Privacy Policy

Last updated: October 05, 2026

This privacy policy governs your use of the Medblocks software applications (the “Application,” including Medblocks Platform) and your use of our website. It explains what information we collect, how we use and share it, and the choices you have. Where a practice applies only to a specific type of data - such as health data synced through Medblocks Platform, or Medicare data obtained through the CMS Blue Button API — that is stated explicitly within each section below.

You do not need a Medblocks account to exercise your privacy choices. If you have connected your records through a magic link sent by an organization, you can disconnect and permanently delete your data at any time through the Delete your data page or by contacting privacy@medblocks.com, as described under “Your Choices and Controlling Your Information” below.

Information We Collect

Account and user-provided information. Registration is optional for the website, but some features require it. When you register and use the Application, you may provide your name, email address, age, username, password, and other registration details; transaction-related information (purchases, offers, downloads); information you provide when contacting us for help; credit card information for purchases; and information you enter into the Application, such as contact or project details.

Automatically collected information. The Application may automatically collect the type of device used, a unique device ID, your IP address, your operating system and browser type, and information about your use of the Application.

Cookies and analytics. We use cookies and similar technologies to operate our website and to understand how it is used, including through third-party analytics services. You can control or disable cookies through your browser settings, though some features of the site may not function properly without them.

Precise location. This Application does not collect precise real-time location information about your device.

Health data (Medblocks Platform - Apple HealthKit and Google Health Connect). With your explicit consent, Medblocks Platform may collect health and fitness data from your device through Apple HealthKit (iOS) or Google Health Connect (Android). Some of this data is sensitive personal data and receives special protection. The categories that may be accessed include:

Heart rate, resting heart rate, heart rate variability, and oxygen saturation
Step count, active energy burned, and walking or running distance
Blood pressure and blood glucose levels
Body measurements such as weight, height, body fat percentage, and body temperature
Respiratory rate
Sleep sessions and sleep stage information
Exercise and workout sessions

Medblocks Platform only reads data from HealthKit and Health Connect; it does not write data to these platforms.

Medicare data (CMS Blue Button API). We obtain Medicare data only after you connect your Medicare account and explicitly authorize the connection through Medicare’s own authorization process. We never ask for, receive, or store your Medicare.gov login credentials, and we cannot access your Medicare account without your authorization. When you authorize the connection, we may obtain your Medicare Parts A, B, and D claims data from the Centers for Medicare & Medicaid Services (CMS), which may include claims for hospital and inpatient services (Part A), claims for doctor visits, outpatient care, and medical services (Part B), prescription drug claims (Part D), and related coverage, provider, and cost information contained in those claims.

We retrieve your Medicare data on an ongoing basis: after you authorize the connection, your Medicare data is refreshed automatically while your Medicare account remains connected to Medblocks, so that the information stays up to date. This continues until you disconnect or revoke access, as described under “Your Choices” below.

How We Use Your Information

General account and website data. We may use this information to operate and improve the Application and to contact you periodically with important information, notices, or marketing promotions.

Health data (Medblocks Platform). Health data is used solely to provide the core functionality of the service - syncing your health information with your Medblocks account to support your health management and to enable you to share it at your direction, with the organizations and services you choose. It is not used for advertising, marketing, or use-based data mining, and is not sold or transferred to third parties for advertising or marketing purposes.

Medicare data (CMS Blue Button API). We use your Medicare data only to provide it, at your direction, to the organization that is providing services to you which you authorize when you connect your Medicare account through Medblocks. To do this, we also store, process, transmit, and secure your Medicare data as necessary to operate the service, and we may disclose it when we are legally required to, such as in response to a subpoena or court order. We do not use your Medicare data for advertising, marketing, or use-based data mining, and we do not sell or rent it, or transfer it to third parties for advertising or marketing purposes.

General account and website data. Only aggregated, anonymized website and usage data is periodically transmitted to external services for Application improvement purposes. Beyond that, we share this information only: as required by law (for example, to comply with subpoenas); when disclosure is necessary to protect rights or safety, investigate fraud, or respond to government requests; and with trusted service providers who work on our behalf under strict confidentiality.

Health data (Medblocks Platform). Health data is shared only at your direction - for example, with the healthcare providers you choose. We do not otherwise disclose it to third parties, and we do not sell it.

Medicare data (CMS Blue Button API). Medblocks is used by organizations that provide services to you. If you access Medblocks through such an organization, you log in and authorize the connection to your Medicare account yourself, and your Medicare data is then made available to that organization so that it can provide its services to you. We disclose your Medicare data to that organization because you have explicitly authorized this disclosure as part of using the service. We do not disclose your Medicare records to any other individual or third party without your specific, explicit consent, except as required by applicable law, such as in response to a subpoena or court order.

The organization you authorize is responsible for its own use of your data once you have directed it to them, in accordance with its own privacy practices and the laws that apply to it. Our disclosure of your Medicare data is limited to the organization you have authorized.

When we use trusted service providers to operate the service (for example, infrastructure hosting and monitoring), they may process Medicare data only on our behalf and are bound by data-protection obligations consistent with applicable law and the sensitivity of the data.

We do not share de-identified or anonymized Medicare data with third parties.

Information about others. Your health data and Medicare claims data may occasionally contain or reveal information about other people, such as family members or caregivers - for example, family medical history recorded in your records. When you direct us to share your data with an organization, that information is shared along with it. Please consider this before authorizing any sharing, as we cannot separate information about others from your records.

AI clients you connect (MCP server). Data is shared with an AI client only through the MCP server, and only when you explicitly initiate it. Connecting an AI client to our MCP server requires you to authenticate and authorize the connection, and during this authorization we ask for your consent to share records with the AI client. No data flows to any AI system unless you have consented and then actively query your data through your chosen client. The data shared is limited to what your query requests, and it is used solely to answer that query within your own AI session. We do not use any data to train AI models, and we do not share any data with AI providers ourselves. You can opt out at any time by disconnecting the MCP integration, which revokes the connection on our end, after which no further data can be accessed by the AI client.

Data Retention and Deletion

General account and website data. User-provided data is retained as long as you use the Application and for a reasonable period thereafter. Automatically collected data is retained for up to 24 months and then stored in aggregate form. To request deletion of your user-provided data, contact privacy@medblocks.com; note that some data may be required for the Application to function.

Health data (Medblocks Platform). Health data is retained on Medblocks servers for as long as your account remains active and you maintain an active connection with Medblocks Platform. You may delete all synced health data at any time using the “Delete Account” option within the Application, or by contacting privacy@medblocks.com. Deletion from our servers does not affect the original data stored on your device in HealthKit or Health Connect.

Medicare data (CMS Blue Button API). We retain your Medicare data for as long as your Medicare connection remains authorized, or until you request deletion. You do not need a Medblocks account to request deletion. You may request permanent deletion of your Medicare data at any time:

On the Delete your data page, where you sign in with a patient portal login you already use and can see and manage every connection associated with you
From your Medblocks dashboard, if you have your own workspace
Or by contacting privacy@medblocks.com.

Once you request deletion (or the workspace or account holding your data is deleted), your Medicare data is permanently deleted from our servers within 7 days, except for any limited information we are required to retain by law. We do not automatically delete Medicare data due to inactivity; your data remains with us until you request its deletion.

Your Choices and Controlling Your Information

Opt-out and marketing. You can use standard uninstall processes via your device or app marketplace or unsubscribe from the emailing list or request to opt out of data collection or marketing emails by emailing privacy@medblocks.com.

Accessing your information. You may request a copy of the data we hold about you, including your health data including Medicare data, by contacting privacy@medblocks.com.

Health data (Medblocks Platform). You may review and modify which health data types Medblocks Platform can access at any time through your device settings:

On iOS: Settings > Health > Data Access & Devices > Medblocks Platform
On Android: Settings > Health Connect > App permissions > Medblocks Platform

Revoking access prevents Medblocks Platform from collecting new data of the specified types. Previously synced data remains on Medblocks servers until you request its deletion.

Medicare data (CMS Blue Button API). You may disconnect your Medicare account from Medblocks at any time. You do not need a Medblocks account to request deletion. You may request permanent deletion of your Medicare data at any time:

On the Delete your data page, where you sign in with a patient portal login you already use and can see and manage every connection associated with you
From your Medblocks dashboard, if you have your own workspace
Or by contacting privacy@medblocks.com.

Revoking access stops Medblocks from retrieving any new Medicare data. Medicare data already retrieved before you disconnect remains with us until you request its deletion, as described under “Data Retention and Deletion” above. To have your Medicare data permanently deleted, use the Delete your data page or contact privacy@medblocks.com.

AI clients (MCP server). You can disconnect an AI client from your Medblocks account at any time. Once disconnected, the AI client can no longer access any of your data.

Security

We safeguard your information using physical, electronic, and procedural measures, and limit access to authorized personnel who need it to operate, develop, or improve the Application. No system can guarantee complete security. Health data and Medicare data are transmitted to Medblocks servers over encrypted HTTPS connections and stored in dedicated databases with restricted access. The databases storing this data are encrypted at rest, including the access and refresh tokens used to connect to your Medicare account, and access to those tokens is restricted to the systems and personnel that require it to operate the service.

How HIPAA, the Privacy Act, and Other Laws Apply to Your Medicare Data

You obtain your Medicare data through the CMS Blue Button API by exercising your individual right to access your own health information and directing it to Medblocks. While your Medicare records are held by CMS, they are protected by the Privacy Act of 1974 and other federal law. Once you direct that data to Medblocks, the laws that apply depend on the organization you use Medblocks with and the nature of that organization’s work, and may include the Health Insurance Portability and Accountability Act (HIPAA) and state privacy laws. Where HIPAA applies to a particular engagement, we handle your Medicare data in accordance with its requirements.

Regardless of whether HIPAA applies, we are subject to other applicable laws, including the Federal Trade Commission Act and the FTC Health Breach Notification Rule. We apply administrative, technical, and physical safeguards designed to protect your Medicare data, consistent with the sensitivity of health information and with applicable law. We comply with the privacy and security obligations that apply to us under the CMS Blue Button API terms and applicable law.

Data Breach Notification

If we discover a security or data breach affecting your personal information, we will notify you in accordance with applicable law. For breaches affecting your health data or Medicare data, this includes notification consistent with the Federal Trade Commission’s Health Breach Notification Rule where it applies. Our notification will describe, to the extent known: what happened and when; the types of information involved; the steps you can take to protect yourself; what we are doing to investigate, mitigate harm, and prevent recurrence; and how to contact us with questions.

Children

We do not knowingly collect data from or market to children under 13 years old. If a parent or guardian believes their child has provided us information without consent, contact privacy@medblocks.com for prompt deletion.

Changes to This Policy

This Privacy Policy may change over time. Updates will be posted here, and you may be informed via email or text. Where a change affects how we handle your health data or Medicare data, we will notify you, describe what has changed, and give you the opportunity to review the updated terms and to opt out, disconnect, or request deletion before the change takes effect. We will not rely on your continued use alone as acceptance of a material change to how your health data or Medicare data is used. If you are connected through an organization, we will also require that organization to relay the notice to you. You can act on any such notice without a Medblocks account, through the Delete your data page or by contacting privacy@medblocks.com.

If Medblocks Is Sold or Transferred

If Medblocks is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy. For your Medicare data specifically, we will give you the opportunity to opt out or delete your data before it becomes subject to a different policy.

By using the Application or visiting our website, you consent to our processing of your information as outlined in this policy. Processing may involve collecting, storing, using, or disclosing information in the United States, regardless of your country of residence. Access to your Medicare data requires your separate, explicit authorization through Medicare’s authorization process, as described above.

Non-Endorsement Notice

This product uses the Blue Button APIs but is not endorsed or certified by the Centers for Medicare & Medicaid Services or the U.S. Department of Health and Human Services.

Contact Us

For privacy-related questions or concerns, contact us at privacy@medblocks.com.