MyHealthVault policy
Privacy Notice
Effective October 11, 2026 · Version 2026-10-11
Scope
This notice explains how MyHealthVault handles information when you create and use a patient-controlled health record. MyHealthVault is not a healthcare provider, health plan, or emergency service. Whether HIPAA applies depends on the service relationship; other consumer privacy and health-data laws may apply regardless.
Information you provide
We process account credentials, profile details, contact information, medical documents, record metadata, allergies, conditions, medications, procedures, reminders, doctor-visit notes, sharing preferences, caregiver details, and support communications that you choose to provide.
Information generated by the service
We generate security and operational information such as sign-in state, consent receipts, temporary sharing sessions, document-access history, notification delivery status, rate-limit counters, error events, and timestamps. Security telemetry is designed to avoid document contents, diagnosis details, medication names, and precise location.
How information is used
Information is used to operate your private record, organize uploaded documents, deliver requested reminders, create time-limited sharing that you initiate, prevent abuse, investigate service failures, provide exports, and honor deletion requests. MyHealthVault does not sell health information or use it for targeted advertising.
AI-assisted document organization
When document scanning is enabled, the original file is sent to the configured AI processor to identify the report type, title, date, time, clinician, and other organization details. For laboratory reports, the processor may also copy quantitative measurements and printed reference ranges into a separate trends-and-review area. These suggestions are not displayed as part of the source record and must be compared with the original document. AI output can be incomplete or incorrect and must not be treated as diagnosis or medical advice. Provider contracts and retention settings must be reviewed before processing real patient documents.
When information is shared
Information is shared only with service providers needed to operate MyHealthVault, when you create access for a doctor or approve family profile management, when you direct an export or integration, when required by law, or when necessary to protect people and the service. Doctor links are scoped, expiring, revocable, and logged.
Retention and deletion
Patient content is retained while the account remains active. When you complete in-app account deletion, active shares are revoked, stored documents and patient records are removed, all sessions are ended, and the authentication account is deleted. Limited security, billing, backup, or legal records may require separate retention only when a documented lawful basis applies.
Security
MyHealthVault uses private storage, encrypted transport, row-level database authorization, server-side access checks, expiring share capabilities, MFA, rate limiting, security headers, and activity records. No system can promise absolute security; users should use a unique password, enable MFA, and revoke unexpected sharing activity.
Your choices and rights
You may review and correct profile information, export structured data, revoke sharing, withdraw optional notifications, and permanently delete the account. Additional access, correction, portability, restriction, objection, or appeal rights may apply where you live.
International use and children
MyHealthVault may process information in countries where its infrastructure and service providers operate. Region-specific transfer terms must be in place before expansion. The account holder must be legally able to consent in their jurisdiction; a verified guardian workflow is required before offering independent accounts to children.
Contact
The monitored privacy email and legal operator address will be published here before public enrollment. During a closed pilot, use the support channel provided with your invitation.