Privacy Policy

1.1This Policy covers personal information collected through the Platform, meaning the MEDCollab website and application, including Clinician applications and profiles, Brand accounts, campaign briefs, messaging, calls, meetings, calendar, approvals and billing, and related communications.

1.2This Policy does not cover third-party websites or services the Platform links to, including a Clinician's own social media profiles, which are governed by those third parties' privacy practices.

2.1 Information Clinicians provide

When a Clinician applies to or maintains an account on the Platform, we collect:

• Identity and contact information: full name, email address, date of birth and account password.
• Professional credentials: professional type, specialty, licence number, licence issuing country and state or province, medical school or university attended, years in practice, board certification status and a self-certification of licence standing.
• Profile content: headshot, professional bio, and social media handles or profile URLs.
• Work preferences and business terms: languages spoken, content categories of interest, opportunity types, comfort with on-camera work, approximate audience size, monthly capacity, rate expectations, category exclusions and existing exclusivity arrangements.
• Application details: how the Clinician heard about the Platform and any referral source.
• Payment and tax information: bank or payout details and tax identification information needed to pay Clinicians and meet tax reporting obligations. This is collected and stored primarily by our payment processor (Section 5.3), and we keep only the minimum needed to administer payments.
• Content and communications: scripts, video, image and audio content, AI Content (Section 2.5), messages, and recordings of calls and meetings held on the Platform (Section 2.4).

2.2 Information Brands provide

When a Brand books a demo, creates an account or runs a Campaign, we collect:

• Business information: company name, business address, website and industry.
• Personnel information: name, job title, business email and phone number of the people using the Platform on the Brand's behalf.
• Billing and payment information, collected primarily by our payment processor (Section 5.3).
• Campaign information: product and marketing details, campaign briefs, scripts and other materials submitted for a Campaign.
• Communications: messages, and recordings of calls and meetings held on the Platform (Section 2.4).

2.3 Information collected automatically

When anyone uses the Platform, we automatically collect technical information such as IP address, device and browser type, pages viewed, referring pages and timestamps, including through cookies and similar technologies (Section 11). For registered users, we also keep a timestamped record of each acceptance of our Terms of Service and of each Campaign Agreement, including the version accepted, the date and time, the IP address and the device used.

2.4 Call and meeting recordings

Calls and meetings held through the Platform are recorded. Recordings, together with any transcripts or summaries generated from them, are used to keep an accurate record of what was agreed, support compliance review, resolve disputes, provide evidence in payment disputes (Section 5.5), and improve our service. Participants are notified that a call is being recorded, and by joining a call or meeting on the Platform each participant consents to it being recorded. Anyone who does not consent to recording should not join the call and should contact us using Section 14.

2.5 AI Content and Digital Replicas

Where a Clinician agrees, as part of a Campaign, that a Brand may create AI Content or a Digital Replica of the Clinician's appearance or voice, that content may contain biometric information such as facial features or voiceprints. In that case:

• a Digital Replica is created only with the Clinician's express consent given for that Campaign on the Platform;
• every item of AI Content must be approved by the Clinician before it is used;
• a Digital Replica may be used only for the Campaign for which it was created and must be deleted by the Brand when the Campaign's licence ends, as set out in the Campaign Agreement; and
• no Campaign Content or Digital Replica may be used to train or fine-tune any AI model beyond creating the Digital Replica permitted for that Campaign.

MEDCollab does not sell, lease or trade biometric information, and does not use it for identification or any purpose other than the Campaign the Clinician approved.

2.6 Information from third parties

We may receive information from third parties, including our payment processor, our customer relationship management provider, public professional licensing databases used to verify credentials, and referral sources.

We use personal information to:

• operate the Platform, including creating and managing accounts, displaying Clinician profiles to Brands, and enabling campaign briefs and applications;
• verify Clinicians' licences and professional credentials;
• run Campaigns, including the approval workflow and MEDCollab's compliance review of Campaign Content;
• process payments, collect amounts due from Brands, pay Clinicians, and meet tax and accounting obligations;
• record, store and review calls, meetings and messages as described in Section 2.4;
• communicate with Clinicians and Brands about their accounts, Campaigns and Platform updates, and, where permitted, send marketing communications;
• feature Brands and Clinicians in MEDCollab's marketing, case studies and promotional materials as permitted by our Terms of Service and the Campaign Agreement, including names, logos, testimonials, excerpts and stills of approved Campaign Content, and Campaign results expressed as percentages, multiples or rates;
• monitor and improve the Platform, troubleshoot issues and develop new features;
• detect, investigate and prevent fraud, abuse, circumvention of the Platform, prohibited conduct and security incidents;
• respond to and defend payment disputes and chargebacks (Section 5.5);
• comply with legal obligations, enforce our agreements, and establish, exercise or defend legal claims; and
• support a merger, acquisition, financing or sale of all or part of our business (Section 5.7).

4.1Where the laws of the European Economic Area, the United Kingdom or a similar jurisdiction apply, we process personal information on the following bases: performance of a contract (to provide the Platform and run Campaigns); legitimate interests (to secure the Platform, keep accurate records, prevent fraud and circumvention, defend payment disputes, market our services and improve the Platform, balanced against individual privacy interests); legal obligation (such as tax and record-keeping); and consent, where we ask for it (such as certain marketing communications and the creation of a Digital Replica).

5.1With Brands. A Clinician's profile information, and any application the Clinician makes to a Brand's campaign brief, are visible to that Brand on the Platform. Approved Campaign Content containing the Clinician's likeness is shared with the Brand for use under the Campaign Agreement. A Clinician's personal contact details are not shared with Brands.

5.2With Clinicians. A Brand's identity and campaign brief are shared with Clinicians so they can review and apply to Campaigns.

5.3Commercial terms. Each party's commercial terms are agreed with MEDCollab individually and are confidential. We do not share one party's commercial terms with another.

5.4Service providers. We share personal information with vendors who provide services to us, including payment processing (Stripe), customer relationship management and email (GoHighLevel), call and meeting recording and transcription, cloud hosting, and identity and licence verification. These providers may use personal information only to provide their services to us.

5.5Payment disputes. If a Brand disputes a payment or initiates a chargeback, we may share relevant records with our payment processor, the card networks and the Brand's bank, including the relevant Terms and Campaign Agreement, acceptance records, Campaign details, messages, call and meeting recordings, submitted and approved content, and evidence of the Brand's use of Campaign Content.

5.6Legal and safety reasons. We may disclose personal information where required by law, legal process or governmental request, or where we believe disclosure is necessary to protect the rights, property or safety of MEDCollab, our users or the public.

5.7Business transfers. We may disclose or transfer personal information in connection with a merger, acquisition, financing, reorganisation, bankruptcy, or sale of all or part of our business or assets, including during due diligence, subject to appropriate confidentiality safeguards. Any acquirer will remain bound by this Policy for information previously collected, except as required by law.

5.8Aggregated and de-identified data. We may create and share aggregated or de-identified data that does not identify any individual, such as category-level performance benchmarks, for any business purpose.

5.9No sale of personal information. We do not sell personal information for money and do not share personal information with third parties for their own cross-context behavioural advertising.

6.1We keep personal information for as long as an account is active and for a reasonable period afterwards to: (a) resolve disputes and enforce our agreements, including non-circumvention obligations, which continue for 12 months after a relationship ends; (b) defend payment disputes and chargebacks; (c) meet tax, accounting and other legal record-keeping obligations; and (d) support the purposes described in Sections 5.7 and 5.8.

6.2Call and meeting recordings are kept for as long as reasonably needed for the purposes in Section 2.4 and are then deleted or de-identified.

6.3Where retention is not otherwise required, we will delete or de-identify personal information within a commercially reasonable period after a valid deletion request under Section 8, subject to the exceptions in Section 8.4.

7.1We use administrative, technical and physical safeguards designed to protect personal information, including access controls, encryption in transit, and due diligence on our service providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7.2We will notify affected individuals and, where required, regulators of any data breach involving personal information in accordance with applicable law.

8.1General. Subject to applicable law and Section 8.4, you may request access to, correction of, or deletion of your personal information, and you may opt out of marketing communications at any time using the unsubscribe link or by contacting us (Section 14).

8.2California and other US state privacy rights. If you live in California or another US state with a comprehensive privacy law, you may have the right to know what personal information we have collected about you, to request its deletion or correction, and to opt out of its sale or sharing (which we do not do) or its use for certain profiling. If you live in a state with a biometric privacy law, you also have the rights that law provides in relation to biometric information (Section 2.5). We will verify your request before acting on it.

8.3EEA and UK rights. If the laws of the European Economic Area, the United Kingdom or a similar jurisdiction apply to you, you may have the right to access, rectify, erase or port your personal information, to restrict or object to certain processing, to withdraw consent where processing is based on consent, and to complain to your local data protection authority.

8.4Exceptions. We may decline or limit a request where necessary to comply with a legal obligation, to establish, exercise or defend legal claims (including payment disputes and non-circumvention), to complete a transaction you requested, or as otherwise permitted by law. For example, we may keep licence verification records, acceptance records, Campaign records and financial records after an account is closed.

9.1MEDCollab is based in the United States, and personal information is processed and stored primarily in the United States. If you are outside the United States, your information will be transferred to and processed in the United States and other countries where our service providers operate, which may have different data protection laws. Where required, we use appropriate safeguards for these transfers.

10.1The Platform is for licensed clinicians and business users and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18, and if we learn we have done so, we will delete it.

11.1We and our service providers use cookies and similar technologies to operate the Platform, remember preferences, understand usage and support our marketing, including through GoHighLevel. You can control cookies through your browser settings, although disabling them may affect how the Platform works.

12.1The Platform may display or link to third-party sites, including Clinicians' own social media profiles. We are not responsible for the privacy practices of those third parties, and this Policy does not apply to them.

13.1We may update this Policy from time to time. We will post the updated Policy with a new effective date and, for material changes, give additional notice by email or on the Platform. Continued use of the Platform after an update takes effect constitutes acceptance of the updated Policy.

14.1Questions, requests or complaints about this Policy or our data practices can be sent to support@medcollab.io.