Skip to main content

Privacy Policy

Effective Date: October 4, 2026·Version 1.3

1. Introduction

Telemedcore (“Company,” “we,” “us,” or “our”) operates the Telemedcore clinical practice management platform (the “Platform” or “Service”). This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you access or use the Platform, whether as a medical practice, an educational institution, or an individual user.

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Platform.

2. Information We Collect

2.1 Account Information

When you create an account or when an administrator creates an account on your behalf, we collect your name, email address, role designation, and authentication credentials. We may also collect a practice identifier (slug), phone number, and professional credentials such as a National Provider Identifier (NPI).

2.2 Practice and Organization Information

For tenant organizations, we collect the practice or institution name, tax identification number (where applicable), NPI (where applicable), business address, phone number, and subscription tier selection.

2.3 Clinical and Patient Data (Medical Practice Tenants)

Medical practice tenants may enter, store, and manage protected health information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA). This includes but is not limited to: patient demographics, medical records, encounter notes, diagnoses, procedures, vitals, prescriptions, insurance information, billing and claims data, clinical documents, and portal communications.

2.4 Training Data (Educational Institution Tenants)

Educational institution tenants use the Platform as a clinical practice management training tool. Data entered by educational tenants is expected to be simulated, fictitious, or de-identified and does not constitute PHI. This includes dummy patient records, sample encounter notes, practice billing scenarios, and training exercises.

2.5 Billing and Payment Data

We collect subscription and payment information necessary to process your subscription, including billing contact details, subscription tier, and payment method information. Payment card data is processed by our third-party payment processor (Stripe) and is not stored on our servers.

2.6 Usage and Technical Data

We automatically collect certain information when you use the Platform, including IP address, browser type and version, device information, pages visited, features used, session duration, and access timestamps. We use this data for security monitoring, performance optimization, and service improvement.

3. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Platform and its features, including scheduling, electronic health records, billing, claims management, patient portal, reporting, and document management;
  • Process subscriptions, manage add-on services, and handle billing transactions;
  • Authenticate users, enforce role-based access controls, and maintain multi-factor authentication;
  • Send transactional communications such as appointment reminders (where the SMS Reminders add-on is active), password resets, and system notifications;
  • Monitor and improve Platform performance, reliability, and security;
  • Enforce practice data isolation through comprehensive security controls and ensure data segregation between organizations;
  • Generate anonymized, aggregated analytics for Platform administration and improvement;
  • Comply with legal obligations, including HIPAA requirements for medical practice tenants; and
  • Detect and prevent fraud, unauthorized access, and other security incidents.

4. HIPAA Compliance (Medical Practice Tenants)

For tenants classified as Medical Practice accounts, the Company acts as a Business Associate under HIPAA. In this capacity, we are committed to the following:

  • Encryption: All PHI is encrypted at rest and in transit using industry-standard encryption.
  • Access Controls: The Platform enforces role-based access controls (RBAC) with multiple distinct user roles. Each role has specific permissions governing which data and features they may access.
  • Practice Isolation: Each medical practice’s data is logically isolated using comprehensive security controls. No practice can access another practice’s data.
  • Audit Logging: All access to and modifications of PHI are logged in comprehensive audit logs with integrity controls. Audit records include user identity, action performed, timestamp, and resource affected.
  • Session Security: User sessions automatically expire after a period of inactivity. Tokens are short-lived and automatically rotated.
  • Multi-Factor Authentication: The Platform supports multi-factor authentication for all user accounts.
  • Signed Encounters: Once a clinical encounter is signed by a provider, it cannot be edited — only amended with an append-only amendment trail, as required by HIPAA.
  • Business Associate Agreements: A Business Associate Agreement (BAA) applies to every medical practice tenant. It is accepted in the Platform before patient information is stored; contact us if you need a countersigned copy.

5. Educational Institution Tenants

For tenants classified as Educational Institution accounts, the following applies:

  • No PHI: Educational Institution tenants are expected to use the Platform exclusively with simulated, fictitious, or de-identified data for training purposes. Data entered by educational tenants is not treated as PHI.
  • No HIPAA Obligations: Because Educational Institution accounts do not handle real patient data, HIPAA Business Associate obligations do not apply to these accounts. The Company does not act as a Business Associate for educational tenants.
  • User Responsibility: Educational institutions are responsible for instructing their users (students, faculty, and staff) that real patient information must not be entered into the Platform. See our Terms of Use for full details on educational tenant obligations.
  • Security Measures: Although HIPAA does not apply, we still apply industry-standard security measures to educational tenant data, including encryption at rest and in transit, role-based access controls, and practice data isolation.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information or any tenant data to third parties. We may share information in the following limited circumstances:

  • Infrastructure Providers: We use third-party cloud infrastructure providers to host and operate the Platform. These providers are contractually bound to maintain the confidentiality and security of the data they process.
  • Payment Processors: Subscription payments are processed through Stripe, Inc. We share only the information necessary to process transactions. Stripe’s handling of your payment data is governed by their privacy policy.
  • Integration Partners: If you activate optional integration add-ons (e.g., e-prescribing services), limited data may be shared with the integration partner as necessary to provide the service. Each integration partner is subject to their own privacy obligations and, where applicable, BAAs.
  • Legal Compliance: We may disclose information when required by law, regulation, legal process, or governmental request, including to comply with HIPAA breach notification requirements, court orders, or subpoenas.
  • Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control.

7. Data Security

We implement technical, administrative, and physical security measures designed to protect your information, including:

  • Industry-standard encryption for data at rest and modern TLS encryption for data in transit;
  • Comprehensive security controls for practice data isolation;
  • Role-based access controls with multiple configurable user roles;
  • Multi-factor authentication;
  • Automatic session timeout after a period of inactivity;
  • Password requirements meeting HIPAA standards;
  • Comprehensive audit logging with integrity controls for all data access and modifications;
  • Rate limiting on authentication endpoints and sensitive operations;
  • SSRF protection on webhook delivery endpoints; and
  • Regular security assessments and monitoring.

While we strive to use commercially acceptable means to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. For a detailed overview of our security controls, visit our Security page.

8. Data Retention

  • Active Accounts: We retain your account and tenant data for the duration of your active subscription and account relationship with us.
  • Medical Records (Medical Practice Tenants): In accordance with applicable state and federal law, medical records are retained for ten (10) years from the date of last service, longer for patients who were minors at the time of service, or as otherwise required by the applicable jurisdiction. We will work with medical practice tenants to ensure compliance with their state-specific retention requirements.
  • Educational Data: Data associated with Educational Institution accounts may be deleted upon account termination at the institution’s request, subject to a 90-day data export window.
  • Audit Logs: Audit logs are retained for seven (7) years, which exceeds the six-year HIPAA documentation requirement.
  • Account Termination: Upon termination of your account, you will have a 90-day window to export your data. After the export window, data will be securely deleted or de-identified in accordance with our retention schedule and applicable legal requirements.
  • Free Trial Accounts: If you register for a free trial and do not convert to a paid subscription before the trial period ends, your account will be automatically deactivated at expiry. All practice data will be permanently deleted 90 days after the trial end date. You will receive an expiry notice and a deletion warning email before permanent deletion occurs. To export your data before deletion, subscribe to a paid plan or contact support. For full details, see our Trial Data Retention Policy →

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

  • Access: You may request a copy of the personal information we hold about you.
  • Correction: You may request that we correct inaccurate or incomplete personal information.
  • Deletion: You may request deletion of your personal information, subject to legal retention obligations (particularly for medical records).
  • Portability: You may request your data in a structured, commonly used, machine-readable format.
  • CCPA Rights (California Residents): California residents have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, please contact us using the information provided in Section 13 below.

10. Cookies and Tracking Technologies

The Platform uses essential cookies and local storage necessary for authentication, session management, and user preferences, and, on our public website, a per-tab record of how a visit began (referring search or answer engine, campaign tags and landing page), sent only if you register. We do not use third-party advertising cookies or cross-site tracking technologies. No personal data is shared with advertising networks.

11. Children’s Privacy

The Platform is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete such information promptly. If you believe a child under 13 has provided us with personal information, please contact us.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be indicated by updating the “Effective Date” and version number at the top of this page. Your continued use of the Platform after any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

13. Contact Information

If you have any questions or concerns about this Privacy Policy, our data practices, or wish to exercise your rights, please contact us at:

Telemedcore
Email: contact@telemedcore.com
Website: telemedcore.com

For HIPAA-related inquiries or to request a countersigned Business Associate Agreement, please contact us at the email address above with the subject line “HIPAA Inquiry.”