Privacy Policy

Marketing website

We collect contact details you voluntarily provide through demo and contact forms (such as name, email, practice name, and message content) so we can respond to your inquiry.

We do not sell personal information. Form data is used for sales, onboarding conversations, and product communication you request.

This marketing site may use essential cookies or similar technologies required for basic functionality. Analytics, if enabled later, will be documented here.

Canada - PIPEDA

For Canadian customers and personal information collected in the course of commercial activities, MedCrest aligns its privacy practices with the Personal Information Protection and Electronic Documents Act (PIPEDA), and with applicable provincial health privacy laws (for example PHIPA in Ontario) where they apply to practice operations.

We collect personal information for identified purposes, use safeguards appropriate to the sensitivity of the information, and support practices in responding to access and correction requests related to data we process on their behalf.

United States - HIPAA

For U.S. customers, when MedCrest processes Protected Health Information (PHI) on behalf of a covered entity, we operate as a business associate under the Health Insurance Portability and Accountability Act (HIPAA).

A Business Associate Agreement (BAA) is available for U.S. customers. Product controls are designed to support the HIPAA Privacy, Security, and Breach Notification Rules - including access controls, encryption, and audit-friendly logging. Your practice remains responsible for its own HIPAA policies and workforce training.

Australia - Privacy Act & APPs

For Australian customers, MedCrest aligns with the Privacy Act 1988 and the Australian Privacy Principles (APPs). Health information is treated as sensitive information. Practices connecting to My Health Record must also consider the My Health Records Act 2012, and state or territory health privacy laws may apply.

Cross-border disclosures are handled with APP 8 accountability in mind. Product safeguards are designed to support security and purpose-limitation expectations for sensitive health information.

New Zealand - Health Information Privacy Code

For New Zealand customers, MedCrest aligns with the Privacy Act 2020 and the Health Information Privacy Code 2020, which sets 13 health-specific rules for health agencies - New Zealand’s closest HIPAA analogue.

Overseas transfers of health information are treated carefully under Rule 12. Practices remain responsible for their own policies and day-to-day handling of health information.

Mexico - LFPDPPP

For Mexican private-sector customers, MedCrest aligns with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). Mexico does not have a standalone HIPAA-style health privacy statute; health data is protected as sensitive personal data. Public bodies follow LGPDPPSO.

Where required, processing of sensitive data is supported by privacy notices and express consent, ARCO rights pathways, security measures, and controlled transfers. COFEPRIS rules may also apply if the software is regulated as a medical device.

More detail

See our Security & Privacy page for a country-by-country compliance map. This policy is informational and not legal advice.

Questions: hello@medcrestpms.com.