Privacy & Data Protection

Scope of This Policy

This Privacy Policy applies to information processed through MedAtlas Learning Minds websites, applications, accounts, educational products, artificial intelligence systems, simulations, support services, and other MedAtlas-operated digital services that reference this Policy.

Certain institutional, enterprise, research, or clinical deployments may be governed by additional agreements, notices, informed-consent documents, business associate agreements, data use agreements, or other terms. Where applicable, those documents may establish additional or different obligations.

Information We Collect

INFORMATION YOU PROVIDE

Depending on the service used, information provided directly to MedAtlas may include:

• Name, email address, username, profile information, professional role, or other account information.
• Communications, support requests, feedback, correspondence, and information submitted through forms.
• Educational prompts, responses, quiz activity, simulation interactions, saved materials, preferences, and other content submitted to MedAtlas systems.
• Transaction or subscription-related information. Payment information may be processed by third-party payment providers rather than stored directly by MedAtlas.

INFORMATION COLLECTED AUTOMATICALLY

When you use MedAtlas services, certain technical information may be collected automatically, including:

• IP address and approximate network location.
• Browser, operating system, device, and application information.
• Pages or features accessed and general usage events.
• Authentication, security, diagnostic, performance, and error logs.
• Cookies, local storage, session identifiers, or similar technologies used to operate and secure services.

How We Use Information

Information may be used for legitimate operational, educational, security, administrative, and service purposes, including to:

• Create, authenticate, and administer user accounts.
• Provide MedAtlas educational, simulation, AI, assessment, and related services.
• Respond to support requests and communications.
• Maintain service availability and functionality.
• Detect, investigate, and prevent fraud, abuse, unauthorized access, security threats, and misuse.
• Diagnose technical problems and improve system performance.
• Develop and improve MedAtlas products and educational experiences, subject to applicable law and contractual restrictions.
• Comply with legal obligations and enforce applicable agreements and policies.

Health Information, PHI & HIPAA

The Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”) regulate certain protected health information maintained or transmitted by covered entities and their business associates.

The fact that information concerns health or medicine does not, by itself, make that information Protected Health Information (“PHI”) under HIPAA. HIPAA status depends in part on the entity involved, the relationship under which information is processed, and the nature and context of that information.

HIPAA-REGULATED DEPLOYMENTS

If MedAtlas provides a service on behalf of a HIPAA covered entity in circumstances in which MedAtlas is acting as a business associate, the applicable service may be subject to separate contractual, privacy, security, and operational requirements, including an appropriate Business Associate Agreement (“BAA”) where required.

A general MedAtlas account, educational subscription, website interaction, or use of an educational AI feature does not by itself establish a business associate relationship or authorize the transmission of PHI.

DE-IDENTIFICATION

Healthcare professionals and learners using MedAtlas for educational discussion should remove patient identifiers and use appropriately de-identified or fictionalized information whenever possible. Users remain responsible for complying with their professional, institutional, contractual, privacy, and legal obligations when submitting information to MedAtlas.

Clinical & Educational Use

MedAtlas provides educational, academic, simulation, informational, and professional-support technologies. Unless a particular service expressly states otherwise under separate terms, MedAtlas is not intended to serve as an electronic health record, designated record set, emergency service, or substitute for professional clinical judgment.

Users are responsible for independently evaluating information presented by MedAtlas and for complying with applicable professional standards, institutional policies, licensing requirements, and laws.

Artificial Intelligence & Generated Content

MedAtlas uses artificial intelligence and computational systems to support educational content, simulations, knowledge retrieval, assessment, reasoning exercises, and other platform functionality.

Depending on the MedAtlas service and its configuration, user-provided content may be transmitted to or processed by service providers that support hosting, artificial intelligence, infrastructure, authentication, storage, communications, or other platform functions.

MedAtlas does not represent AI-generated output as infallible. Artificial intelligence may produce incomplete, inaccurate, outdated, or inappropriate information. Users should independently verify information when accuracy is material.

MedAtlas does not sell user conversations or personal information for advertising purposes. Any use of data for system improvement, analytics, research, or model development will be subject to applicable law, contractual restrictions, and the configuration of the relevant service.

Disclosure & Service Providers

MedAtlas does not sell or rent personal information. Information may be disclosed when reasonably necessary to operate MedAtlas or when permitted or required by law.

This may include disclosure to:

• Cloud hosting, infrastructure, database, storage, authentication, communications, analytics, payment, and technology service providers.
• Artificial intelligence or computational service providers used to deliver specific platform functionality.
• Professional advisers, auditors, insurers, or other parties assisting with legal, security, compliance, or business operations.
• Government authorities or other parties when disclosure is required by applicable law, legal process, or a valid governmental request.
• Parties involved in investigating fraud, misuse, security threats, or conduct that may endanger MedAtlas, its users, or others.
• A successor or participating entity in connection with a merger, acquisition, financing, restructuring, sale of assets, or similar business transaction, subject to applicable law.

Data Security

MedAtlas uses administrative, technical, and organizational safeguards intended to protect information against unauthorized access, disclosure, alteration, destruction, or misuse.

No internet-connected system, transmission method, software platform, or electronic storage mechanism can be guaranteed to be completely secure. Accordingly, MedAtlas cannot guarantee absolute security or that unauthorized third parties will never defeat security measures.

Users are responsible for maintaining the confidentiality of their credentials, using appropriate device security, and promptly notifying MedAtlas if they believe an account or credential has been compromised.

Data Retention

MedAtlas may retain personal information for as long as reasonably necessary to provide services, maintain accounts, fulfill the purposes described in this Policy, satisfy contractual requirements, resolve disputes, maintain security, prevent fraud or abuse, enforce agreements, and comply with legal obligations.

Retention periods may vary depending on the type of information, the service involved, contractual requirements, backup cycles, security requirements, and applicable law.

Information may remain temporarily in backups, security logs, disaster-recovery systems, or other systems after deletion from active services where technically necessary or legally permitted.

Cookies, Local Storage & Analytics

MedAtlas may use cookies, browser local storage, session technologies, and similar mechanisms for authentication, preferences, security, service functionality, performance, and analytics.

Browser settings may permit users to block or delete certain cookies. Doing so may affect authentication, saved preferences, or the functionality of some MedAtlas services.

Privacy Rights & Requests

Depending on applicable law and the user's jurisdiction, individuals may have rights concerning personal information, which may include rights to request access, correction, deletion, portability, restriction, or other information regarding processing.

Rights are not absolute and may be subject to legal, security, identity-verification, contractual, record retention, or other permitted exceptions.

MedAtlas may request information reasonably necessary to verify the identity and authority of an individual making a privacy request.

Children's Privacy

General MedAtlas services are not directed to children under 13, and MedAtlas does not knowingly collect personal information from children under 13 through services intended for general users without appropriate authorization.

Educational or institutional services involving minors, if offered, may be subject to separate terms, institutional controls, consent processes, or privacy requirements.

If MedAtlas becomes aware that information has been collected from a child in circumstances inconsistent with applicable requirements, appropriate steps may be taken to address or delete that information.

Third-Party Services & Links

MedAtlas may contain links to, integrations with, or functionality provided by third-party websites, applications, platforms, or services.

Unless otherwise stated, MedAtlas does not control the independent privacy or security practices of third parties. Users should review the privacy policies and terms applicable to those services.

Security Incidents & Breach Notification

MedAtlas maintains processes intended to identify, investigate, contain, and respond to suspected security incidents.

If MedAtlas determines that a security incident triggers notification obligations under applicable law or an applicable contractual agreement, MedAtlas will provide notifications as required by the governing law or agreement.

Different legal frameworks may apply depending on the type of information involved and the relationship under which MedAtlas processes it. These may include HIPAA breach-notification requirements in an applicable HIPAA-regulated environment or other federal or state privacy and breach-notification requirements.

Changes to This Policy

MedAtlas may revise this Privacy Policy as services, technologies, legal requirements, or business practices evolve.

The effective date displayed at the top of this page identifies the current version. When required by applicable law, additional notice or consent may be provided for material changes.

Contact MedAtlas

Questions concerning this Privacy Policy, privacy requests, or suspected privacy or security issues may be directed to MedAtlas Learning Minds.

Email: [email protected]

Website: medatlaslearning.com