Legal

Privacy & Security Policy

How MedVision, built and operated by Vision Infinity, collects, protects and uses information for clinics and their patients — across the app, WhatsApp, Instagram, Messenger, phone and web enquiries.

Encrypted in transit & at rest
TLS for all traffic, encrypted database storage, no plaintext credentials.
Per-clinic data isolation
Each clinic's patient records are logically separated at the database level. No cross-clinic access, ever.
Role-based access
Staff see only what their role permits. Every record change is logged with who made it and when.
Built for regulated healthcare data
Architecture and handling practices are designed around HIPAA-style safeguards for patient information — access control, audit trails, minimum-necessary data use and breach response readiness.
Last updated 10 September 2026

1 Who this policy covers

This policy applies to MedVision, a practice revenue and communications system built and operated by Vision Infinity ("we", "us", "our"). It covers our website, our web application (the CRM clinics use daily), and the messaging channels we connect on a clinic's behalf — WhatsApp Business Platform, Instagram, Messenger, phone and web enquiry forms.

2 Information we collect

  • Clinic staff accounts: name, email, phone number, role and login activity.
  • Patient and enquirer information: name, phone number, email, messages exchanged through WhatsApp, Instagram, Messenger, website forms or phone, appointment and treatment-course details, and attendance history.
  • Message content: the content of enquiries and conversations, so we can route, log and respond to them accurately.
  • Usage & device data: pages visited, actions taken in the app, browser/device information, and system logs kept for security and troubleshooting.

3 How we use this information

  • To respond to patient enquiries and route them to the right clinic staff member, day or night.
  • To manage appointment reminders, recall and follow-up for unfinished treatment courses.
  • To generate the dashboard reporting and "revenue at risk" summaries clinics see.
  • To operate, secure and improve MedVision, and to support clinics using it.
  • To meet legal, regulatory and contractual obligations.

4 Meta platforms — WhatsApp, Instagram, Messenger

Where a clinic connects its WhatsApp Business, Instagram or Messenger account to MedVision, we access and process messages sent through those channels solely to deliver the service the clinic configured — answering enquiries, logging conversations and triggering reminders. We do not use this data for advertising and we do not sell it. Our use of data received via Meta Platforms is subject to Meta's Platform Terms and Developer Policies, in addition to this policy.

5 Security & compliance

Because MedVision handles patient health-adjacent data, we build and operate it with healthcare-grade safeguards in mind:

  • Encryption of data in transit (TLS) and at rest.
  • Role-based access control, so staff only reach the records their role requires.
  • Full audit logging — every access or change to a patient record is tied to a user and a timestamp.
  • Per-clinic data isolation at the database level, preventing any cross-clinic access.
  • Minimum-necessary data handling: we process what is needed to run the workflow a clinic has enabled, nothing more.
  • A documented breach-notification process for clinics and, where required, affected individuals.
These practices are designed to align with the safeguards required under frameworks such as HIPAA (US) and equivalent regional healthcare data regulations. Where a clinic requires a formal signed agreement — such as a Business Associate Agreement — this is arranged directly with that clinic as part of onboarding, alongside any region-specific requirements that apply to them.

6 Data storage and separation

Data is stored in a database region chosen to suit each clinic's location. Each clinic's records are logically separated so no other clinic can reach them, and every change to a patient record is logged with who made it and when.

7 Sharing of information

We do not sell personal information. We share data only with:

  • The clinic that owns the patient relationship — this is the core purpose of the service.
  • Infrastructure and communication providers used to operate the service (for example, database hosting and messaging platform providers), bound by confidentiality and data-processing terms.
  • Authorities, where required by law.

8 Data retention and export

Clinics can export their data as a spreadsheet from inside the app at any time. Data is retained for as long as a clinic's account is active, or as needed to meet legal obligations, after which it is deleted or anonymised on request.

9 Your rights

Depending on your location, you may have the right to access, correct, export or request deletion of your personal information. Patients should contact the clinic they interacted with directly, since the clinic controls that relationship; clinics can reach us using the details below.

10 Changes to this policy

We may update this policy as MedVision evolves. The "last updated" date above always reflects the most recent revision.

11 Contact us

Questions about this policy or how your data is handled can be sent to team@visioninfinity.tech or +1 929-820-8036.