Privacy Policy for MD Review

Effective Date: August 24, 2026

This Privacy Policy describes how RCM Automation AI handles information in connection with the MD Review mobile application.

MD Review is intended for authorized healthcare professionals who use the application to review clinical documentation, coding recommendations, clarification requests, and related encounter information. MD Review is not a patient-facing application, and patients do not create accounts through the application.

For services involving Protected Health Information ("PHI"), RCM Automation AI processes information on behalf of participating healthcare organizations in accordance with applicable Business Associate Agreements ("BAAs"), customer agreements, applicable HIPAA requirements, and other applicable laws.

1. Information Available Through MD Review

Authorized users may access information maintained in the RCM Automation AI platform that is necessary to perform an assigned review.

Depending on the encounter, this information may include:

• Patient name;
• Date of birth;
• Medical record number;
• Insurance or payer information;
• Date and type of service;
• Provider information;
• Clinical documentation, including clinical notes;
• Diagnosis information;
• ICD-10-CM codes;
• CPT or HCPCS codes;
• Coding recommendations and supporting information;
• Clarification requests and responses;
• Review decisions; and
• Other information necessary to complete an authorized clinical or coding review.

This information may constitute PHI under HIPAA.

MD Review may also process information relating to the authorized reviewer, including the reviewer's name, email address, professional or organizational affiliation, authentication information, and account authorization status.

2. How MD Review Accesses Patient Information

Patient, encounter, clinical, and coding information is maintained in the central RCM Automation AI platform.

MD Review retrieves authorized information from that platform when it is needed for an assigned review.

MD Review does not maintain a separate mobile copy of the patient's medical record as its system of record.

The application may retain limited technical information necessary for authentication, security, application settings, device identification, and notification functionality. This technical information is separate from the underlying patient medical record.

3. How Information Is Used

Information accessed through MD Review is used to:

• Authenticate authorized users;
• Verify organizational and practice access;
• Present assigned review cases;
• Display clinical information necessary to perform a review;
• Present coding recommendations;
• Allow authorized reviewers to accept, reject, edit, or otherwise resolve review items;
• Permit responses to clarification requests;
• Record review decisions;
• Maintain appropriate workflow and audit records;
• Protect the security of the application and platform;
• Fulfill contractual obligations to participating healthcare organizations; and
• Comply with applicable legal and regulatory requirements.

RCM Automation AI does not sell PHI and does not use PHI for advertising.

4. Completed Review Visibility

Completed reviews, including accepted ICD-10-CM and CPT/HCPCS coding information, remain visible in the MD Review completed-review list for up to 15 days.

After 15 days, the completed review is no longer displayed in the MD Review mobile application's completed-review list.

This 15-day period governs visibility within the mobile application. It is not the retention period for the underlying record maintained by the RCM Automation AI platform.

5. Data Retention

Patient, encounter, coding, review, and related information maintained in the RCM Automation AI platform is retained according to the requirements applicable to the healthcare organization responsible for that information.

The applicable retention period may therefore depend on:

• The healthcare organization's documented requirements;
• The applicable customer agreement;
• The applicable Business Associate Agreement;
• Applicable HIPAA requirements;
• Applicable federal and state laws and regulations; and
• Legitimate contractual, audit, security, and compliance requirements.

Because these requirements may differ between healthcare organizations, RCM Automation AI does not apply the 15-day MD Review visibility period as the retention period for backend patient records.

When services for a healthcare organization end, PHI and other customer information is returned, deleted, retained, or otherwise handled in accordance with the applicable BAA, customer agreement, healthcare organization's instructions, and applicable law.

Information that must continue to be retained for legal, regulatory, contractual, security, or audit purposes remains subject to appropriate privacy and security safeguards and is not used for unrelated purposes.

Reviewer account information may be retained while the reviewer remains authorized to use MD Review or other applicable RCM Automation AI services. Following account deactivation, information that is no longer required may be deleted or de-identified, subject to applicable legal, contractual, security, and audit obligations.

Certain security logs, access records, transaction records, and audit information may be retained for the period necessary to maintain security, investigate incidents, demonstrate compliance, resolve disputes, fulfill contractual obligations, or comply with applicable law.

6. Data Deletion Requests

Authorized MD Review users may request deletion of personal information associated with their reviewer account by contacting:

Email: compliance@rcmautomation.ai
Subject: MD Review Data Deletion Request

A deletion request should include:

• The reviewer's name;
• The email address associated with the MD Review account;
• The healthcare organization or practice associated with the account; and
• A statement requesting deletion of the reviewer's personal information.

RCM Automation AI may verify the identity and authority of the person submitting the request before processing it.

Following verification, personal information associated with the reviewer will be deleted or de-identified where permitted and appropriate.

Some information may need to be retained for legal, regulatory, contractual, security, fraud-prevention, compliance, or audit purposes. Information retained for those purposes will remain protected and will not be used for unrelated purposes.

Patient Records and PHI

Patient medical records and PHI are maintained on behalf of the healthcare organization responsible for those records.

Individual MD Review users generally do not have independent authority to require deletion of a patient's medical record through the mobile application.

Requests involving access to, correction of, or deletion of patient records should generally be directed to the healthcare organization responsible for the patient record.

RCM Automation AI will process the return, deletion, amendment, or continued retention of PHI as instructed by the applicable healthcare organization and in accordance with the applicable BAA, customer agreement, and law.

7. Information Sharing

Information processed through MD Review may be disclosed where necessary to provide contracted services, support the responsible healthcare organization, protect the platform, or comply with applicable legal requirements.

Information may be accessible to:

• The healthcare organization responsible for the applicable patient or encounter;
• Authorized healthcare professionals and workforce members;
• Authorized RCM Automation AI personnel where access is necessary to provide or secure the service;
• Service providers supporting the platform under appropriate contractual and security obligations; and
• Governmental, regulatory, judicial, or law-enforcement authorities where disclosure is required or permitted by law.

Service providers that create, receive, maintain, or transmit PHI on behalf of RCM Automation AI are subject to applicable contractual and HIPAA requirements.

8. Security

RCM Automation AI maintains administrative, technical, and organizational safeguards designed to protect information processed through MD Review.

These safeguards may include encryption of information in transit, authentication controls, organization- and practice-based access restrictions, server-side authorization, multi-factor authentication where configured, audit records, session controls, and other measures appropriate to the service.

Access to patient and clinical information is restricted to authorized individuals acting within their permitted roles.

Suspected security incidents, unauthorized access, or lost or stolen devices involving MD Review should be reported to:

incidents@rcmautomation.ai

9. Push Notifications

Where push notifications are enabled, MD Review may use mobile notification services to alert authorized users about application activity.

Notifications are designed to avoid displaying PHI or detailed clinical information in the notification title or message body.

Users may disable push notifications through their mobile device settings.

10. Children's Privacy

MD Review is a professional healthcare application intended for authorized healthcare professionals.

It is not directed to children and is not intended for use by individuals under 18 as a consumer service.

11. Changes to This Privacy Policy

RCM Automation AI may update this Privacy Policy when its services, application functionality, information-handling practices, contractual obligations, or applicable legal requirements change.

The Effective Date shown above will be updated when this Privacy Policy is revised.

12. Contact Us

Questions concerning this Privacy Policy, privacy practices, compliance matters, or data deletion requests may be directed to:

RCM Automation AI
Privacy & Compliance: compliance@rcmautomation.ai
Website: https://rcmautomation.ai/

Security incidents or suspected unauthorized access should be reported to:

Security Incident Reporting: incidents@rcmautomation.ai

Questions concerning a patient's medical record should generally be directed to the healthcare organization responsible for that record.

MD Review Terms and Conditions

Effective Date: August 24, 2026
Application: MD Review
Publisher: RCM Automation Inc.

These Terms and Conditions ("Terms") govern access to and use of the MD Review mobile application.

MD Review is part of the RCM Automation AI platform and is intended only for authorized healthcare professionals and other authorized professional reviewers.

By accessing or using MD Review, you agree to these Terms. If you do not agree to these Terms, you must not use the application.

1. Relationship to Your Organization

Your healthcare organization may have a separate Master Services Agreement, Business Associate Agreement ("BAA"), order form, subscription agreement, data-processing agreement, or other agreement governing its use of RCM Automation AI.

Those organizational agreements continue to apply.

If these Terms conflict with an applicable agreement between RCM Automation AI and your healthcare organization, the applicable organizational agreement controls to the extent of the conflict.

With respect to Protected Health Information ("PHI"), the applicable BAA and applicable law control.

2. Eligibility and Authorized Use

MD Review is intended only for healthcare professionals and other professional reviewers who have been specifically authorized to use the application by or on behalf of a participating healthcare organization.

You may use MD Review only:

• Through an account authorized for you;
• For organizations, practices, patients, encounters, and review work that you are permitted to access;
• For legitimate professional purposes authorized by your organization;
• In accordance with your professional responsibilities;
• In accordance with your organization's policies; and
• In compliance with applicable agreements and law.

MD Review is not intended for patient use or general consumer use.

3. Account Security

Your MD Review account is personal to you.

You must not:

• Share your username, password, authentication code, authentication device, or other credentials with another person;
• Allow another person to perform review actions under your identity;
• Permit unauthorized individuals to access an authenticated MD Review session;
• Circumvent authentication, authorization, access-control, session, or audit mechanisms; or
• Use another person's MD Review account.

Actions performed through your account may be associated with your identity and recorded as part of an encounter, coding workflow, review history, audit trail, or security log.

If you believe your credentials, account, or device have been compromised, promptly notify your organization and report the incident to:

incidents@rcmautomation.ai

4. Purpose of MD Review

MD Review provides an authorized professional review workflow for encounters requiring clinician judgment or other qualified professional review within the RCM Automation AI platform.

Depending on the assigned case, MD Review may display:

• Clinical documentation;
• Diagnosis information;
• ICD-10-CM codes;
• CPT or HCPCS codes;
• Coding recommendations;
• Coding rationale;
• Automated or AI-assisted recommendations;
• Clarification requests;
• Documentation questions;
• Coding or compliance review scenarios;
• Reimbursement-related information where enabled; and
• Other information necessary to perform the assigned review.

The application may allow an authorized reviewer to:

• Review clinical documentation;
• Review coding recommendations;
• Accept, reject, edit, or otherwise act on coding information;
• Respond to clarification requests;
• Provide professional input;
• Author an addendum where supported;
• Approve a review; or
• Reject a review with an appropriate reason.

5. Automated and AI-Assisted Recommendations

MD Review may display recommendations, classifications, coding suggestions, confidence information, or other information generated or assisted by automated systems or artificial intelligence.

These outputs are provided as decision-support information.

They do not replace professional judgment.

5.1 Reviewer Responsibility

You are responsible for reviewing the information available for an encounter and exercising your own professional judgment before accepting, rejecting, editing, approving, or otherwise acting on a recommendation.

You must not approve a code, clarification response, addendum, or case solely because MD Review or an automated system recommended it.

5.2 No Guarantee of Outcome

Automated or AI-assisted recommendations may be incomplete, inaccurate, unavailable, or inappropriate for a particular encounter.

Unless expressly provided otherwise in an applicable agreement with your organization, RCM Automation AI does not guarantee that use of MD Review or any recommendation generated through the platform will result in:

• Correct coding in every circumstance;
• Correct reimbursement;
• Payment by a payer;
• Avoidance of claim denials;
• Avoidance of audits or recoupments;
• Regulatory compliance;
• A particular coding determination; or
• Any specific financial result.

Professional review remains required where applicable.

6. Review Decisions and Attestations

Actions taken through MD Review may affect coding, documentation, billing, claims, compliance activities, audit records, or other records maintained by your organization.

When you approve a case, approve a coding action, submit a clarification response, provide an addendum, or otherwise complete an action identified as requiring professional review, you represent that:

• You reviewed the relevant information available to you;
• You are authorized to perform the action;
• The action reflects your professional judgment; and
• You believe the action is supported by the information available at the time of review.

Where the application identifies an action as an attestation, your action may be recorded and relied upon as an electronic attestation.

Do not approve or attest to information that you have not reviewed or do not believe is supported by the applicable documentation.

7. Submission and Completion of Reviews

Patient, encounter, clinical, and coding information displayed in MD Review is accessed from the central RCM Automation AI platform.

MD Review is not the system of record for the patient's medical record.

A review should not be treated as successfully completed until the application confirms that the applicable action or decision has been submitted.

Network interruptions, application errors, session expiration, system availability, or other technical conditions may delay or prevent submission.

If MD Review indicates that submission has failed, you should follow the available retry or organizational escalation process and confirm successful completion before relying on the review as submitted.

8. Completed Review Visibility

Completed reviews, including accepted ICD-10-CM and CPT/HCPCS coding information, may remain visible in the MD Review completed-review list for up to 15 days.

After the 15-day visibility period, the completed review will no longer appear in that mobile application list.

The 15-day period relates only to visibility within MD Review.

It does not mean that the underlying encounter, coding, audit, or healthcare record is deleted from the RCM Automation AI platform after 15 days.

Backend records are retained or deleted according to the applicable healthcare organization's requirements, customer agreement, BAA, applicable HIPAA requirements, and other applicable laws and regulations.

Additional information concerning retention and deletion is provided in the MD Review Privacy Policy.

9. Privacy and PHI

MD Review may provide authorized access to PHI and other confidential healthcare information.

You may access and use this information only:

• For authorized professional purposes;
• For patients and encounters you are authorized to review;
• To the extent necessary to perform your assigned responsibilities; and
• In accordance with applicable privacy and security requirements.

You must protect PHI and confidential information in accordance with:

• Applicable HIPAA requirements;
• Other applicable privacy and security laws;
• Your professional obligations;
• Your organization's policies;
• Applicable customer agreements and BAAs; and
• The MD Review Privacy Policy.

Patient, encounter, and clinical information is maintained in the central RCM Automation AI platform. MD Review provides authorized access to that information and does not serve as the underlying medical-record system.

For information about collection, access, use, retention, deletion, and other privacy practices, refer to the MD Review Privacy Policy.

Privacy, compliance, and data deletion inquiries may be submitted to:

compliance@rcmautomation.ai

10. Acceptable Use

You agree not to:

• Access any patient, encounter, practice, organization, or account you are not authorized to access;
• Share login credentials or authentication factors;
• Circumvent access controls, security mechanisms, session controls, or audit logging;
• Use MD Review for purposes unrelated to your authorized professional responsibilities;
• Improperly export, transmit, forward, photograph, copy, download, or store PHI outside authorized systems;
• Capture screenshots containing PHI unless expressly permitted by your organization's policies and applicable law;
• Use an unauthorized, compromised, shared, or insecure device to access PHI;
• Introduce malicious software, code, or other harmful technology;
• Interfere with or disrupt MD Review or the RCM Automation AI platform;
• Probe, scan, penetration-test, or load-test the application or platform without prior written authorization;
• Attempt to reverse engineer, decompile, or derive source code except to the extent such restriction is prohibited by applicable law;
• Use automated means to access MD Review without authorization;
• Attempt to gain access to another user's account or another organization's data; or
• Use MD Review in violation of law, professional requirements, organizational policy, or an applicable agreement.

11. Device Security

You are responsible for taking reasonable steps to protect any device used to access MD Review.

You should:

• Follow your organization's mobile-device security requirements;
• Use appropriate device authentication and locking mechanisms;
• Prevent unauthorized persons from using an authenticated MD Review session;
• Use MD Review's available lock and sign-out controls appropriately;
• Protect authentication credentials and factors; and
• Promptly report a lost, stolen, or compromised device.

A device or account security feature provided by MD Review does not replace your responsibility to follow your organization's security requirements.

12. Clinical and Medical Limitations

MD Review is an RCM, coding, documentation, and professional-review application.

MD Review is not intended to:

• Diagnose a patient;
• Independently determine medical necessity;
• Prescribe or recommend medical treatment;
• Replace a healthcare professional's clinical judgment;
• Replace the patient's official clinical medical record; or
• Serve as an emergency or time-critical clinical communication system.

Do not use MD Review for emergency medical communications.

Follow your organization's established emergency, clinical escalation, and patient-care procedures.

13. Availability and Updates

RCM Automation AI seeks to provide reliable access to MD Review but does not guarantee uninterrupted or error-free availability except where expressly provided in an applicable organizational agreement.

The application or service may temporarily become unavailable because of:

• Scheduled maintenance;
• Emergency maintenance;
• Software or infrastructure failures;
• Internet or mobile-network interruptions;
• Third-party service failures;
• Security incidents;
• Required upgrades; or
• Circumstances outside reasonable control.

RCM Automation AI may modify, update, replace, suspend, or discontinue application functionality as permitted under applicable agreements.

You may be required to install a supported version of MD Review to continue accessing the service.

14. Third-Party Services

MD Review may rely on third-party infrastructure and service providers for technical functionality such as hosting, security, authentication, communications, or push-notification delivery.

Use of MD Review does not provide you with independent access rights to those third-party services.

Third-party service providers handling information on behalf of RCM Automation AI are subject to applicable contractual, privacy, security, and regulatory requirements.

15. Intellectual Property

MD Review, the RCM Automation AI platform, associated software, workflows, interfaces, documentation, trademarks, technology, and other proprietary materials are owned by RCM Automation AI and/or its licensors, except for customer-owned information, PHI, and third-party materials.

Subject to your organization's applicable agreement and these Terms, you receive a limited, non-exclusive, non-transferable, revocable right to use MD Review solely for authorized professional purposes.

No ownership rights in MD Review or the RCM Automation AI platform are transferred to you.

16. Suspension and Termination

Access to MD Review may be suspended or terminated if:

• Your organization deactivates your account;
• Your professional authorization or assigned role ends;
• You are no longer authorized to perform applicable reviews;
• Your organization's agreement for the service ends;
• A security concern is identified;
• Unauthorized access is suspected;
• You violate these Terms;
• You violate applicable organizational policies; or
• Suspension or termination is otherwise permitted by an applicable agreement or law.

RCM Automation AI may take reasonable actions necessary to protect PHI, healthcare organizations, users, patients, the platform, and related systems.

Termination of mobile access does not automatically require deletion of healthcare, coding, audit, security, or other records that must be retained under an applicable BAA, customer agreement, organizational requirement, or law.

17. Disclaimers

Except as expressly provided in an applicable organizational agreement and to the maximum extent permitted by law, MD Review and related services are provided on an "as is" and "as available" basis.

RCM Automation AI does not warrant that:

• Automated recommendations will always be complete or accurate;
• MD Review will operate without interruption or error;
• Every coding, documentation, or compliance issue will be identified;
• A payer will accept a particular code or claim;
• Use of MD Review will prevent denials, audits, recoupments, or compliance findings; or
• MD Review will satisfy every organization's particular policies, requirements, or workflows without appropriate configuration and professional review.

Nothing in these Terms limits any warranty or obligation that cannot lawfully be excluded.

18. Limitation of Liability

To the maximum extent permitted by applicable law and subject to the controlling agreement between RCM Automation AI and the applicable healthcare organization, RCM Automation AI will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages arising from use of MD Review.

The applicable customer agreement controls the allocation of contractual liability between RCM Automation AI and the healthcare organization to the extent provided in that agreement.

Nothing in these Terms excludes or limits liability that cannot legally be excluded or limited.

19. Governing Agreements and Disputes

Any governing-law, venue, arbitration, dispute-resolution, or similar provision contained in the applicable agreement between RCM Automation AI and your healthcare organization will control to the extent applicable.

These Terms are not intended to replace or modify the governing-law or dispute-resolution provisions of an applicable organizational agreement.

20. Changes to These Terms

RCM Automation AI may update these Terms when application functionality, contractual arrangements, security requirements, legal requirements, or business practices change.

The Effective Date shown at the beginning of these Terms will be updated when revisions are published.

Material changes will be communicated where required by applicable law or the applicable organizational agreement.

Continued use of MD Review following the effective date of updated Terms constitutes acceptance of the revised Terms to the extent permitted by applicable law and applicable organizational agreements.

21. Contact

For questions concerning these Terms, privacy matters, compliance matters, or data deletion:

RCM Automation AI
Email: compliance@rcmautomation.ai
Website: https://rcmautomation.ai/

For suspected security incidents, unauthorized access, compromised credentials, or lost or stolen devices involving MD Review:

Security Incident Reporting: incidents@rcmautomation.ai