Legal

Privacy policy

Last updated October 15, 2026

1.Who this covers

This policy explains what MedFind AI collects and why, for the website at medfindai.com and the app at app.medfindai.com (together, the "Service"). MedFind AI is based in Lexington, Kentucky, USA. Using the Service means you accept this policy and the Terms of Service.

2.Account information

• Email sign-up: your email address, the name you enter (optional) and your password. The password is stored only as a one-way hash, so nobody at MedFind AI can read it.
• Google sign-in: only your name and email address (and Google's account ID, used to recognize you next time). MedFind AI does not see your Google password, contacts, files or anything else in your Google account.
• Preferences: settings you choose, such as a default location or pinned specialties.
• Plan details: which plan you are on and how many free searches you have used.
• Sign-up check: a scrambled (salted hash) form of the network address you signed up from, used only to stop one person from creating many free accounts. The address itself is not stored.

This information is used to sign you in, run the Service, send the emails you need (such as email verification and password resets) and prevent abuse. It is never sold and never used for advertising. Google user data is used only to sign you in and is not shared with anyone else.

3.Searches, locations and shared links

When you are signed in, each search you run is saved: what you typed, the location you searched near (a city, ZIP code or your device's location if you allow it) and the results. This is stored so that:

• the extra results (“Show more”) and AI details you open for that search can be added to it, and
• you can create a shared link to send results to someone else. A shared link holds a copy of the results you chose to share, and anyone with the link can open it. Shared links stop working after 30 days.

Searches run without an account are not saved to a history.

4.Free searches without an account

Visitors can try a small number of searches without signing up. To count them, MedFind AI keeps a scrambled (salted hash) form of your network address and a small cookie with the count. The raw address is not stored.

5.Services MedFind AI relies on

A few outside companies handle parts of the Service. Each one gets only what it needs for its job and handles that data under its own privacy policy:

• Google (Maps Platform and Gemini): your search text and location are sent to Google to find nearby places, distances, hours and map data, and to summarize what a facility offers. See the Google Privacy Policy.
• Stripe: handles all payments. Your card details go directly to Stripe and never touch MedFind AI's servers. MedFind AI receives only what it needs to manage your plan, such as a customer ID and whether a payment went through. See the Stripe Privacy Policy.
• Resend: sends account emails (email verification and password resets) to your address. See the Resend Privacy Policy.
• Cloudflare Turnstile: checks that sign-ups, sign-ins and free searches come from a person and not a bot. It may look at your network address and basic browser and device signals. See the Turnstile privacy addendum.
• LogRocket: session recording, described in the next section.
• Hosting: the app and its database run on cloud hosting providers in the United States.

Facility information also comes from public U.S. government datasets (CMS NPPES, HRSA and CMS Care Compare) and from insurer directories. These sources receive nothing about you.

6.Session recording

MedFind AI uses LogRocket to record how pages are used (clicks, page views and errors) so problems can be found and fixed. Everything you type into a form or search box is masked and is not captured in recordings. The contents of what the app sends and receives (such as passwords, search text and results) are not recorded, secret codes are removed from recorded page addresses (such as password-reset and shared-link codes), and the search text, earlier searches, shared-link lists and results shown on the page are hidden from recordings as well. When you are signed in, recordings are linked to your account email and plan so a reported problem can be traced.

On the medfindai.com website, recording starts only if you click Accept in the cookie box. See the LogRocket Privacy Policy.

7.Cookies

• Session cookie: keeps you signed in.
• Anonymous search counter: counts the free searches used before you have an account.
• Sign-in security cookies: short-lived cookies used during Google sign-in.
• Turnstile and LogRocket may store their own small cookies or browser storage to do their jobs.

There are no advertising cookies. Blocking cookies in your browser will stop sign-in from working.

8.Keeping and deleting your data

• Your account, search history and shared links are kept while your account exists.
• Deleting your account from the account page permanently removes your account, your search history and your shared links, and cancels any subscription. It cannot be undone. Usage records (which kind of lookup was made, when, and its cost) are kept only in anonymous form, with nothing linking them to you, so service costs can still be counted.
• To stop the free searches being claimed over and over by deleting and re-creating accounts, a one-way scrambled fingerprint of the email address and of the network an account was created from (never the address or the network itself), and the number of free searches used, are kept for 90 days after an account is deleted. A scrambled fingerprint of the account's internal ID is kept with them, only so that a payment arriving after the account is gone can be refunded. After 90 days these records are no longer used, and they are deleted at the next routine cleanup.
• Shared links stop working 30 days after they are created.
• Payment records stay with Stripe, which keeps them as tax and financial laws require.
• Short-lived security records (such as rate-limit counters) expire on their own.

To ask for a copy of your data, or for help deleting it, email info@medfindai.com.

9.No selling, no ads

MedFind AI does not sell personal information, does not share it for advertising and does not use it to target ads. Information is disclosed only to the services listed above to run the Service, when the law requires it, to protect the safety of users or the Service, or as part of a sale or merger of the business (in which case this policy continues to apply).

10.Health details

Searches can describe a health need. MedFind AI is not a healthcare provider or health plan, and the Service is not covered by HIPAA. Please describe the kind of care you need without names, dates of birth, member IDs or other details that identify a person.

11.Security

Connections are encrypted, passwords are hashed and access to data is limited. No system is perfectly secure, though, so keep your password private and contact info@medfindai.com if you think your account has been misused.

12.Children

The Service is not for children under 13, and children under 13 may not create an account. If you believe a child under 13 has provided information, email info@medfindai.com and it will be deleted.

13.Where data is handled

MedFind AI is a U.S. business, and data is stored and processed in the United States. If you use the Service from another country, your information is transferred to the United States.

14.Changes to this policy

This policy may be updated as the Service changes. The date at the top shows the latest version. For significant changes, signed-in users will be told by email or in the app before the change takes effect. Continuing to use the Service after a change means you accept the updated policy.

15.Contact

MedFind AI, Lexington, Kentucky, USA. Email info@medfindai.com.

See also the Terms of Service.