Privacy Policy

What Information do we Collect?

Data Automatically Collected Through Use of Our Website

MedaSystems automatically collects certain information when individuals access our corporate website. This information does not reveal your specific identity (like your name or contact information). However, it may include device and usage information, such as your IP address, browser, device characteristics, operating system, language preferences, referring URLs, device name, country, geographic location, and information about how and when you use our application and other technical details. This information is primarily needed to maintain the security and operation of our website and for our internal analytics and reporting purposes. 

Like many businesses, we also collect information through cookies and similar technologies. The information we collect includes:

• Log and Usage Data. Log and usage data are service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use the website which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type and settings, and information about your activity in the website (such as the date/time stamps associated with your usage, pages, and files viewed, searches and other actions you take such as which features you use), device event information (such as system activity, error reports and hardware settings).

• Device Data. We collect device data such as information about your computer, phone, tablet, or other devices you use to access the website Depending on the device used, this data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and mobile carrier, operating system, and system configuration information.

• Location Data. We collect location data, such as information about your device's location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the website For example, we may use technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt-out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. Note, however, that if you choose to opt-out, you may not be able to use certain aspects of the website. 

Data Automatically Collected Through Use of the Service

Similar to our corporate website, certain information is automatically collected when individuals use our Service.  Such information includes log and usage data to enable MedaSystems to monitor usage and access to the Service.  In addition, local storage files are generated when a User logs into the Service. These files are stored on the User’s local browser.

Information Submitted by Individuals Through the Website

MedaSystems also collects information from individuals who submit information about themselves through the website (e.g., on the “Contact Us” page).  This information includes email address, name, and company name.  

Information Submitted by Users of the Service

MedaSystems provides the Service to connect health care providers, their staff, life science company employees, consultants, and agents, and/or patients (collectively “Users”) to enable Users to efficiently submit, process and manage requests for access to investigational drugs developed by a Customer. 

Each life science company whose employees, consultants, or agents use the Service (each, a “Customer”) is a contracted customer of MedaSystems.  As such, each Customer ultimately directs MedaSystems how to handle the information or data pertaining to requests submitted to the Customer through the Service, consistent with the Customer’s agreement(s) with MedaSystems, the Terms of Service governing how Users utilize the Service, and applicable law.  The information provided while using the Service is governed by the Customer's privacy policy, except for identifiable information provided by patients/caregivers in connection with an Initial Request (see Section II.B.1), or personal information provided by physicians or physician's staff members for creating or maintaining their MedaSystems accounts (see Section II.B.2), which are governed by this Policy.  

Be advised that Customers may ask physician Users to sign separate legal agreements with the Customer regarding confidentiality and data rights pertaining to information submitted by the physicians to the Customer.  MedaSystems is not a party to any such agreements, and has no involvement with them.  MedaSystems recommends that Users review any such agreements carefully, and consult their legal counsel if necessary.

Initial Requests 

• Information Collected from All Users:  In the process of submitting an initial request through the Service (“Initial Request”), MedaSystems may collect personal information from a User which may include first/last name, mailing address, email address, and phone number.  We convey and store this information based on the way the user initially identifies themselves (either as a physician or as a patient or caregiver), in the following manner:

  • Physicians: From physicians or their staff only, information collected also includes employer name and a brief medical history of the patient on whose behalf the request is being made. No protected health information relating to the patient is requested, and MedaSystems intends that no protected health information be provided. The information submitted in connection with an Initial Request is accessible by both (i) MedaSystems and (ii) the Customer to which the Initial Request is directed.  This Policy governs MedaSystems’ use of that information, while the privacy policy of the Customer governs how the Customer will handle the information.  A link to the Customer's privacy policy appears at the bottom of the Initial Request submission form.  A copy of the policy may also be available on the Customer’s website. 

  • Patients/Caregivers:  If you are a patient or authorized caregiver and have specifically been prompted to make an Initial Request (e.g., by your physician), a different process applies. MedaSystems will notify the appropriate Customer of the fact that you are making an Initial Request and will provide to the Customer only information that cannot be used to identify you (e.g., age, gender, diagnosis). This Policy governs MedaSystems’ use of that information, while the privacy policy of the Customer governs how the Customer will handle the information.  A link to the Customer's privacy policy appears at the bottom of the Initial Request submission form. A copy of the policy may also be available on the Customer’s website. In connection with an Initial Request, if a patient/caregiver provides their name, email address, phone number, mailing address, or any other piece of information that could be used to identify them, MedaSystems will not provide such information to the Customer; such information will be stored by MedaSystems and governed by this Policy.  

Invitations to Clinicians to Create a MedaSystems Account

After an Initial Request has been submitted to a Customer, physician Users (or their authorized staff) may be invited by the Customer to create a MedaSystems account to access the Service to continue the processing of the request, and/or provide additional information to the Customer about the request and/or the patient.  

If you are a physician User we may collect the following information from you when you create an account: name, employer, work address, work email, work phone number, mobile phone number, and information about your professional credentials, including a copy of your curriculum vitae. You will be asked to agree to our Terms of Service. If you are a member of the physician’s staff, you may be asked to provide some or all of this information on the physician’s behalf. In providing this information, you certify that the physician has authorized you to share this information.

Patients and their caregivers are not authorized to create an account or to utilize the Service apart from submitting an Initial Request. If a Customer receives an Initial Request submitted by a patient/caregiver and determines that the request should move forward, the Customer will direct the patient to have their physician contact the Customer directly.  

Additional Information Requested by a Customer

On occasion, a Customer may ask a physician or their authorized staff member(s) to provide additional information about the physician or their patient beyond what is collected by MedaSystems when the User’s MedaSystems account is created.  These requests will be sent by a Customer representative to the physician/staff member User through the Service. 

Examples of additional information a physician may be asked to provide includes: a prior treatment history, lab results, medical images, proposed treatment plans including risk/benefit statements, information about where medications should be shipped, requests for initial supply and re-supply, and information about how the patient is reacting to the treatment.   

Any information requested and provided in this manner will be governed by the privacy policy of the applicable Customer, and/or the agreement between the physician and the Customer (if applicable). 

Phone Numbers for Two-Factor Authentication (2FA)

When you provide your phone number to enable two-factor authentication (2FA), MedaSystems collects and securely stores this information solely for the purpose of securing your account.

• Purpose of Collection: Phone numbers are used exclusively to send SMS-based verification codes for account login and recovery.

• Data Security: MedaSystems encrypts and securely stores all phone numbers collected for 2FA purposes. These numbers are not used for marketing or any purpose unrelated to account security.

• Prohibition of Sharing: Phone numbers collected for 2FA are not shared, sold, rented, or traded with any third parties.

You may opt out of receiving SMS messages for 2FA at any time by replying "STOP" to any SMS message. However, opting out may limit your ability to use certain features of the Service that require 2FA.