Privacy Policy

Account information. Your name, email address, and a hashed password. We never store passwords in plain text.

Content you submit for scanning. The marketing materials you ask MedScan to review — pasted text, uploaded documents and images, and the content of URLs you submit. We keep scanned content and scan results in your scan history so you can build submission packages, track revisions, and show your work later.

Invite requests. If you request a pilot invite, we keep the name, email, website, and details you provide so we can review and respond.

Session and log data. Standard technical records — IP address, browser user agent, and timestamps — tied to sign-ins and requests, used for security and abuse prevention.

MedScan analyzes your content using Anthropic's Claude API. The content you submit is sent to Anthropic for analysis and the findings are returned to you. Anthropic does not use API data to train its models by default. We do not use your content to train models, and we do not sell it to anyone.

When you scan a URL or set up a drift monitor, our crawler fetches that page the way a browser would. It identifies itself honestly — see About our crawler.

The service providers required to run MedScan: Anthropic (AI analysis), Railway (hosting), and Resend (transactional email such as password resets). Each receives only what it needs to perform its function.

On our public pages only, we also share limited browsing data with Google Analytics and Meta (Facebook) so we can measure our advertising — see Cookies and analytics below. We never send them anything you scan, upload, or store in MedScan, and we do not sell your personal data.

We may disclose information if required by law, or to protect the rights, safety, or security of MedScan and its users.

MedScan uses a session cookie to keep you signed in. It is required for the product to work and is never used for advertising.

Our public pages — the marketing site, blog, pricing, and the sign-in and sign-up screens — also run Google Analytics and the Meta (Facebook) pixel. These set third-party cookies and tell Google and Meta which pages you visited, so we can understand which ads bring people to MedScan. Meta can match that activity to a Facebook or Instagram account if you have one.

None of this runs once you sign in. Every page under your dashboard — scanning, materials, monitors, filing tools — loads no analytics or advertising scripts of any kind. The content you scan, the URLs you check, and the materials you store are never exposed to an advertising network.

To block the public-page tracking entirely, use your browser's Do Not Track or tracker-blocking setting, or any standard content blocker. Doing so has no effect on your ability to use MedScan.

Scan history and materials are retained while your account is active so version-diff and submission-package features work. You can delete individual scans from your dashboard.

To delete your account and all associated data, email brett@ehlertmarketing.com from your account address. We complete deletion requests within 30 days.

All traffic is encrypted in transit over HTTPS. Passwords are hashed. Access to production data is limited to the operator of the service. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you promptly.

MedScan reviews marketing materials— it is not built to receive Medicare beneficiary information, protected health information, or enrollment data. Please don't submit content containing beneficiary PHI; if you do so inadvertently, delete the scan from your history and contact us to confirm removal.

If this policy changes in a way that matters, we'll note it here with a new effective date and, for material changes, email account holders. Questions: brett@ehlertmarketing.com.