Privacy Policy

My Dx Hub Inc (“we”, “us”) is a healthcare technology company. We are not a laboratory and not a medical or dental practice. Your practice orders your tests, independent laboratories perform them, your provider reviews them, and we carry the results into a record that you control.

When a practice uses myDxHub to handle your health information, we act as that practice’s business associate under HIPAA, and we sign the agreements HIPAA requires for that.

Results and records a practice handles through myDxHub are protected health information under the Health Insurance Portability and Accountability Act (HIPAA). We hold them as that practice’s business associate and handle them the way HIPAA requires.

HIPAA does not cover everything we hold. Health information you add yourself, such as the vitals and activity your phone reads from its health store, may not be protected health information; our Consumer Health Data Privacy Policy covers it. Your account details and the way you use this website are not protected health information either. This policy covers them, and we treat all of it with the same care.

• Your account: your name, email address, phone number, and sign-in details. We never see or store your password itself.
• Your health information: lab results, the individual values behind them, images and documents, reports, prescriptions you enter, and related records created by your practice or its laboratories, or added by you.
• Your access history: who opened which of your records, and when. We keep this to protect you, and it is the list you see under Privacy & Access in your account.

• To deliver your results to you and to the providers you have allowed.
• To show your results in plain language, track them over time, and produce reports.
• To send emails about your own care: a new report, a reminder to retest.
• To answer your questions when you contact us.
• To keep the platform safe: recording access, and detecting fraud and misuse.

We do not sell your personal or health information, and we do not use your health information for advertising.

We use only the cookies needed to keep you signed in and to protect your account. There are no advertising trackers and no third-party analytics on this site.

When you create an account on this website, Cloudflare performs a security check intended to distinguish a person from an automated program. To perform that check, Cloudflare receives your IP address and information about your browser and device associated with the sign-up request. Cloudflare does not receive your health records through this check, and myDxHub does not use the check for advertising.

The myDxHub app for iPhone and Android uses the same myDxHub account and the same health records as this website. The rest of this Privacy Policy applies to the app as well. The following information is specific to the app.

• Records on your phone: your health records are not permanently stored on your phone. Results, reports and images are retrieved when you open them. A report or image may be held temporarily in the app’s private storage while you are viewing it and is removed when you close it or when the app locks.
• What the app keeps on your phone: the app stores only the credential needed to keep you signed in. That credential is held using your phone’s protected credential storage, such as the iOS Keychain or Android Keystore. Signing out removes it.
• Your age: before you sign in, the app may ask the App Store or Google Play for the age category associated with your store account so the app can determine whether you are 18 or older. The answer is used on your phone only for that check and is not stored by myDxHub or sent to us.
• Vitals and activity from your phone’s health store (available from version 1.1 of the app; this paragraph takes effect October 25, 2026): if you choose to connect Apple Health or Health Connect, myDxHub can read the health and activity information you authorize, including heart rate, resting heart rate, heart rate variability, sleep, steps, blood pressure, weight, blood oxygen, and blood glucose meter readings (not continuous glucose monitors).You select which categories of information myDxHub may access using your phone’s permission controls. The app reads permitted measurements, creates daily summaries on your device, and securely adds those summaries to your myDxHub record, together with available information identifying the original data source.myDxHub displays recorded measurements and calculated daily summaries without evaluating your health, comparing measurements to clinical reference ranges, providing diagnoses, or generating medical alerts. This feature is not a medical monitoring or emergency alert service.Your health-store information is not sold, used for advertising, or disclosed to healthcare practices unless you separately authorize access for a particular practice. Practice access is disabled by default and can be withdrawn at any time. Information may also be processed by authorized service providers as necessary to operate and secure myDxHub, subject to applicable contractual and privacy protections.You may disconnect your health store at any time to stop future collection, and you may request deletion of previously imported measurements and summaries from myDxHub, subject to applicable legal retention requirements. Disconnecting does not delete the original information from Apple Health or Health Connect. myDxHub does not write measurements back to those services. Our Consumer Health Data Privacy Policy describes your rights over this information.
• Face ID, Touch ID, fingerprints and face unlock: biometric information used to unlock the app remains under the control of your phone’s operating system. myDxHub does not receive your fingerprint, face image or biometric template. The app asks the phone whether authentication succeeded and receives the result.
• Phones signed in to your account: we record information about each phone signed in to your account, including its model, operating system, app version, when it signed in and when it was last used. This lets you review your signed-in devices under Account and sign out a device you no longer use or recognize.
• Photos and files you add: the app uses the camera only when you choose to take a photo and accesses a photo or file only when you choose to add it. Before a photo is stored by myDxHub, location metadata contained in the photo is removed. The myDxHub app does not request access to your device location.
• Error reports: if the app crashes or encounters an error, it may send us technical diagnostic information such as the type of error, a coded description of where in the app it occurred, and the app and operating-system versions. These diagnostic reports are designed not to include your health records or the contents of reports and images.
• Screen capture: the app blocks screenshots and screen recording on screens displaying health records where the operating system allows us to do so.
• No advertising, tracking or third-party analytics: the app contains no advertising, does not use your device’s advertising identifier, and contains no third-party advertising, tracking or analytics software.
• Connecting a hospital or health system: when you connect a hospital or health system patient portal, authentication occurs through the provider’s own secure sign-in process. myDxHub does not receive the password you use with that provider.
• Closing your account in the app: you can begin closing your account from Account > Closing your account. The same 30-day closing process, retention requirements and exceptions described elsewhere in this Privacy Policy apply whether you start the process on the website or in the app.

Apple and Google operate the stores through which their respective apps are distributed and process information under their own privacy policies.

We share information only in these cases:

• With your care team: the providers and practice staff connected to your record. You can see and change that list under Privacy & Access.
• With people you choose: when you create a link to share a report, whoever holds the link can open that report until the link expires or you turn it off.
• With the companies that run the platform for us: the cloud services that store and serve it. Each is bound by a confidentiality agreement and, where health information is involved, by a HIPAA business associate agreement.
• When the law requires it: in response to valid legal process, or to protect the safety of our users and the public.

From your own account, at any time, you can:

• See every provider with access to your record, and end or restore that access.
• Read the history of who has opened your records.
• Create, watch, and turn off the links you have shared.
• Download a complete copy of your records.
• File a request to correct something in your record, in your own words.
• Close your account, in Settings on the website or the Account tab in the app. Your records are removed 30 days later, and you can change your mind until then (how to delete your account).

To ask for something specific to be deleted, or if you cannot sign in, email support@mydxhub.com from the address on your account. We complete it within 30 days. The patient rights page walks through each of these, step by step.

We keep your health records for as long as you have an account. We do not delete them because they have reached a certain age; a record you may need later is not less yours for being old.

When you ask us to delete your records, or you close your account, we remove your records from myDxHub within 30 days, every earlier version of your files with them. Database backups, which we keep so a failure can be recovered from, roll over within 7 days. A single file you remove while your account stays open keeps an earlier version for 90 days, so a mistake can be undone. Your practice keeps its own copy of the records it created, as the law requires of it; that copy is theirs, and questions about it go to them. If a practice ends its use of myDxHub, we remove the practice’s account within 30 days; its patients’ records belong to the patients and stay in their own accounts.

Keeping your records and letting someone see them are two different things, and only the second one expires. When you end a provider’s access, anything they never opened is closed to them right away. Anything they did open stays available to them for 30 days and then ends. You can see exactly what that is, and when each item ends, under Privacy & Access.

Your access history is the one exception. It is kept separately and for longer, because health privacy rules require us to be able to account for who looked at your records. It records who looked at what, not what your results were.

No system is perfectly secure, but this one was built with security first: your records are encrypted while stored and while moving, access is limited to the people you have allowed, and every access is recorded. Our security page explains how. If a breach ever affects your information, we will tell you, and the authorities, as the law requires.

A record for someone under 18 is set up by their practice, with a parent or guardian involved. myDxHub is not aimed at children, and we do not knowingly collect information from a child outside that practice-managed arrangement.

If we make a material change, we will update the date at the top and tell you, in the product or by email, before it takes effect.

Questions about privacy or this policy? Email privacy@mydxhub.com. You can also raise a concern with your practice, or with the U.S. Department of Health and Human Services Office for Civil Rights. We will never treat you differently for asking.