Effective date: September 22, 2026
1. Introduction
Medical Database ("we", "us", "our") operates LabNecessity (the "App"), a mobile and web application that helps healthcare providers and billing staff look up whether a lab test is likely to be considered medically necessary for a given diagnosis, payer, and state.
This Privacy Policy explains what information we collect through the App, how we use and share it, and the choices you have. It applies to everyone who creates an account or otherwise uses LabNecessity. By using the App you agree to the collection and use of information as described here.
2. Information We Collect
We collect the following categories of information:
•
Account information: full name, email address, password (stored by our authentication provider in hashed form — we never see or store it in plain text), and the state you select for coverage lookups.
•
Institutional information: if your account is provided through an employer or school, we associate your account with that institution (by matching your email domain) so we can grant the access level your institution has arranged. We do not receive your institution's billing or contract details beyond what an administrator enters (institution name, domain, contract status and expiration, and an optional address, contact email, and contact phone).
•
Usage and check history: each time you run a necessity check, we store the diagnosis codes (ICD-10) you selected, the procedure/test codes (CPT) you selected or entered, the state you selected, and the results returned, along with the date and time. These are the only three inputs the check form takes — there is no field for patient names or other patient details. This lets you review your own check history later.
•
Subscription and payment status: if you subscribe through the App, Apple or Google processes your payment directly — we never receive or store your card number or other payment instrument details. We do receive and store subscription metadata from Apple/Google (plan, billing cycle, status such as trialing/active/canceled, and renewal date) so the App can show you the right access level.
•
Technical information: standard log and diagnostic data generated by our cloud infrastructure (such as IP address, request timestamps, device/OS type, and error logs) as part of operating the App securely and reliably.
3. We Don't Collect Patient Information
LabNecessity is a coverage-lookup tool, not a medical record system, and it is built so that patient-identifying information is never part of what you submit. The necessity-check form only takes three structured inputs — a diagnosis code (ICD-10), a procedure/test code (CPT), and a state — each chosen from a fixed list or validated against the standard code format. There is no free-text field for a patient's name, date of birth, medical record number, or any other identifying detail, so none of that is collected, stored, or transmitted through the App.
4. Informational Purpose Only
Coverage-necessity results shown in the App are generated from the diagnosis codes, procedure codes, and state you enter, and are provided for informational purposes only. They are an estimate to help guide your workflow — not a guarantee of coverage, reimbursement, or how a payer will actually adjudicate a claim, and not medical, legal, or billing advice. Final coverage and payment decisions rest with the applicable payer. We do not use your check history to make any automated decision about you that produces a legal or similarly significant effect.
5. How We Use Information
We use the information described above to:
•
Create and secure your account, and authenticate you when you sign in.
•
Run the coverage-necessity checks you request and show you your check history.
•
Determine your subscription or institutional access level and enforce usage limits.
•
Communicate with you about your account, changes to the App, or support requests.
•
Monitor, secure, debug, and improve the App.
•
Comply with legal obligations and enforce our Terms of Service.
6. How We Share Information
We do not sell your personal information. We share it only in the following circumstances:
•
Service providers: we use Amazon Web Services (AWS Amplify/Cognito) to host the App's backend, authenticate users, and store data, and we use Apple's and Google's in-app purchase systems to process subscription payments and report subscription status back to us.
•
Your institution: if your account is linked to an institution, that institution's administrators can see that your account exists under their domain and its active/inactive status, but not your individual check history.
•
Legal and safety: if required by law, subpoena, or other legal process, or to protect the rights, property, or safety of Medical Database, our users, or others.
•
Business transfers: if we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Privacy Policy or a successor policy.
7. Data Retention
We keep your account information and check history for as long as your account is active, so you can rely on your saved history. If you delete your account, we delete or anonymize your personal information within a reasonable time, except where we need to retain it to comply with legal obligations, resolve disputes, or enforce our agreements.
8. Data Security
We use industry-standard safeguards — including encryption in transit, access controls, and reputable cloud infrastructure providers — to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to promptly address any issues we identify.
9. Security Breach Notification
If we discover a breach of security that compromises your personal information, we will notify affected users, and any regulators or authorities where required, without unreasonable delay and consistent with applicable state and federal breach-notification laws.
10. Your Rights and Choices
Depending on where you live, you may have the right to:
•
Access, correct, or update the personal information in your account (name, email, and state can be edited in the app under Profile).
•
Request deletion of your account and associated personal information.
•
Request a copy of the personal information we hold about you.
•
Withdraw consent, where processing is based on consent, without affecting the lawfulness of prior processing.
11. U.S. State Privacy Rights
LabNecessity is offered only in the United States. A number of U.S. states — including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, and others — have enacted comprehensive privacy laws (e.g. the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Virginia Consumer Data Protection Act, and similar state laws) that give residents of those states rights over their personal information. Where a law gives you these rights, subject to that law's own exceptions and verification requirements, you may:
•
Know and access the categories and specific pieces of personal information we have collected about you.
•
Request deletion of personal information we have collected about you, subject to certain exceptions (e.g. information we must retain for legal, security, or fraud-prevention reasons).
•
Correct inaccurate personal information we hold about you.
•
Obtain a portable copy of your personal information.
•
Opt out of the sale of personal information and of targeted/cross-context behavioral advertising, and opt out of profiling in furtherance of decisions that produce legal or similarly significant effects (we do not sell personal information, engage in targeted advertising, or perform this kind of profiling, so no opt-out action is needed).
•
Not receive discriminatory treatment for exercising any of these rights.
•
Designate an authorized agent to submit a request on your behalf, and appeal a denied request (available under several of these state laws).
12. Children's Privacy
LabNecessity is intended for licensed healthcare providers, billing professionals, and institutional staff/students, and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us so we can remove it.
13. International Users
Our infrastructure is hosted in the United States. If you access the App from outside the United States, your information will be transferred to, stored, and processed in the United States, which may have different data protection laws than your country of residence.
14. Third-Party Links
The App may contain links to third-party websites or resources (for example, a payer's website or public coverage-policy documentation). We are not responsible for, and this Privacy Policy does not cover, the privacy practices or content of those third-party sites. We encourage you to review the privacy policy of any third-party site before providing it with information.
15. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date below and, where appropriate, notify you in the App. Your continued use of LabNecessity after a change becomes effective means you accept the updated policy.
16. Contact Us
If you have questions about this Privacy Policy or want to exercise any of the rights described above (including the state-specific rights in Section 11), contact us at support@medicaldatabase.com. We will verify your identity before fulfilling access, correction, or deletion requests.