconnect and deletion (Portal handoff §6, items 6 and 7), which are in build and expected live before publication. Confirm both are in production on the day of publication, not on the day they were promised.

12. How long we keep your information

We keep your Portal account information for as long as you have a Portal account.

When you close your account, we remove the account, its connections, and the record of the shares you have made.

We keep the record of sign-ins to the Portal, but we remove the link between those records and you, so that they no longer show whose sign-ins they were. The internet address a sign-in came from is kept for a further fourteen months, so that we can investigate misuse of the Portal, and is then removed.

[FLAG — confirm shipped] The fourteen-month rule is being built and is expected to be live before this notice is published. Confirm it is in production on the day of publication, not on the day it was promised.

13. Your rights

Subject to the Act, you have the right to ask for access to your personal data, to ask for it to be corrected or erased, to restrict or object to certain processing, and to data portability. To exercise these rights over your Portal account, contact us at privacy@medregis.com. For your medical records, contact the clinic that holds them, as explained in section 10.

You also have the right to complain to the Data Protection Commissioner of Barbados or, if you are outside Barbados, to the data protection authority with jurisdiction over you.

14. Changes to this notice

We may update this notice. When it changes, we will show you the current version and ask you to agree again. We keep a record of which version you agreed to and when.

15. Contact

For any privacy question about the Portal, or to exercise your rights over your Portal account, contact our Data Protection Officer at privacy@medregis.com.

Patient Portal Privacy Notice — Draft v0.5 — 26 August 2026 — not published