Privacy Policy

1. Introduction

This Privacy Policy explains how Untappd Labs Inc., doing business as MedFX (“MedFX,” “we,” “us”), collects, uses, shares and protects information when you visit medfx.com or use our payment services. It applies to clinics and their staff, to patients and other people who send us a payment, and to visitors to our website.

We act as a controller of personal data we collect for our own purposes, such as verifying clinics and meeting our legal duties. Where we process a payer’s details on behalf of a clinic, the clinic is responsible for its own use of that information.

2. Information we collect

From clinics and their staff

• Identity and contact details: name, role, email, phone number, date of birth, nationality and country of residence.
• Business details: legal name, registration documents, tax identifiers, professional licences, ownership structure and bank account details.
• Verification data: government-issued identification, proof of address and the results of identity, sanctions and adverse-media checks, which may come from our service providers.
• Transaction data: payment amounts, currencies, rails, references, dates, counterparties and payout details.
• Communications: messages sent to us by WhatsApp, email or through a scheduling tool.

From patients and other payers

• The payer’s name, country, bank and account details as they appear on a transfer, and the payment reference.
• Information we need to meet sanctions and anti-money-laundering obligations.

From visitors

• Basic technical data such as IP address, browser type and pages viewed, collected through server logs. See our Cookie Policy.

3. Health information

We do not need, and do not want, medical records or health information. Please do not send them to us. If we receive health information by mistake we will delete it where we can. A payment reference should identify the payer, not the treatment.

4. How we use information

• To verify clinics and open, operate and secure accounts.
• To issue payment instructions, match incoming transfers to patients and send payouts.
• To meet legal duties, including KYC, KYB, anti-money-laundering, counter-terrorist-financing, sanctions and tax reporting.
• To detect and prevent fraud, abuse and security incidents.
• To respond to messages, provide support and improve the Services.
• To enforce our Terms and defend legal claims.

Where the law requires a legal basis, we rely on performance of a contract, compliance with legal obligations, our legitimate interests in running a secure and compliant service, and consent where we ask for it.

5. How we share information

We share information only as needed, with:

• Banking, foreign-exchange, payment-rail and stablecoin partners that provide the Services.
• Identity-verification, sanctions-screening and fraud-prevention providers.
• Infrastructure providers for hosting, email, scheduling and messaging.
• Professional advisers, auditors and insurers under duties of confidentiality.
• Regulators, tax authorities, courts and law enforcement where the law requires it or where we believe disclosure is necessary to prevent harm or financial crime.
• A buyer or successor in a merger, acquisition or sale of assets.

We do not sell personal information, and we do not share it for third-party advertising.

6. International transfers

Our clinics, payers and partners are in many countries, so information moves across borders. Where we transfer personal data out of the European Economic Area, the United Kingdom, Brazil or another region with transfer rules, we use appropriate safeguards such as standard contractual clauses, adequacy decisions or the other mechanisms those laws allow.

7. Retention

We keep information for as long as needed to provide the Services and to meet legal obligations. Financial and compliance records are usually kept for at least five years after the relationship ends, or longer where the law requires. We delete or anonymise information when it is no longer needed.

8. Security

We use administrative, technical and physical safeguards that fit the sensitivity of the data, including encryption in transit, access controls and logging. No system is perfectly secure, and we cannot guarantee the security of information you send us. Tell us promptly at support@specie.finance if you think your account has been compromised.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or port your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to your data-protection authority. To exercise a right, email support@specie.finance. We may need to verify your identity first, and some requests may be limited where we must keep records by law.

10. Jurisdiction-specific information

European Economic Area and United Kingdom

We process personal data under the GDPR and UK GDPR. You have the rights listed above and may lodge a complaint with your supervisory authority.

Brazil

We process personal data under the Lei Geral de Proteção de Dados (LGPD). You may confirm that we process your data, access it, correct it, anonymise or delete it, and request portability, by contacting support@specie.finance. You may complain to the Autoridade Nacional de Proteção de Dados (ANPD).

Mexico

We process personal data in line with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares. You may exercise your ARCO rights (access, rectification, cancellation and opposition) by contacting support@specie.finance.

Türkiye

We process personal data in line with Law No. 6698 on the Protection of Personal Data (KVKK). You may apply to us about your data under Article 11 of that law.

California

California residents have the rights to know, delete, correct and limit the use of sensitive personal information, and to not be discriminated against for exercising them. We do not sell or share personal information for cross-context behavioural advertising.

11. Cookies

See our Cookie Policy.

12. Children

The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect information from children. If you believe we have, contact us and we will delete it.

13. Links to other sites

Our site links to WhatsApp, Calendly and other third-party sites. They have their own privacy practices and we are not responsible for them.

14. Changes to this policy

We may update this policy. If a change is material we will update the effective date and, where practicable, tell you by email or on the site.

15. Contact

Untappd Labs Inc., doing business as MedFX
115 E 23rd St, Floor 12, New York, NY 10010
Privacy requests: support@specie.finance