Privacy and Security Notice.
Last Updated: August 13, 2026
Overview
This Privacy and Security Notice (the “Privacy Policy”) covers all websites, services, and mobile apps (the “Services”) provided or hosted by MedRecords.me (sometimes referred to as “we”). This Policy applies to the Personal Information we collect from your use of our services, website, or mobile application, and through any other means by which you engage with us.
“Personal Information” means:
Personally Identifiable Information (PII)- Identifiers like your name, address, date of birth, contact details, Social Security number.
Protected Health Information (PHI) - Health-related information like medical records, treatment history, diagnoses, and health plan details.
Tekmir Solutions, LLC provides TEFCA Individual Access Services through its MedRecords.me platform. If there is any conflict between this Privacy Policy and the MedRecords.me Terms of Service, this Privacy Policy governs.
Definition of Services
"Services" refers to all websites, mobile applications, software platforms, and related functionalities offered, operated, or provided by MedRecords.me. These include, but are not limited to:
Tools to collect, maintain, and share your health information in accordance with your directions.
Secure identity verification.
Data analysis and machine learning for health insights.
Communication tools (email, SMS) for updates.
Customer support, research, educational, and promotional activities.
Any future updates or enhancements.
MedRecords.me will attempt to collect your health information for the purpose of sharing that information with you and—only if you clearly and expressly direct us to share your information—sharing that information with third parties you select.
What is TEFCA?
The Trusted Exchange Framework and Common Agreement (TEFCA) is a nationwide network that enables the secure exchange of health information across different healthcare systems and organizations. TEFCA establishes a common set of standards and rules to help healthcare providers, health plans, and other authorized parties share patient health information electronically in a safe and standardized way.
MedRecords.me connects to the TEFCA network through Commonwell Health Alliance, a Qualified Health Information Network (QHIN). This connection allows us to locate and collect your medical records from participating healthcare providers, hospitals, health plans, and other organizations across the country that are part of the TEFCA network. By leveraging this nationwide infrastructure, we can help you access your comprehensive health information from multiple sources in one convenient location.
In addition to these terms, MedRecords.me has agreed to comply with the CommonWell Health Alliance End User License Agreement v11.05.23, available at this link.
Acceptance of This Notice
By using our Services, you say to us that you agree to the terms of this Privacy Policy. If you do not agree to the terms of this Privacy Policy, please do not use the Services. Your continued use of the Services after we make changes to this Privacy Policy will mean that you agree to those changes.
Changes to This Notice
This Notice may be revised from time to time as we add new features and services, as laws change, and as industry privacy and security best practices evolve. We will give you advance notice of any material changes so you can decide if you want to maintain your account with MedRecords.me (except changes that need to be made immediately in order to comply with law or to deal with an urgent situation that threatens the security of information held by us or which severely impacts our functionality).
A "Material Change" means a change to this Privacy and Security Notice that results in us using or disclosing Identifiable Information in a different manner than when the information was collected or otherwise obtained. This includes, for example, changes that may adversely affect you, new categories of Identifiable Information processed by MedRecords.me, or any change to how we process Identifiable Information, which you may not reasonably expect.
If there is a dispute about whether we should have made reasonable efforts to proactively notify you of a change to this Notice, MedRecords.me has the burden to prove the change was not a Material Change.
The updated Notice will be effective as of the time of posting, or such later date as may be specified in the updated Notice. Each Material Change will have its own effective date.
We will:
Post the updated Notice on our website.
Post any changes no later than the effective date of the change.
Notify existing users of Material Changes using your stated communication preferences.
Clearly highlight Material Changes so you can easily identify them.
We maintain records of all changes to this Notice, including documentation sufficient to demonstrate whether each change was material or immaterial. In any dispute regarding whether we should have notified you of a change, we bear the burden to prove the change was immaterial.
Account Creation & Maintenance
When you sign up for and use the Services, we collect personal and business information from you for account creation and maintenance (“Account Information''). Such Account Information includes, as applicable or permitted under law, items such as your name, address, e-mail address, telephone numbers, contact preferences, device identifiers, IP address, and prior names and addresses.
Health Records & Self-Reported Information
We enable you to receive copies of your health information and medical records (“Health Records”) through the “patient access” granted to you under HIPAA, HITECH, and/or the laws applicable where you are located, as well as through online portal accounts that may be made available to you by some health care providers, health plans, or independent app developers.
To collect those Health Records on your behalf, we collect information such as name, birth date, address, gender, medical or health plan record numbers, or information about your doctors, medical providers and health plans. We will let you know when it is optional for you to provide certain information, and when that information is necessary to use certain Services.
Any information we receive from outside sources will be treated in accordance with this Privacy Policy. We are not responsible or liable for the accuracy of the information provided to us by third parties and are not responsible for any third party’s policies or practices.
REQUEST-ONLY IAS PROVIDER: MedRecords.me DOES NOT PROVIDE BIDIRECTIONAL SERVICES. YOU WILL HAVE THE ABILITY TO REQUEST ACCESS TO YOUR HEALTH INFORMATION VIA TEFCA EXCHANGE. YOU WILL NOT BE ABLE TO USE MedRecords.me TO SHARE YOUR HEALTH INFORMATION WITH OTHER PARTICIPANTS IN TEFCA.
HIPAA Applicability
MedRecords.me and Tekmir Solutions are not subject to the Health Insurance Portability and Accountability Act (HIPAA) as a matter of law.
Identity Verification
In order to verify your identity, we use a third-party identity verification provider that collects a copy of your official government photo ID and images of your face, which are analyzed and compared to your official ID. The third-party identity verification provider uses your official ID and images solely for purposes of identity verification for MedRecords.me. For information on this third-party’s privacy practices, please visit ID.me
If you decide you want friends, family members, or others to have access to your MedRecords.me account or to be a personal representative, we will collect personal information about those individuals to fulfill your request. Such information may include name, email, telephone, a health care proxy, a power of attorney, or other information used to confirm their identity and authority to represent you.
How We Use Your Personal Information
MedRecords.me uses your information to deliver, improve, and personalize our Services while ensuring you retain control over your data.
Our use of Identifiable Information must comply with Section 11.1 of the TEFCA Common Agreement (available at https://rce.sequoiaproject.org/tefca-common-agreement/), which limits how health information can be used and disclosed.
We must also comply at all times with this Privacy Policy and must protect your Personal Information in accordance with the applicable Framework Agreement.
Specifically, we use your information to:
1. Request your health records
To locate your health records and help providers and health plans accurately match and send the correct information to us.
2. Deliver and personalize our Services
To create, manage, and personalize your account.
To provide secure access to your health records and allow you to send your records to others as directed by you. To be clear, by default, MedRecords.me will not share your health information with other participants in TEFCA.
To deliver tailored content, product recommendations, and service updates based on your preferences and usage.
3. Respond to requests
To respond to customer service inquiries and fulfill your requests efficiently.
To process transactions and administer promotions, surveys, or other features of the Services.
4. Improve our Services
To analyze how users interact with our Services and gather feedback to enhance existing features and develop new ones.
To conduct research, including aggregated and anonymized analyses, for improving our offerings and generating insights.
5. Keep your data safe
To detect, prevent, and mitigate unauthorized access, fraud, and abuse of the Services.
To maintain and improve account and network security.
6. Contact you
We may contact you via the following methods to ensure you are informed about your account and services:
Email: To send important updates about your account, changes to terms or policies, and optional newsletters or promotional offers. We will also use email to notify you of any unauthorized access or data breaches impacting your information.
Phone: To address urgent matters, such as account security, or to respond to specific customer support requests when necessary.
Text Messages: If you opt-in, we may send occasional text messages to provide updates about the Services. Message frequency may vary. Standard message and data rates may apply based on your carrier.
7. Send important communications
To send essential notices regarding your account, changes to policies, or updates to the Services. These communications are mandatory and cannot be opted out of.
8. Resolve disputes
We will not access, exchange, use, and/or disclose your Personal Information to assert any type of claim against You except for the collection of fees.
How We Share Your Personal Information
We might share your Personal Information in one or more of the following ways.
1. Service providers
We may share your Personal Information under confidentiality agreements with trusted third-party service providers who assist us in operating, developing, or maintaining the Services. These include:
Identity verification services (e.g., ID.me) to ensure secure access to your health records.
Cloud hosting providers for data storage.
Analytics providers for usage analysis and service improvements.
Email and text communication vendors.
Marketing service providers for delivering promotional materials.
These companies use your data solely to provide services to MedRecords.me and do not have independent rights to share your information.
2. To comply with legal and safety requirements
We may disclose your personal information:
To comply with mandatory legal obligations, such as subpoenas, court orders, or government regulations, including potentially relating to reproductive health or gender affirming care.
To establish or defend legal claims.
To prevent fraud, unauthorized access, or threats to safety.
To comply with obligations under the Trusted Exchange Framework and Common Agreement (TEFCA) for sharing medical information.
Any disclosures made through TEFCA are in accordance with the permitted and required uses and disclosures specified in the TEFCA Common Agreement and applicable U.S. Department of Health and Human Services guidance.
We will notify you within three (3) business days of receiving a civil or criminal subpoena, court order, search warrant, or other demand to disclose your Personal Information, unless that notice is prohibited by law. You will have the chance to object to the disclosure or seek a court order preventing it.
We will also notify you within three (3) business days of disclosing your Personal Information to law enforcement or regulators, unless prohibited by law. You will have the chance to object to the disclosure or seek a court order preventing it.
3. Third parties authorized by you
If you expressly and clearly direct us to send your medical records to an authorized third party—for example a law firm, insurance company, or pharmaceutical company—we will comply with your directive if allowed by federal and state law.
Important: When you make a decision to share your data outside of Tekmir and MedRecords.me—including your Health Records—the data practices under this Notice will no longer apply to the information held by that outside entity. We recommend that you review and determine you are comfortable with that entity's privacy policy prior to sharing your data (including Account Information and Health Records).
4. Business transfers
In the event of a business transaction such as a merger, acquisition, or sale, your personal information may be transferred to the new entity. We will require the new entity to adhere to this Privacy Policy.
How We Protect Your Personal Information
We:
Use commercially reasonable efforts to protect your information.
Encrypt all data, including your Personal Information, at rest and in transit. This includes all Identifiable Information held by MedRecords.me, regardless of whether such data are TEFCA Information.
Require service providers to meet strict privacy/security standards, including commercially reasonable efforts to protect your information.
Maintain obligations for as long as we hold your data.
Retain your medical information for 6 years unless you direct us to destroy it before then, or unless otherwise required by federal or state law.
These obligations will continue as long as we maintain your Personal Information.
De-Identification of Information
We may de-identify your Personal Information by removing identifiers so that the information can no longer reasonably be used to identify you. If we de-identify your information:
How we de-identify: We follow industry-standard methods to remove or obscure personal identifiers.
How we use de-identified information: We may use de-identified information for research, analytics, product improvement, and to generate aggregate insights about health trends.
How we disclose de-identified information: We may share de-identified, aggregated data with research partners, academic institutions, or other third parties. Because this information cannot identify you, it is no longer subject to this Notice.
Data Breach Notification
If we believe your Personal Information is involved in a data breach or unauthorized access of our systems, we will notify you with:
What happened and when, including the specific dates of the incident and its discovery if known.
What type of data was involved.
Steps you should take to protect yourself from potential harm.
Our actions to investigate and prevent recurrence.
Contact Information to reach us with questions:
Toll-free phone: (888) 500-3088
Email:support@MedRecords.me
Your Choices and Rights
You control how your Personal Information is used, shared, and retained.
1. Giving Your Consent
We obtain your express documented and informed consent before you first use our Services.
If we materially change how we use your information, we will ask for your consent again.
We capture consent via paper or electronic signature and keep an auditable record.
2. User-Controlled Sharing
You have full control over sharing your medical information with others, for instance lawyers, family, and caregivers. Use the account settings to manage these permissions. We will not share your health records without express, written authorization in accordance with all applicable laws and regulations.
When you make a decision to share your data outside of Tekmir and MedRecords.me--including your Health Records--the data practices under this Privacy Policy will no longer apply to the information held by that outside entity. We recommend that you review and determine you are comfortable with that entity’s privacy policy prior to sharing your data (including Account Information and Health Records).
3. Revoking Your Consent
You can revoke consent at any time using the following methods:
Step-by-Step Instructions to Revoke Consent:
Log into your MedRecords.me account
Navigate to Settings > Privacy & Consent
Click "Revoke Consent"
Confirm your decision
You will receive a confirmation email
Alternative methods:
Email support@MedRecords.me with subject line "Revoke Consent"
Call (888) 500-3088 and request consent revocation
Important:
Revoking consent stops future use or disclosure but does not undo past actions based on your earlier consent.
Once revoked, you will no longer be able to access our Services.
4. Your Rights to Your Data
You may:
Request complete deletion of your information (except legally required audit logs).
Access and export your information in a machine-readable format with instructions for interpretation. Instructions are available in your portal. Available formats include JSON and CSV with accompanying data dictionaries.
Be informed if the law prevents deletion of your information.
We will act on your requests within a reasonable time.
5. Consent to Sale
We do not sell your information without your separate, clearly labeled “Consent to Sale.”
If you ever give such consent, you may revoke it at any time through the same methods listed above.
We will obtain your express and documented consent before we ever: (1) sell your Personal Information, (2) receive remuneration in exchange for Personal Information, or (3) use Personal Information for targeted advertising or other marketing purposes.
6. Changing or Deleting Your Information
You can update, correct, or delete your information using in-app tools or by emailing support@MedRecords.me.
We delete your data as soon as reasonably possible after a valid request, except for records we must retain by law.
7. Opting Out of Communications
Emails: Click “unsubscribe” in the message.
Calls: Update your settings or email us.
Text messages: Reply STOP; HELP for help.
Mandatory account and legal notices cannot be opted out of.
Fees and Costs
We do not charge individuals to access, view, download, export, or delete their records, or to exercise any privacy rights.
If you choose to have MedRecords.me send your records to another organization—such as a law firm or other authorized third party—we may charge that organization a flat fee to cover the administrative and technical work required to retrieve and transmit the records at your direction.
That fee:
Is currently $150
Is charged only for medical records retrieval and transmission services
Is paid by the receiving organization
Is assessed at the time the records request is made
Does not depend on the contents of your records
Does not affect your ability to access or obtain your records through MedRecords.me
May be reimbursed to the organization by you only if permitted under your separate agreement with that organization
We accept payment from receiving organizations by credit card, ACH bank transfer, or invoice for approved accounts. Invoiced payments are generally due within 30 days.
We will clearly disclose any applicable fees to the receiving organization before the request is processed.
Contact Us
If you have questions about this Notice, our privacy practices, or wish to submit a complaint, please contact us:
Toll-free phone: (888) 500-3088
Email:support@MedRecords.me
Website:https://www.MedRecords.me/contact
Mail: MedRecords.me Privacy Team, 6375 Penn Ave. Suite B #1015, Pittsburgh, PA 15206
For Privacy Rights Requests: Email support@MedRecords.me with subject line "Privacy Rights Request"
Complaint Process: We maintain a documented process for receiving, investigating, and responding to privacy-related complaints. When you submit a complaint, we will:
Acknowledge receipt within 2 business days
Investigate the issue
Provide a response with our findings
Document the complaint and its resolution
State Privacy Rights and Additional Disclosures
Depending on where you reside, you may have additional rights regarding your personal information under applicable state privacy laws, including the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and similar laws in other U.S. states such as Virginia, Colorado, and Connecticut (collectively, “State Privacy Laws”).
Your Rights Under State Privacy Laws
Subject to applicable law and certain exceptions, residents of these states may have the right to:
Access / Know: Request information about the categories and specific pieces of personal information we have collected about you, the purposes for which we use it, and the categories of third parties with whom we share it.
Delete: Request that we delete personal information we have collected from or about you.
Correct: Request that we correct inaccurate personal information.
Data Portability: Request a copy of your personal information in a portable and, to the extent technically feasible, readily usable format.
Opt Out of Certain Processing: Opt out of certain uses of personal information, such as targeted advertising or sharing of personal information for cross-context behavioral advertising, where applicable.
Limit Use of Sensitive Personal Information: Where required by law, limit certain uses or disclosures of sensitive personal information.
Non-Discrimination: Not be discriminated against for exercising your privacy rights.
Exercising Your Rights
You may submit a request to exercise your privacy rights by contacting us at:
Email:support@MedRecords.me
Subject Line: “Privacy Rights Request”
We may need to verify your identity before fulfilling your request. If you submit a request through an authorized agent, we may require proof of authorization as permitted by law.
California Residents – Additional Information
If you are a California resident, you may have additional rights under California law. To the extent applicable, we do not sell personal information for monetary consideration. We may share personal information with service providers and contractors for business purposes consistent with applicable law.
If required, we will honor requests to opt out of the sale or sharing of personal information and to limit the use of sensitive personal information.
Scope and Limitations
These rights are subject to limitations and exceptions under applicable law. Certain information may be retained as required or permitted by law, including for legal, security, compliance, and operational purposes.
Updates
We may update this section as our services evolve and as state privacy laws change. Any updates will be reflected by the “Last Updated” date at the top of this Privacy Policy.
Children’s Privacy Policy
Our website and Services are not intended for individuals under 18 years of age. If you are under 18 years of age, do not use this website, its features, or our Services in any capacity. Do not provide us with any information about yourself.
We will not knowingly collect data on anyone under the age of 18. If we learn we have collected or received personal information from someone under 18 without valid parental consent, we will delete that information. Please contact us if you believe we might have information from or about a child under 18.
Non-United States Residents
Our website is operated in the United States. If you are located outside of the United States, please be aware that any personal information you provide to us will be transferred to the United States. By using our website and/or providing us with your personal information, you agree to this transfer.