Privacy Policy

Our servers are located in the United States. If you are accessing our application from outside the United States, please be aware that your information may be transferred to, stored, and processed by us in our facilities and by those third parties with whom we may share your personal information, in and other countries.

If you are a resident in the European Economic Area, then these countries may not have data protection or other laws as comprehensive as those in your country. We will however take all necessary measures to protect your personal information in accordance with this privacy policy and applicable law.

We collect information directly from individuals who visit our website, from third-parties and automatically through the PatientXpress Platform.

In the course of providing you access to the PatientXpress services, we collect and receive personal information in a few ways. Often, you can choose what information to provide, but sometimes we require personal information from you to carry out certain activities such as user registration. This section details the ways in which we collect information from you and how that information is received.

We may provide your personally identifying information, and information about your activities and preferences, to other companies wishing to contact you about products or services, but only to those that we believe impose reasonable safeguards on the privacy of your information. We may also provide these companies with collective profiles of our user groups and their activities and preferences. Such collective profiles may also be disclosed in describing our site and services to prospective partners, advertisers and other third parties, and for other lawful purposes. Finally, we may disclose information to fulfill certain legal and regulatory requirements or if we believe, in good faith, that such disclosure is legally required or necessary to protect others' rights or to prevent harm.

Security is important to us and we know it is important to you. PatientXpress maintains a written information security program that is designed to protect the information entrusted to us and is reviewed at least annually. Our safeguards include:

• Encryption in transit: all data exchanged with PatientXpress is protected with TLS encryption.
• Encryption at rest: sensitive data we store, including integration credentials such as bank connection credentials, is encrypted at rest and decrypted only on our servers when needed.
• Data minimization: patient and practice records remain in each practice's own practice-management system; PatientXpress keeps only what each feature requires.
• Access control: access is limited by role and to the practice a user belongs to, staff access to production systems is reviewed regularly and removed promptly when no longer needed, and multi-factor authentication protects administrative access.
• Audit logging: changes we make to a practice's records are logged with the identity of the staff member who made them.
• Incident response: we investigate suspected security incidents promptly and notify affected customers as required by law and our agreements, including HIPAA breach-notification rules where they apply.

Please remember that you play a valuable part in security as well. Your password to access our site, which you select at registration, should never be shared with anyone and should be changed frequently. And, after you have finished using our site, you should log off and exit your browser so no unauthorized persons can use our site with your name and account information. Remember that any information you voluntarily disclose online in any news or message postings, scorecards, discussion groups or chat rooms may be collected and used by others without your permission.

Furthermore, if you provide any information to parties who operate Web sites that are linked to or from our site, different rules may apply to their collection, use or disclosure of your personal information. We encourage you to review these sites' policies before revealing any sensitive or personal information.

PatientXpress retains personal information only for as long as it is needed to provide our services, to meet our legal, regulatory and contractual obligations, and to resolve disputes. Patient and practice records remain in each practice's own practice-management system and are governed by that practice's retention practices.

• Connected accounts: data from connected third-party accounts (such as email or bank connections) is retained only as described in the sections above, and is deleted when the account is disconnected.
• Customer accounts: when a practice ends its service, we delete or de-identify the data we hold for that practice, except where law or a legal obligation requires us to keep it.
• Deletion requests: you may request deletion of your information at any time by emailing support@patientxpress.us. We will respond within the time required by applicable law.

This retention and deletion policy is designed to comply with applicable privacy laws, including HIPAA and California privacy law, and is reviewed at least annually.

By using this Web site, you consent to the terms of our Online Privacy Policy and to Patient Xpress's processing of Personal Information for the purposes given above as well as those explained where Patient Xpress collects Personal Information on the Web.

If you do not wish to accept cookies in connection with your use of the PatientXpress Platform, you will need to delete and block or disable cookies via your browser settings. You may also choose to restrict our use of your information to maintaining your account on the site or prohibit our disclosure of your information to others, by contacting us and directing us to impose such limits.

If you do not wish us to provide your information to third parties, or otherwise wish us to restrict the use or disclosure of your information, please send us an email at support@patientxpress.us.

In addition, we will not send unsolicited messages to users of our site who indicate that they do not wish to receive such messages. If you do not wish to receive unsolicited email messages from us, please contact us directly.

If you have any questions or grievances about our practices or this Privacy Policy, please contact us at:

It may be necessary from time to time for us to modify this policy to reflect changes in the way we collect and use information or changes in privacy-related laws, regulations, and industry standards. Accordingly, we reserve the right to change this policy at any time by posting the revised policy on this web site. Data will be handled in accordance with the policy in effect at the time the data is used, subject to the user's right to opt out of revisions to this policy implemented since the data was first collected.