Last Updated: August 31, 2026
UMEDEX®, Inc. (“UMEDEX,” “we,” “us,” “our,” or the “Company”) respects the privacy of individuals who access or use our websites, mobile applications, clinical applications, platforms, products, and services. We recognize the importance of protecting personal information, including health information and other sensitive information entrusted to us. This Online Privacy Policy (“Privacy Policy”) explains how UMEDEX collects, receives, uses, stores, protects, shares, retains, and deletes personal information when you access or use UMEDEX websites, applications, platforms, and services (collectively, the “Services”). This Privacy Policy is intended to apply to UMEDEX Services offered in the United States and the United Kingdom. Depending upon the Service, the individual involved, the organization receiving the Service, and UMEDEX's role in processing information, additional healthcare, privacy, contractual, or regulatory requirements may apply. Where UMEDEX processes information on behalf of a healthcare provider, hospital, health system, health plan, NHS organization, or other customer, that organization may be responsible for determining how the information is used. In those circumstances, its privacy notice, Notice of Privacy Practices, contract, or other applicable policies may also govern the information.
This Privacy Policy applies to websites and software applications maintained or developed by UMEDEX, including:
U.S. Healthcare Information
When UMEDEX processes Protected Health Information (“PHI”) on behalf of a healthcare provider, health plan, healthcare clearinghouse, or other entity subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), UMEDEX may act as a Business Associate. In such circumstances, UMEDEX processes PHI in accordance with applicable HIPAA requirements, the applicable Business Associate Agreement (“BAA”), other contractual obligations, and the permitted instructions of the applicable Covered Entity. The Covered Entity remains responsible for administering many patient rights relating to the medical record, including rights of access, amendment, and other rights provided under HIPAA. Individuals seeking access to, correction of, or other action concerning PHI maintained by UMEDEX on behalf of a Covered Entity may therefore be directed to the healthcare provider or organization responsible for the medical record.UK Healthcare Information
Where UMEDEX processes personal data on behalf of an NHS organization, healthcare provider, or other customer subject to UK data-protection law, UMEDEX may act as a data processor and the healthcare organization may act as the data controller. In those circumstances, UMEDEX processes personal data according to the controller's documented instructions, applicable data-processing agreements, the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and other applicable legal requirements. Where UMEDEX independently determines the purposes and means of processing particular personal data, UMEDEX may act as the controller for that processing. The applicable role depends upon the particular Service and processing activity.The information UMEDEX collects depends upon the Service you use, the functions you access, the permissions you provide, your relationship with UMEDEX, and whether UMEDEX is processing information directly or on behalf of another organization.
Information you provide may include:
For healthcare professionals, information may also include:
Certain Services may process health or medical information, which may include:
Health information may constitute PHI under HIPAA, special-category data under UK GDPR, consumer health data under certain U.S. state laws, or another category of legally protected information.
UMEDEX may receive personal information from authorized third parties where necessary to provide the Services. These sources may include:
Information received from healthcare organizations may be subject to contractual, statutory, healthcare, or regulatory restrictions in addition to this Privacy Policy.
When you use UMEDEX websites or applications, certain technical information may be collected automatically, including:
UMEDEX uses administrative, physical, organizational, and technical safeguards designed to protect personal and sensitive information from unauthorized access, disclosure, alteration, destruction, loss, or misuse. Depending upon the Service and type of information involved, safeguards may include:
Access to personal and sensitive information is restricted to authorized personnel, service providers, healthcare professionals, customers, or systems with a legitimate need for access. No electronic transmission, network, software platform, or storage system can be guaranteed to be completely secure. Users are responsible for protecting usernames, passwords, authentication credentials, and devices used to access UMEDEX Services.
UMEDEX may use information as necessary to:
Where permitted, UMEDEX may use anonymized, aggregated, or appropriately de-identified information for analytics, operational improvement, research, service development, quality improvement, and other lawful purposes. UMEDEX may use automated technologies, intelligent software functions, analytical tools, or similar technologies in connection with certain Services to support functionality, operational workflows, analysis, or service improvement. The nature and extent of such processing depend upon the particular Service. Where applicable law requires disclosure, permission, or another legal basis for the processing of personal or sensitive information through such functionality, UMEDEX will implement appropriate measures. UMEDEX does not represent that automated functionality replaces professional medical judgment, where professional judgment is required.
Where UK GDPR applies and UMEDEX acts as a controller, UMEDEX processes personal data only where an appropriate lawful basis exists. Depending upon the processing activity, UMEDEX may rely upon one or more of the following:
Health information and other special-category personal data receive additional protection under UK law. Where UMEDEX acts as controller of special-category data, UMEDEX will identify an applicable condition permitting such processing under UK data-protection law in addition to an applicable lawful basis. Where UMEDEX acts solely as processor, the applicable healthcare organization or other controller generally determines the lawful basis for processing.
UMEDEX systems may maintain application, server, network, authentication, operational, audit, and security logs. Logs may be used to:
UMEDEX may use cookies, pixels, software development kits (“SDKs”), log files, and similar technologies to support authentication, security, analytics, application functionality, performance monitoring, troubleshooting, and operation of the Services. These technologies may help UMEDEX:
Where required by applicable law, UMEDEX will provide appropriate notice and obtain consent before using non-essential cookies or similar technologies. Users may be able to control cookies through browser or device settings. Disabling certain technologies may affect application or website functionality. UMEDEX does not sell personal or sensitive user information. Where applicable, UMEDEX does not share personal information for cross-context behavioral advertising. UMEDEX does not sell consumer health data.
Certain UMEDEX applications, including U-InTouch, may offer functionality that uses location information. Depending upon the feature and permissions selected by the user, UMEDEX may process approximate or precise location information provided by the user's device. Location may be used for functions such as:
UMEDEX accesses location information only to the extent permitted by the user's device, application permissions, applicable organizational configuration, and applicable law. Users can control location permissions through their device settings. Certain features may not operate correctly if location permission is disabled.
UMEDEX does not sell personal information. UMEDEX may disclose or provide access to personal information only where reasonably necessary for legitimate purposes, including providing Services, complying with instructions from an authorized user or customer, meeting legal obligations, or protecting users and systems. Information may be shared with the following categories of recipients where applicable:
Service providers are permitted to process personal information only as necessary to provide contracted services or as otherwise permitted by applicable law and contractual requirements. Where appropriate, UMEDEX requires service providers receiving personal or sensitive information to implement privacy and security protections appropriate to the information involved. UMEDEX may also share information:
Certain UMEDEX Services may offer functionality involving location or device movement information where supported by the user's device and expressly permitted by the user. Where a feature enables location sharing, users may be able to share location information with selected contacts, healthcare professionals, authorized organizations, or other designated recipients. Users may modify applicable permissions through the application or device operating-system settings. Certain emergency or safety functions intentionally activated by a user may transmit the user's current or available location to designated contacts or recipients necessary to perform the requested function. UMEDEX will request device permissions where required before accessing sensitive device information.
UMEDEX may disclose information where required or permitted by applicable law, including in response to a legally valid:
UMEDEX may also use or disclose information where reasonably necessary to:
Where legally permitted and appropriate, UMEDEX evaluates requests for information to determine whether they are valid and appropriately scoped.
UMEDEX's general consumer Services are not directed to children under 13 in the United States or to children below the applicable age at which they may independently consent to relevant data processing in another jurisdiction. Certain healthcare Services may process information concerning minors when authorized by:
Where information regarding a minor is processed on behalf of a healthcare organization, the healthcare organization's privacy practices and applicable healthcare laws may govern the information. If UMEDEX learns that personal information has been collected directly from a child contrary to applicable legal requirements, UMEDEX will take appropriate action.
UMEDEX may disclose or transfer information as part of an actual or proposed:
Any recipient of personal information will be required to process that information in accordance with applicable privacy and healthcare laws and applicable contractual obligations. Where required by law, affected individuals will be provided with appropriate notice or choices concerning materially different processing.
UMEDEX operates and supports Services across multiple jurisdictions. Personal information may therefore be processed in a country different from the country in which the individual is located. Where UK personal data is transferred outside the United Kingdom in circumstances governed by UK GDPR, UMEDEX will use an appropriate transfer mechanism or safeguard where required by law. Depending upon the circumstances, these safeguards may include:
Additional contractual or customer-specific geographic restrictions may apply to healthcare information. UMEDEX will comply with applicable contractual data-residency requirements established for particular Services.
UMEDEX may analyze technical, transactional, operational, system, and usage information to:
Where information is anonymized, aggregated, or de-identified, UMEDEX may use that information for lawful analytics, research, quality improvement, operational improvement, and service development. Where required by law or contract, appropriate safeguards will be applied to such
UMEDEX retains personal information only for as long as reasonably necessary for the purposes for which it was collected or received, subject to applicable legal, regulatory, contractual, operational, healthcare, security, and professional requirements. Retention periods vary depending upon:
Account and profile information is generally retained while the account remains active and thereafter only for the period reasonably necessary to complete deletion, meet applicable obligations, prevent fraud, maintain security, resolve disputes, or enforce agreements. Technical, audit, and security information may be retained for periods reasonably necessary for cybersecurity, auditing, troubleshooting, investigation, regulatory compliance, and operation of the Services. Healthcare information may be subject to retention requirements established by healthcare providers, NHS organizations, federal or state law, professional requirements, contractual obligations, or other applicable healthcare regulations. When UMEDEX processes healthcare information as a processor or Business Associate, the applicable healthcare organization may determine the required retention period. Subject to applicable legal requirements, information deleted from active systems may remain temporarily within encrypted or otherwise protected backup systems until those backups are overwritten, expire, or are securely deleted pursuant to applicable backup-retention procedures. Information retained following a deletion request will be restricted to purposes for which retention remains lawful or required and will subsequently be deleted, anonymized, de-identified, or securely disposed of when the applicable retention requirement ends.
UMEDEX users may request deletion of an UMEDEX account and personal information associated with that account, subject to applicable legal and regulatory retention requirements. Account deletion is different from temporarily disabling, suspending, or deactivating an account. Where a UMEDEX mobile application permits users to create accounts, users will be provided with a mechanism to initiate account deletion through the application. Where supported, this may be available through:
Settings → Account → Delete AccountUsers may also initiate an account-deletion request through UMEDEX's online account-deletion facility: https://www.umedex.com/account-deletion.php
UMEDEX may require reasonable authentication or identity verification before completing a deletion request to prevent unauthorized or fraudulent deletion. Following verification, UMEDEX will delete, anonymize, or de-identify personal information associated with the account unless retention is required or permitted for a lawful purpose. Information may need to be retained for purposes including:
Deletion of an individual's UMEDEX account does not necessarily authorize UMEDEX to delete an official patient medical record maintained on behalf of a healthcare organization. Medical records and other healthcare information may be subject to independent legal, regulatory, professional, or contractual retention requirements. If UMEDEX processes the applicable information on behalf of a healthcare organization, the individual may need to contact that healthcare organization to exercise rights concerning the medical record. Where UMEDEX can lawfully delete requested information, deletion will be completed within the period required by applicable law and consistent with the technical processes necessary to securely remove the information. UMEDEX will inform the requesting user where additional verification is required or where information cannot be deleted because UMEDEX or the applicable healthcare organization is required to retain it. Where third-party authentication services are used, UMEDEX may revoke or terminate applicable authentication credentials or authorizations associated with the deleted UMEDEX account where required and technically applicable. Deleting an UMEDEX account does not automatically cancel subscriptions or contractual obligations administered separately by Apple, Google, a healthcare organization, or another third party.
Depending upon your location, the Service involved, UMEDEX's role in processing your information, and applicable law, you may have rights concerning your personal information. These may include the right to:
These rights are not absolute and may be subject to exceptions provided by applicable law. Where UMEDEX acts as a processor or Business Associate on behalf of a healthcare organization, UMEDEX may refer a privacy-rights request to the applicable healthcare organization. To exercise applicable rights relating to information controlled directly by UMEDEX, contact: privacy@umedex.com UMEDEX may request information reasonably necessary to verify your identity before completing a privacy-rights request. An authorized representative may submit requests where permitted by applicable law and subject to appropriate verification.
Residents of certain U.S. states may have additional rights under applicable state privacy laws. Where applicable, these may include rights to know, access, correct, delete, obtain a portable copy of personal information, opt out of certain sales or sharing, limit certain processing of sensitive personal information, or appeal certain decisions regarding privacy requests. UMEDEX does not sell personal information. Where applicable, UMEDEX does not share personal information for cross-context behavioral advertising. UMEDEX does not discriminate against individuals for exercising privacy rights provided by applicable law. Certain information, including PHI regulated by HIPAA or information maintained by healthcare organizations, may be exempt from some state consumer privacy laws or may be governed by separate requirements.
Certain personal information that relates to an individual's physical or mental health may constitute “consumer health data” under applicable U.S. state laws even when the information is not regulated as PHI under HIPAA. Where such laws apply, UMEDEX will process consumer health data in accordance with applicable requirements. UMEDEX does not sell consumer health data. UMEDEX will not use consumer health data for purposes materially incompatible with the purposes disclosed to the individual except where permitted by law and, where required, with appropriate authorization or consent. Consumer health data may be shared with healthcare providers, service providers, authorized recipients, or other parties only where necessary to provide requested Services, where directed by the individual, where authorized by applicable law, or where otherwise appropriately disclosed. Individuals may contact privacy@umedex.com regarding rights relating to consumer health data.
Where UK GDPR applies and UMEDEX acts as controller, individuals may have rights including:
The availability of a particular right depends upon the lawful basis for processing and other circumstances provided under UK law. Where UMEDEX relies upon consent, an individual may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn. Where UMEDEX relies upon legitimate interests, individuals may have a right to object to that processing.
Where personal information is processed for direct marketing, individuals may object to such processing. Individuals may submit UK privacy-rights requests to: privacy@umedex.comWhere UMEDEX acts solely as processor for an NHS organization, healthcare provider, or other controller, the request may need to be handled by that organization. Individuals in the United Kingdom also have the right to lodge a complaint with the UK Information Commissioner's Office (“ICO”) where they believe their personal data has been processed in violation of applicable UK data-protection law.
UMEDEX may send communications concerning:r
Where permitted by applicable law, UMEDEX may also send marketing or promotional communications. Users may withdraw consent to optional marketing communications using available unsubscribe mechanisms or applicable account preferences. Withdrawal from marketing communications does not prevent UMEDEX from sending communications reasonably necessary to administer an account, maintain security, provide requested Services, comply with law, or complete a transaction. Users may also modify optional device permissions, including location, camera, microphone, motion, notifications, or similar permissions, through the applicable application or device settings. Disabling permissions may affect functionality that depends upon those permissions.
UMEDEX may update this Privacy Policy periodically to reflect changes in:
The “Last Updated” date at the beginning of this Privacy Policy identifies when this Privacy Policy was most recently revised. Where changes are material, UMEDEX will provide notice through appropriate means, which may include the applicable website, application, account notification, email, or other reasonable communication. Where applicable law requires consent to a materially different use of personal information, continued use of the Services will not substitute for such consent.
Questions, concerns, complaints, privacy-rights requests, or requests concerning account deletion may be directed to:
2655 First St, Suite 250
Simi Valley, CA 93065
USA
