Mederium privacy policy

Information handled by Mederium

Mederium processes account details, sign-in and security data, and information that practices and their authorized users enter to operate their websites, schedules, appointments, patient records, and clinical workflows. Public website features may receive information submitted through booking, review, and assistant forms. We also use limited operational events and logs to maintain and protect the service.

How information is used

We use this information to provide the requested features, show information to authorized practice users, manage appointments and availability, support the service, and investigate security or reliability issues. Access to private portal information is limited by account role and practice permissions.

Google Calendar connection

A doctor may choose to connect Google Calendar. Mederium requests the calendar.events permission to read calendar events for availability, and to create, update, or delete events for that doctor’s Mederium appointments. For unrelated Google events, Mederium uses busy time ranges and event identifiers; it does not store their titles in its busy-time records.

Mederium stores the connected calendar identifier, event and sync identifiers, busy time ranges, and an encrypted OAuth refresh token so synchronization can continue. The default title for events Mederium creates is generic. A doctor may choose a setting that includes a patient name in the calendar event title. Mederium does not send patient phone numbers, email addresses, diagnoses, notes, transcripts, or clinical attachments to Google Calendar.

Google Calendar data is used for the calendar features described here. It is not sold, used for advertising, or used to train AI models. When a doctor disconnects Google Calendar, Mederium clears its stored refresh token and stops using that connection for future synchronization. The doctor can also revoke access in their Google account.

Sharing and storage

Information may be available to people authorized by the relevant practice and to service providers needed to host and operate Mederium. Calendar event information is exchanged with Google when a doctor enables synchronization. We may disclose information when required by law or to protect the service. Access and retention depend on the information and the purpose for which it was provided; disconnecting a calendar does not automatically erase appointment records or other operational records.

Your choices and questions

Doctors can choose whether to connect or disconnect Google Calendar in the portal. If you submitted information to a clinic using Mederium, contact that clinic about its records and privacy practices. For questions about Mederium itself, email mederium.pk@gmail.com.

Learn more about Mederium.