Data Stewardship & Health Record Policy
Effective Date: June 27, 2026
Version: 1.0

At MaydiCare Connect ("MCC"), we believe that trust begins with clarity.

This Policy explains who is responsible for different parts of your health record, who can access it, how it is protected, and the rights and responsibilities of patients, healthcare professionals, clinics, and MCC.

MCC does not claim ownership of your medical records. Instead, we act as a trusted steward of health information, helping patients and healthcare professionals securely create, manage, and share records for safe and continuous care.

This Policy forms the foundation of all MCC services, including MMDx, Maydic, Access, Access-Rx, Access-Labs, and any future MCC products.
Please also read our Privacy Policy and Terms of Service, which explain how personal information is processed and the rules governing use of our services.

1. Purpose
   This Policy establishes the principles governing:
   • Health record stewardship
   • Data ownership and responsibilities
   • Access permissions
   • Record integrity
   • Patient rights
   • Healthcare professional responsibilities
   • MCC's responsibilities as a technology platform
   Where applicable law provides greater protection than this Policy, the law will prevail.

2. Definitions
   For the purposes of this Policy:
   Health Record means the complete collection of information relating to a person's healthcare, including clinical documentation, prescriptions, referrals, laboratory requests and results, imaging requests and reports, consultation summaries, uploaded documents, and related information.
   Personal Health Information (PHI) means information that identifies an individual and relates to their physical or mental health, healthcare services, or payment for healthcare.
   Clinical Documentation means professional records created by licensed healthcare professionals, including consultation notes, diagnoses, assessments, treatment plans, prescriptions, referrals, and follow-up recommendations.
   Patient means the individual receiving healthcare services.
   Healthcare Professional means a licensed doctor or other authorized healthcare provider using MCC.
   Care Team means healthcare professionals who have been granted authorized access to assist in a patient's care.
   MCC means MaydiCare Connect and its affiliated platforms and services.

3. Our Stewardship Principle
   MCC operates under a Data Stewardship Model.
   This means:
   • Patients retain rights over their personal health information.
   • Healthcare professionals remain responsible for the clinical records they create.
   • Clinics and healthcare organizations retain responsibility for records they are legally required to maintain.
   • MCC securely stores, processes, protects, and transmits information on behalf of authorized users but does not claim ownership of users' medical records.
   Our role is to safeguard information, not to own it.

4. Rights and Responsibilities
   4.1 Patients
   Patients have the right to:
   • Access their health information, subject to applicable law.
   • Receive copies of their health records where permitted.
   • Know which authorized healthcare professionals have accessed their records.
   • Grant or decline requests for access to their records, except where disclosure is legally required.
   • Request correction of inaccurate personal information.
   • Report suspected unauthorized access.
   • Withdraw certain permissions where permitted by law.
   Patients are responsible for:
   • Providing accurate information.
   • Protecting their account credentials.
   • Reporting unauthorized account activity.
   • Respecting applicable payment obligations before accessing consultation outputs where required under MCC's Terms of Service.
   Patients may not alter or edit professional clinical documentation created by healthcare professionals.
   4.2 Healthcare Professionals
   Healthcare professionals are responsible for:
   • Maintaining accurate clinical documentation.
   • Recording consultations truthfully and professionally.
   • Protecting patient confidentiality.
   • Requesting access only when clinically justified.
   • Reviewing all documentation before finalizing it.
   • Ensuring that any AI-assisted content is verified before signing.
   Healthcare professionals retain professional responsibility for all documentation submitted under their account.
   4.3 Clinics and Healthcare Organizations
   Where healthcare professionals practice within an organization, that organization may have additional legal responsibilities regarding medical records under applicable law.
   Nothing in this Policy removes those legal obligations.
   4.4 MCC
   MCC is responsible for:
   • Providing secure systems for healthcare documentation.
   • Protecting information using appropriate technical and organizational safeguards.
   • Maintaining access logs and audit trails.
   • Processing information only for authorized purposes.
   • Supporting continuity of care through secure information sharing.
   • Responding appropriately to verified privacy and security incidents.
   MCC does not make medical decisions or provide clinical care.

5. Ownership and Stewardship
   Healthcare information consists of different components with different legal responsibilities.
   Personal Health Information
   Patients retain rights over their personal health information.
   This includes demographic information, uploaded documents, consent preferences, and information relating to their healthcare.
   Clinical Documentation
   Clinical documentation is the professional work product of the healthcare professional who created it.
   This includes:
   • Consultation notes
   • SOAP documentation
   • Diagnoses
   • Clinical reasoning
   • Treatment plans
   • Prescriptions
   • Referrals
   • Clinical recommendations
   Patients may access these records as permitted by law but may not modify them.
   Platform Technology
   MCC retains ownership of:
   • Software
   • Platform architecture
   • User interfaces
   • Security systems
   • Algorithms
   • Artificial intelligence technologies
   • Trademarks
   • Branding
   • Documentation produced by MCC that is not part of an individual's medical record

6. Access to Health Records
   MCC follows a permission-based access model.
   Unless otherwise required by law:
   • Patients control which healthcare professionals may access their records.
   • Access may be time-limited.
   • Access activity is logged for security and accountability.
   Emergency access may occur where permitted by applicable law or where necessary to protect life or prevent serious harm.

7. Documentation of Consultations
   Healthcare professionals may document consultations using MCC's secure clinical documentation tools.
   Documentation may include:
   • Medical history
   • Symptoms
   • Examination findings
   • Clinical assessments
   • Diagnoses
   • Treatment plans
   • Prescriptions
   • Referrals
   • Follow-up recommendations
   The healthcare professional remains solely responsible for the medical accuracy of the documentation.
   Additional information regarding consultation documentation is available in the Consent & Documentation Policy.

8. Artificial Intelligence
   Certain MCC features may assist healthcare professionals by organizing information, generating drafts, or supporting documentation workflows.
   AI does not replace professional medical judgment.
   Healthcare professionals remain fully responsible for reviewing, correcting, approving, and signing all clinical documentation.
   Further details are provided in the AI Assistance Policy.

9. Security and Audit Logs
   MCC maintains security measures designed to protect health information.
   These include, where appropriate:
   • Encryption
   • Authentication controls
   • Access logging
   • Audit trails
   • Role-based permissions
   • Secure backups
   • Monitoring for unauthorized activity
   Audit logs form part of MCC's security records and may not be altered by users.
   Additional safeguards are described in the Security Policy.

10. Record Retention
    Health records are retained for the period required by applicable law and professional obligations.
    Where deletion is legally permitted, requests will be handled in accordance with the Retention & Deletion Policy.
    Certain records may be retained despite account closure where required for legal, regulatory, security, or clinical purposes.

11. Corrections
    Patients who believe personal information is inaccurate may request correction.
    Healthcare professionals may amend clinical documentation where appropriate but shall preserve the integrity of the original record through appropriate audit history.
    Historical medical records will not be silently rewritten.

12. Disclosure of Information
    Health information will only be disclosed:
    • With patient authorization;
    • To authorized members of a patient's care team;
    • As required or permitted by applicable law;
    • To protect life or prevent serious harm where legally authorized; or
    • As otherwise described in the Privacy Policy.

13. International Processing
    MCC may securely process information in jurisdictions where it operates or where trusted service providers are located.
    Where cross-border transfers occur, MCC will implement appropriate safeguards consistent with applicable data protection laws.
    Further details are available in the Privacy Policy.

14. Relationship to Other Policies
    This Policy should be read together with:
    • Privacy Policy
    • Terms of Service
    • Consent & Documentation Policy
    • AI Assistance Policy
    • Security Policy
    • Retention & Deletion Policy
    • Doctor Participation Agreement
    • Patient Platform Agreement
    Where these documents address the same subject, they are intended to complement one another.

15. Changes to this Policy
    We may update this Policy to reflect changes in law, technology, professional standards, or MCC services.
    Material changes will be communicated through appropriate channels before taking effect where required by law.
    Contact Us
    If you have questions about this Policy or your health information, please contact:
    Privacy Office
    MaydiCare Connect (MCC)
    Email: privacy@maydicare.com