Privacy Policy

View archived versions

FabrixMed Privacy Policy

Effective Date: January 1, 2025

This Privacy Policy explains how FabrixMed Systems LLC ("FabrixMed", "we", "us", or "our") collects, uses, shares, retains, and protects information through fabrixmed.com, ConsultBridge, CareScreen, ClinixBox, HCN, APIs, dashboards, and related services.

FabrixMed operates in healthcare. Some information handled through our services may be protected health information ("PHI") under HIPAA. When we handle PHI for a covered entity or another business associate, the applicable BAA and HIPAA rules control over this Privacy Policy if there is a conflict.

1. Information We Collect

Depending on your role and the service used, we may collect:

  • Account and contact information: name, email, phone number, organization, role, login information, support communications, and preferences.
  • Provider and organization information: specialties, licenses, DEA or registration details, education, professional references, CVs, credentials, facility affiliations, availability, rates, and network participation details.
  • Patient and care information: demographics, identifiers, contact details, medical history, symptoms, screening answers, consult requests, clinical questions, notes, images, labs, diagnostic data, device readings, care context, authorizations, referrals, and follow-up information.
  • Telehealth and workflow information: appointments, video session metadata, meeting details, care team assignments, messages, notifications, attachments, audit logs, and task status.
  • Payment and billing information: transaction status, invoices, ledger information, payer or customer billing details, and payment processor references. Full card numbers are normally handled by payment processors rather than stored by FabrixMed.
  • Technical and security information: IP address, device and browser details, operating system, identifiers, log files, authentication events, usage data, error reports, cookies, and similar technologies.
  • Website and marketing information: information submitted through contact forms, newsletter or demo requests, and business development communications. Do not submit PHI through public website forms unless the form clearly says it is intended for PHI.

2. How We Use Information

We use information to:

  • provide, secure, support, and improve FabrixMed services;
  • route consults, screening records, diagnostic inputs, and care coordination tasks;
  • support virtual clinic, scheduling, video, messaging, credentialing, and network workflows;
  • help healthcare organizations document, review, and manage care operations;
  • process payments, invoices, service fees, and account administration;
  • verify identity, permissions, licenses, credentials, and eligibility;
  • monitor performance, prevent fraud, investigate abuse, and protect patient safety;
  • comply with HIPAA, contracts, subpoenas, audits, law enforcement requests, and other legal obligations;
  • communicate about accounts, services, security, support, updates, and administrative matters.

We do not sell PHI. We do not use PHI for targeted advertising. We do not train public artificial intelligence models on PHI unless expressly allowed by an applicable agreement and law, or unless the information has been de-identified under HIPAA.

3. How We Share Information

We may share information with:

  • treating providers, specialists, care teams, healthcare organizations, health plans, and authorized staff involved in the applicable workflow;
  • customers, partners, and organizations that direct or sponsor your use of the services;
  • business associates, subcontractors, vendors, and service providers who help us operate secure hosting, communications, video, analytics, support, billing, identity, device, EHR, and payment services;
  • regulators, courts, auditors, law enforcement, or other parties when required by law or needed to protect rights, safety, security, or compliance;
  • successors in a merger, acquisition, financing, restructuring, or similar transaction, subject to appropriate confidentiality and legal protections.

Patients should usually contact their healthcare provider or sponsoring organization for medical record requests, corrections, or care questions, because that organization controls the medical record.

4. Cookies and Tracking

We use cookies and similar technologies for login sessions, security, preferences, analytics, and service performance. You can control cookies through your browser, but some features may not work without them.

5. Retention and Deletion

We retain information for as long as needed to provide services, meet legal and contractual obligations, support audits, maintain security, resolve disputes, and comply with healthcare record requirements.

PHI retention and deletion are usually controlled by the covered entity, healthcare organization, BAA, order form, and applicable medical record laws. When we receive a valid deletion or return instruction from an authorized customer, we will follow it unless retention is legally required or technically necessary for backups, audit logs, security records, or dispute preservation.

Website, marketing, and support records are retained only as long as reasonably needed for the business purpose collected, unless a longer period is required by law. Backup copies may remain for a limited period until overwritten or deleted through normal backup cycles.

6. Security

We use administrative, technical, and physical safeguards designed to protect information, including access controls, encryption in transit and at rest where appropriate, audit logging, role-based permissions, vendor review, incident response, and workforce privacy training. No system is perfectly secure, so users and organizations must also protect credentials, devices, integrations, and local workflows.

7. HIPAA and Patient Rights

When HIPAA applies, rights such as access, amendment, accounting of disclosures, restriction requests, and confidential communication requests are generally handled by the covered entity responsible for your care. FabrixMed assists covered entities as required by our BAA and applicable law.

If you contact us directly about PHI, we may need to verify your identity and route the request to the appropriate healthcare organization.

8. Children and Minors

FabrixMed is not directed to children as a general consumer service. Minors may use certain services only through a parent, guardian, healthcare provider, or organization authorized under applicable law.

9. State and International Privacy Rights

Depending on where you live and the type of information involved, you may have rights to access, correct, delete, restrict, object to, or receive a copy of certain personal information. These rights may be limited for PHI, medical records, security records, legal obligations, and information controlled by a healthcare organization. To make a request, contact us using the information below.

10. Changes

We may update this Privacy Policy as our services, laws, or practices change. Material changes will be posted or communicated through reasonable channels.

11. Contact

Privacy questions: [email protected]

HIPAA and compliance questions: [email protected]

Legal questions: [email protected]