SYNC.MD PRIVACY AND SECURITY NOTICE

Last updated: Aug 18, 2026

What Information Does SyncMD Collect?

SyncMD collects only the information necessary to provide the services you request.

This may include:

Personal Information

Name
Date of birth
Address
Email address
Phone number

Health Information

Medical records and reports
Lab results
Insurance and Medicare-related documents
Forms and authorizations
Any health information you upload or authorize to be shared

Technical Information

Device and browser type
IP address
Basic usage data required for secure system operation

Sync.MD does not collect information for advertising purposes.

How Does SyncMD Use Your Information?

We use your information only to:

Provide access to your Personal Health Record
Securely store and exchange your records
Process record requests you initiate
Verify your identity
Maintain system security
Comply with legal requirements

SyncMD does not use your information for:

Marketing emails
Targeted advertising
Data sales
Behavioral profiling
Automated decision-making that affects your rights or healthcare

Does SyncMD Sell My Information?

No.

SyncMD does not and will not sell, rent, trade, or monetize your personal or health information.

We do not engage in targeted advertising or cross-context behavioral advertising.

Who Can See My Information?

You control who has access to your records. You may revoke sharing permissions at any time through your account settings.

SyncMD shares your information only:

With organizations or individuals you authorize
With trusted service providers that help operate our platform
When required by law
In connection with a business transfer (with advance notice and user options)

SyncMD is required to obtain express documented consent to the terms of the Privacy Policy from the Individual prior to the access, exchange, Use, or Disclosure of your personal information, other than disclosures that are required by applicable law.

SyncMD may need to disclose or be required to disclose information about you in specific legal situations. Individuals will receive a written or electronic notice within 3 business days of:

Receiving a legal demand for their PII (personally identifiable information), unless prohibited by law
Making your PII available to law enforcement, including through sale

Third-party disclosures to authorized recipients, service providers, or other entities that have already received information may retain or further process the information in accordance with their own legal obligations and practices, which may be outside of SyncMD’s direct control.

Can I Revoke Consent, Download, or Delete My Information?

Yes.

You may:

Download your records
Modify sharing settings
Revoke access
Request correction or annotation
Request account deletion

To revoke consent:

Go to Profile.
Scroll down to ‘Terms and Conditions’
Select Agreement
Select Decline
Select Revoke Consent

To delete your account:

Go to Profile.
Scroll down to ‘Delete account’.
Type in last name.
Add comment if desired.
Delete account and confirm.

If you withdraw consent for sharing, future disclosures will stop. Organizations that already received your information may retain copies in accordance with their own legal obligations.

How Long Is My Information Stored?

SyncMD operates as a persistent Personal Health Record platform.

Your information remains in your account until:

You delete specific records, or
You request account deletion

A SyncMD account may be considered “Dormant” if the account holder has not logged into or otherwise accessed the SyncMD Services for an extended period of time. If an account remains inactive, SyncMD may classify the account as Dormant. In accordance with SyncMD’s data retention practices described in the Privacy Policy, SyncMD generally retains Dormant accounts and associated information for up to ten (10) years from the date of the user’s last recorded activity. After this period of inactivity, SyncMD may deactivate, archive, or delete the account and associated information in accordance with its records management and data retention policies, unless a longer retention period is required or permitted by applicable law.

If you request account deletion, it is processed within 24–48 hours.

How Does SyncMD Protect My Information?

SyncMD uses administrative, technical, and physical safeguards to protect your information. We make reasonable efforts to protect your information from unauthorized/illegal access, modification, use, or destruction.

When SyncMD uses a third-party service provider that needs access to your identifiable information to provide services on our behalf, we require that provider to protect your information and use it only for authorized purposes. Our requirements include appropriate privacy, confidentiality, and security safeguards; limiting access to individuals who need the information to perform their services; protecting information from unauthorized access, use, or disclosure; promptly reporting security incidents; and securely returning or deleting information when it is no longer needed, as applicable.

Where required by law or appropriate based on the services provided, SyncMD also requires written agreements addressing the provider’s privacy, security, and data protection responsibilities. We do not permit service providers to sell or use your identifiable information for their own advertising, marketing, or other unauthorized purposes.

Security measures that SyncMD uses and requires of its vendors include:

Encryption of data in transit and at rest
Secure authentication controls
SMART on FHIR OAuth 2.0 authorization framework
Identity assurance practices aligned with industry standards
Access controls and audit logging

If a confirmed data breach occurs, SyncMD will notify affected individuals without unreasonable delay and no later than 30 days after confirmation, unless a shorter timeframe is required by law.

Does SyncMD Use Artificial Intelligence or Automated Decisions?

SyncMD does not use artificial intelligence, profiling, or automated decision-making systems that affect your legal rights, healthcare treatment, or access to services as part of standard SyncMD services. AI processing occurs only when a user affirmatively opts into the separate, optional Sync.Sense service.

Does SyncMD Use My Data for Research?

SyncMD may create de-identified data by removing information that identifies you.

De-identified data:

Cannot reasonably identify you
Is used only internally
Is not sold
Is not shared for commercial purposes

SyncMD prohibits re-identification of de-identified data.

What About Genetic or Family Information?

Some health information, such as genetic test results or family medical history, may indirectly reveal information about relatives. You should consider these implications before sharing such information.

What Happens If SyncMD Is Sold or Merges?

If SyncMD is sold, merged, or transferred:

You will receive advance notice
You will have the opportunity to download your data
You may request deletion of your account before the transfer

Who Oversees Privacy and Security?

SyncMD has designated a Compliance Program Coordinator responsible for privacy and security oversight.

You should report any suspected unauthorized access, disclosure, or security incident involving your SyncMD account or personal information by contacting security@syncmd.com or (864) 642-1117.

If you have questions or concerns, contact:

help@syncmd.com

You may also submit complaints to:

The Federal Trade Commission (FTC)
Your State Attorney General

Will I Be Notified of Privacy Changes?

Yes.

If SyncMD makes material changes to how your information is handled:

You will receive notice
You will be required to affirmatively accept the updated terms before continuing to use the app

Is SyncMD a Bidirectional IAS Provider?

No.

REQUEST-ONLY IAS PROVIDER: SYNCMD DOES NOT PROVIDE BIDIRECTIONAL SERVICES. YOU WILL HAVE THE ABILITY TO REQUEST ACCESS TO YOUR HEALTH INFORMATION VIA TEFCA EXCHANGE. YOU WILL NOT BE ABLE TO USE SYNCMD TO SHARE YOUR HEALTH INFORMATION WITH OTHER PARTICIPANTS IN TEFCA.

All disclosures through TEFCA are in accordance with the Common Agreement and HHS guidance.

Can Your Information Be Accessed, Exchanged, Used, and/or Disclosed by SyncMD to Assert Any Type of Claim Against You?

No, your personal information cannot be used to assert claims against the Individual except for collection of fees.

Is SyncMD Subject to HIPAA?

No, as a personal health record, SyncMD is not subject to the Health Insurance Portability and Accountability Act (HIPAA Rules) as a matter of law.

SyncMD is required to act in conformance with the Privacy and Security Notice and must protect the security of the information it holds in accordance with the applicable Framework Agreement. Obligations under the Notice continue as long as SyncMD maintains your personal information.

Does SyncMD Charge Fees?

SyncMD is a free app you can download on your smartphone, where you can upload, store, and share your medical records without cost. Patients can verify their identity to automatically access records from participating providers and connect their patient portals with login credentials where an integration exists for free.

Patients who send a records request to a private provider, clinic, or hospital using the app will be charged a $6.50 service fee for records collection. Requests to VA facilities do not have a fee. When payment is authorized, a ‘hold’ may be placed on your account for the $6.50 amount. You will only be charged the $6.50 service fee when your request is successfully fulfilled. Any rejected or unfulfilled request will be automatically canceled and refunded after 30 days.

SyncMD also offers certain premium features available through a paid subscription, including expanded access to SyncMD’s A.I. Assistant, Sync.Sense.

Where Can I Learn More?

For full details, please review: