Health Data & Consent Policy

1. What counts as health data

• Consultation notes, presenting complaints, diagnoses and clinical assessments.
• Allergies, current medication and recorded vitals.
• Prescriptions issued and dispensing history.
• Laboratory orders, results and uploaded reports or images.
• Referrals, follow-up plans and patient instructions.
• Records you keep for family members or pets under your account.

2. How consent is captured

A professional cannot simply open a patient's history. Before the record opens, Medexxa requires a patient-present confirmation step — the professional must enter a detail only the patient can supply, confirming the patient is physically or actively present and agrees to the access.

The same applies to a walk-in QR check-in: scanning a center's QR code adds you to that center's waiting list and shares only what you entered at check-in, until you confirm access to your fuller history.

Every access event is recorded, so you can see who opened your record and when.

3. What each provider can see

• Treating doctor or professional — the clinical record needed for your care, for the duration of the care relationship.
• Center or hospital — the encounters that took place at that center.
• Pharmacy — only the prescriptions actually sent to it, with the medicines, quantities and prices on them.
• Laboratory — only the orders assigned to it and the results it produced.
• Nobody else. Other centers, other pharmacies and unrelated professionals cannot read your record.

4. Withdrawing consent

You can revoke a professional's or center's access from your care team settings at any time, without giving a reason. Revocation takes effect immediately for future access.

Revocation does not erase a record a provider was legally required to make about care already given — that record stays with that provider, as medical records law requires. It does stop any further reading of your Medexxa record.

5. Your storage choice

You choose where your documents live. Medexxa-only keeps them on the platform. Medexxa plus your own Google Drive additionally writes a copy into your Drive using the narrow 'drive.file' scope, so you hold your own copy and Medexxa still cannot see anything else in your Drive.

You can change this choice or disconnect Google at any time from Drive settings.

6. Family and dependants

When you add a family member or a child to your account you are stating that you are entitled to manage their health information. Their records carry the same protection as yours, and control transfers to them when they open their own account.

7. Deletion and export

You may export your full health record at any time, or ask us to delete your account. We delete everything we are not obliged to retain and tell you plainly what must remain and why. Write to privacy@medexxa.com.

8. Contact

Health data questions: privacy@medexxa.com, or MeDexxA, Pannipitiya, Sri Lanka, +94 71 799 7000.