Privacy Policy

1. Highlights / Summary

At MedWorks Inc., we value your trust and are committed to transparency.

• What we collect: Contact details, account information, health data (with explicit consent), payment info, location data, and usage analytics.
• Why we collect it: To provide healthcare connectivity services, process payments, verify identities, improve our app, and comply with legal obligations.
• How it's protected: We use industry-standard encryption, strict access controls, and regular security audits.
• Your rights: You can access, correct, delete, or object to the processing of your data at any time.
• Contact us: Questions? Email us at privacy@medworks.com.

2. Introduction & Scope

This Privacy Policy ("Policy") describes how MedWorks Inc. ("MedWorks", "we", "us", or "our") collects, uses, discloses, and protects your personal information. This Policy applies to all users ("Users", "you", or "your") of our services, including:

• Our website located at www.medworks.com (the "Website");
• Our mobile applications available on the Apple App Store (iOS) and Google Play Store (Android) (the "App");
• All related services, features, and content offered by MedWorks (collectively, the "Services").

3. Legal Basis for Processing

We process your personal information only when we have a valid legal basis to do so, including:

• Consent: You have given us clear consent to process your personal information for a specific purpose. This consent may be express (e.g., checking a box) or implied (e.g., using a service that reasonably requires data collection).
• Contractual Necessity: Processing is necessary for the performance of a contract to which you are a party (e.g., delivering healthcare connectivity services you requested).
• Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject (e.g., tax reporting, regulatory compliance).
• Legitimate Interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, provided those interests are not overridden by your data protection rights (e.g., fraud prevention, network security).

You have the right to withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect our ability to provide certain services to you.

4. Personal Information We Collect

We collect information that identifies, relates to, describes, or could reasonably be linked to you ("Personal Information"). The categories include:

5. How We Use Your Information

We use your Personal Information for the following purposes:

• Service Delivery: To create and manage your account, verify your identity, and provide the features of the App.
• Healthcare Facilitation: To connect you with independent healthcare contractors and facilitate the scheduling and delivery of services.
• Payment Processing: To process payments for services, issue refunds, and manage billing disputes.
• Communication: To send you service updates, security alerts, appointment reminders, and support messages.
• Improvement & Analytics: To analyze usage trends, troubleshoot technical issues, and improve the functionality and user experience of our Services.
• Marketing: To send you promotional materials and newsletters, where you have opted in to receive them. You may opt out at any time.
• Legal & Security: To detect and prevent fraud, enforce our Terms of Service, and comply with legal obligations.

Emergency Disclaimer: Our Services are NOT for medical emergencies. If you have an emergency, please call 911 immediately.

6. Sharing & Disclosure

We do not sell your Personal Information.

We may share your information with the following categories of third parties:

• Healthcare Contractors: Independent healthcare professionals who provide services to you.
• Service Providers: Trusted third-party vendors who assist us with hosting, data analysis, payment processing (e.g., Stripe), customer support, and email delivery.
• Legal Authorities: Courts, law enforcement, or regulatory bodies if required by law.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets.
• Aggregate Data: We may share aggregated, de-identified data with partners for industry analysis.

7. International Data Transfers

Your Personal Information may be transferred to, stored, and processed in countries other than your country of residence, including the United States, Canada, and Mexico.

8. Your Privacy Rights

9. Sensitive Data Protections

"Sensitive Personal Data" includes information related to health status, genetic information, biometric data, racial or ethnic origin, religious or philosophical beliefs, and political opinions.

In accordance with Mexico's LFPDPPP, we will obtain your express written consent before processing any Sensitive Personal Data. We apply stricter security measures including advanced encryption and restricted access controls.

10. Children's Privacy

Our Services are intended for individuals aged 18 and older. We do not knowingly collect Personal Information from children under the age of 13 without verifiable parental consent.

If you are a parent or guardian and believe that your child under 13 has provided us with Personal Information without your consent, please contact us at privacy@medworks.com.

11. Automated Decision-Making & AI

• Objecting to Decisions: You have the right to object to decisions based solely on automated processing if they produce legal effects.
• Human Intervention: You may request human intervention to review any significant automated decision.
• Transparency: We are committed to transparency regarding the logic involved in any automated decision-making processes.

12. Data Security

• Encryption: Data is encrypted in transit (using TLS/SSL) and at rest.
• Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis.
• Security Audits: We conduct regular vulnerability assessments and security audits.
• Vendor Management: We require our third-party service providers to maintain equivalent security standards.

No method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

13. Data Breach Notification

• Internal Assessment: We will assess the breach within one (1) hour of discovery.
• Notification to Authorities: Where required by applicable law, we will notify the relevant data protection authorities within the required timeframe (typically 72 hours).
• Notification to You: We will notify affected individuals as soon as feasible, providing details about the breach and steps you can take.

14. Data Retention

• Account Data: Retained as long as your account is active.
• Transaction Data: Retained for a minimum of 7 years for tax and accounting purposes.
• Health Data: Retained in accordance with applicable medical record retention laws.

Upon expiry of the retention period or upon your valid request for deletion, we will securely delete, destroy, or anonymize your Personal Information.

15. Cookies & Tracking Technologies

• Essential Cookies: Necessary for the operation of the Website (e.g., login sessions).
• Analytics Cookies: Help us understand how you use our Services (e.g., Google Analytics).
• Functionality Cookies: Allow us to remember choices you make (e.g., language preference).

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. We respect "Do Not Track" signals.

16. Location Data

• Collection Methods: We use GPS, IP address, and Wi-Fi access points to determine your location.
• Control: You can enable or disable location services at any time through your device settings.
• Purpose: We use this data strictly to facilitate service delivery and improve logistics. We do not sell your location history.

17. Marketing & Communications

• Consent: We will only send marketing communications if you have opted in.
• Opt-Out: You can opt out by following the unsubscribe link in any email, or by contacting us.
• Transactional Messages: We will continue to send essential service-related communications even if you opt out of marketing.
• CASL Compliance: We comply with Canada's Anti-Spam Legislation.

18. Third-Party Services & Links

Our Services may contain links to third-party websites or services that are not owned or controlled by MedWorks. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Healthcare Contractors are independent third parties. While we vet them, their independent practices are governed by their professional obligations.

19. Apple App Store Specific Disclosures

• This Policy is between you and MedWorks Inc. only, not with Apple.
• Apple and its subsidiaries are third-party beneficiaries of this Policy.
• We comply with Apple's App Tracking Transparency (ATT) framework.
• Our data collection practices align with the "App Privacy" section on our App Store product page.

20. Mexico-Specific Provisions (LFPDPPP 2025)

• Controller: MedWorks Inc. is the "Data Controller" responsible for the processing of your personal data.
• We provide both Simplified and Comprehensive Privacy Notices as required by law.
• We will obtain your express written consent for processing sensitive personal data.
• ARCO Rights: You may exercise your ARCO rights by contacting our LFPDPPP Privacy Officer at arco@medworks.com.
• This Policy is available in Spanish. In case of discrepancies, the version in the language of the jurisdiction governing the dispute shall prevail.

21. Canada-Specific Provisions (PIPEDA)

• We have designated a Privacy Officer who is accountable for our compliance.
• If you have a concern, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada.
• We will respond to your written request for access within 30 days.

22. Changes to This Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. If we make material changes, we will notify you by email or through a notice on the App home screen.

23. Contact Information & Privacy Officers

24. Glossary of Terms

• Personal Information / Personal Data: Any information relating to an identified or identifiable individual.
• Sensitive Data: Data revealing racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data, or data concerning health or sexual orientation.
• Processing: Any operation performed on personal data, such as collection, recording, storage, use, disclosure, or deletion.
• Controller: The natural or legal person who determines the purposes and means of the processing (MedWorks Inc.).
• Processor: A natural or legal person who processes personal data on behalf of the controller.
• ARCO Rights: The rights of Access, Rectification, Cancellation, and Opposition under Mexican law.
• Data Subject: The identified or identifiable natural person to whom the personal data relates (You).