Privacy Policy

Scope and privacy roles

This Policy applies to personal information that The Medical Bay controls through the Service, including information associated with accounts, public profiles, listings, offers, orders, messages, reviews, support, security, integrations, and visits to the Service. It does not govern information handled independently by a seller, buyer, payment provider, carrier, manufacturer, regulator, linked website, or other third party under that party's own privacy practices.

Buyers and sellers are independent parties. When one user receives another user's name, contact details, delivery information, eligibility records, or transaction information, the recipient is responsible for using and protecting that information only for authorized diligence, transaction, compliance, fulfillment, support, safety, fraud-prevention, or legal purposes. The Medical Bay does not control a user's separate recordkeeping or legally required reporting.

The Service is intended for adults and United States marketplace activity. If a separate notice is presented at collection or in a feature, that notice supplements this Policy and controls for the collection it addresses.

Personal information we collect

Depending on how you use the Service, we collect the following categories of information:

• Account and identity information. Name, email address, telephone number, account credentials, verification status, account settings, and information showing that you are at least 18 and authorized to represent a business or organization.
• Profile and business information. Public display name, business name, logo, job title, website, business phone, city and state, description, hours, response expectations, ships-from location, vacation status, and similar professional or organizational information.
• Marketplace content. Listings, titles, descriptions, categories, prices, equipment identifiers, photographs, condition and service information, imported listing content, reviews, reports, attachments, and other user content.
• Communications. Buyer-seller messages, offers and counters, support requests, safety or infringement reports, feedback, notices, and records of communications sent through or about the Service.
• Transaction and commercial information. Offers, reservations, orders, item and price details, transaction status, refunds, returns, chargebacks, marketplace fees, taxes, invoices, delivery events, and transaction history.
• Payment and payout information. Payment-provider account identifiers, connected-account status, payment method type and limited details, payment and refund status, payout-readiness signals, and fraud or dispute information. Stripe or another payment provider generally collects full card or bank details directly; The Medical Bay does not ordinarily receive complete payment-card numbers or bank-account credentials.
• Shipping and location information. Billing and delivery addresses, ships-from address, contact person, carrier, freight and delivery requirements, labels, tracking numbers and events, and approximate location inferred from an IP address. We do not request precise device geolocation for ordinary marketplace use.
• Verification, regulatory, and sensitive information. Business ownership, tax, licensing, professional role, facility authority, prescription or practitioner-order information, intended use, identity documents, permits, registrations, and other records reasonably needed for eligibility, payment, safety, fraud prevention, or law. Provide only what is requested and redact patient information whenever possible.
• Device, network, and usage information. IP address, browser and device type, operating system, identifiers, language, referring pages, pages and features used, searches, dates and times, cookie or session data, and diagnostic, performance, and error information.
• Security and integrity information. Login events, authentication results, suspected fraud, policy reports, sanctions or compliance signals, access logs, moderation decisions, and information used to protect users, transactions, providers, and the Service.
• Preferences and marketing information. Notification settings, communication preferences, email engagement, waitlist or referral source, survey responses, and interactions with The Medical Bay announcements or campaigns.
• Inferences. Reasonable inferences from account, transaction, device, and activity information, such as likely interests, account risk, suspected misuse, or service preferences. We do not use automated profiling to make decisions that produce legal or similarly significant effects about consumers.

Sources of information

We collect personal information from:

• you, when you create or update an account, publish a listing or profile, communicate, transact, connect an integration, provide documentation, contact support, or otherwise use the Service;
• other users, such as a buyer, seller, account administrator, reviewer, or person who reports a concern involving you or a transaction;
• your device and use of the Service, through server logs, cookies, session technologies, and similar tools;
• service providers and transaction partners, including payment, identity, shipping, tracking, communications, hosting, security, support, and analytics providers;
• connected services and integrations, such as Stripe, Shippo, DOTmed, carriers, and other services you authorize; and
• public and official sources, including business registries, licensing databases, recall records, sanctions lists, and information lawfully made public.

If you provide personal information about another person, you represent that you are authorized to provide it and will give any notice or obtain any consent required by law. Do not provide patient information or another person's sensitive information merely because it may be relevant to equipment.

How we use personal information

We use personal information to:

• provide, maintain, personalize, and improve accounts, profiles, listings, search, messaging, offers, orders, reviews, integrations, and other Service features;
• process and document transactions, marketplace fees, payments, refunds, returns, chargebacks, tax information, shipping labels, tracking, delivery, and related support;
• connect buyers and sellers and provide each party with information reasonably needed for diligence, verification, payment, fulfillment, delivery, return, support, safety, or legal obligations;
• verify identity, authority, business status, licensure, eligibility, ownership, payment readiness, and compliance where appropriate;
• detect, investigate, prevent, and respond to fraud, misuse, prohibited items, unsafe activity, security incidents, sanctions risk, policy violations, disputes, recalls, and unlawful conduct;
• operate, secure, troubleshoot, analyze, and develop the Service, including testing, quality assurance, performance measurement, and aggregated reporting;
• send account, operational, security, transaction, support, legal, policy, safety, and marketing communications;
• enforce agreements, protect rights and safety, establish or defend legal claims, cooperate with lawful requests, and meet legal, tax, accounting, regulatory, and recordkeeping obligations; and
• carry out another purpose disclosed when the information is collected or that you direct or consent to.

We may combine information from different sources for these purposes. We may also create aggregated or deidentified information that cannot reasonably be linked to an individual and use or disclose it for lawful business purposes. We will maintain deidentified information in deidentified form and will not attempt to reidentify it except as permitted to test deidentification safeguards.

How and why we disclose information

We disclose personal information only as reasonably necessary for the Service, as described at collection, at your direction or with your consent, or as permitted or required by law. Recipients may include:

• Other users. Buyers, sellers, and their authorized personnel receive information needed for the listing or transaction, which may include profile and business details, messages, offer and order terms, contact and delivery information, eligibility records, transaction status, and reviews.
• Service providers and contractors. Providers that support hosting, databases, storage, security, authentication, communications, email, customer support, analytics, image processing, verification, professional services, and other operations may process information for us under applicable contractual restrictions.
• Payment and financial providers. Stripe, connected financial institutions, payment networks, and dispute or fraud providers receive information needed to onboard sellers, process payments and refunds, handle payouts, prevent misuse, and respond to disputes or legal duties.
• Shipping and transaction partners. Shippo, carriers, freight providers, insurers, address-validation services, manufacturers, service providers, and other parties may receive information needed to quote, label, ship, track, deliver, insure, install, service, return, recall, or investigate an item.
• Connected services. If you connect DOTmed or another external account, we exchange information and take actions that you authorize in the connection flow, such as retrieving listings, account details, or integration status.
• Authorities and protective recipients. We may disclose information to regulators, courts, law enforcement, rights holders, manufacturers, payment providers, affected users, or other appropriate parties when we believe disclosure is required by law or reasonably necessary to protect rights, safety, patients, the public, providers, transactions, or the Service; investigate misconduct; respond to legal process; or establish or defend claims.
• Business transactions. Information may be disclosed in connection with financing, diligence, insurance, merger, acquisition, reorganization, sale of assets, bankruptcy, or a similar transaction, subject to appropriate confidentiality and legal requirements.

As of the effective date, we do not sell personal information for money or other valuable consideration and do not share personal information for cross-context behavioral advertising, as those terms are defined by applicable privacy laws. We do not knowingly sell or share the personal information of people under 18.

Public information and marketplace communications

Listings, listing photographs and descriptions, public profile fields, business information, reviews, and other content designated as public can be viewed by users and the public, indexed by search engines, included in previews, or distributed through marketplace and marketing channels. Copies may remain in search caches, archives, screenshots, or records controlled by others after the original content is removed. Do not publish home addresses, personal phone numbers, patient information, credentials, confidential records, or other information that is unnecessary for a public listing.

Messages and transaction records are not ordinarily public, but they are not clinical or legally privileged communications. The Medical Bay and authorized providers may access, preserve, review, and disclose them for operation, support, safety, fraud, payment, policy, or legal purposes. A transaction counterparty may retain information legitimately received from you. Keep material transaction communications in the Service, but minimize sensitive information.

Payments, shipping, and connected services

Stripe or another disclosed payment provider processes payment and payout information under its own privacy policy. The Medical Bay generally receives identifiers, status, limited payment details, balances or fee information, and transaction events needed to operate the marketplace; full payment credentials are ordinarily provided directly to the payment provider. Sellers may use a connected payment account, and a buyer's payment is a direct charge on that account.

Shippo, carriers, freight providers, address-validation services, and insurers may process names, addresses, contact details, parcel or freight information, rates, labels, tracking events, delivery evidence, and claims information. Information entered in a carrier or provider interface may be collected directly by that provider.

If you authorize DOTmed or another marketplace import, we process integration credentials or access tokens, external account identifiers, imported listing content, and synchronization or import status as needed to perform the requested connection. Disconnecting an integration stops future authorized access but does not automatically delete content already imported or records that must be retained. External providers control their services and privacy practices.

Cookies and similar technologies

We and providers acting for us use cookies, sessions, local storage, server logs, pixels, and similar technologies where appropriate to keep you signed in, remember settings, maintain carts or transaction state, prevent fraud, secure the Service, diagnose errors, measure performance, understand feature use, and improve the user experience.

You can control many cookies through browser settings. Blocking necessary cookies may prevent account, security, payment, or other features from working. We do not currently use personal information collected through these technologies for cross-context behavioral advertising. If our practices materially change, we will update this Policy and provide any notice, consent, or opt-out mechanism required by law.

Consumer health data and sensitive information

Medical-equipment activity can reveal or permit an inference about a person's health, diagnosis, treatment, bodily function, or efforts to obtain health-related products, even when no medical record is submitted. This section serves as The Medical Bay's consumer health data notice to the extent a state consumer health data law applies.

Categories of consumer health data we may collect include:

• searches, views, saved items, offers, purchases, sales, messages, and support activity involving medical equipment when linked or reasonably linkable to a consumer;
• eligibility, prescription-device, practitioner-order, licensing, facility, intended-use, delivery, and transaction information that may reveal health-related needs or services; and
• inferences about health-related interests drawn from marketplace activity for the limited purposes described below.

We collect this information from you, your use of the Service, transaction counterparties, devices, service providers, connected services, and public or official sources. We use it to provide a product or service you request; complete and support marketplace transactions; verify eligibility; prevent fraud and unsafe or unlawful activity; maintain security; respond to recalls, concerns, and legal requests; and meet the other operational and legal purposes in Section 4.

The categories of consumer health data disclosed are the marketplace activity, transaction, contact, delivery, eligibility, and safety information reasonably necessary for those purposes. Categories of recipients are transaction counterparties; hosting, communications, support, security, verification, analytics, and professional-service providers; Stripe and payment providers; Shippo, carriers, freight providers, and insurers; connected services you authorize; and authorities or protective recipients described in Section 5. We have no affiliate with which we share consumer health data as of the effective date.

We collect and disclose consumer health data only with consent or as reasonably necessary to provide a product or service the consumer requests, or as otherwise permitted by applicable law. We do not sell consumer health data. We do not use a geofence around a health-care facility or service location to identify or track a person, collect consumer health data, or send health-related messages or advertisements.

Where applicable, you may ask whether we collect, share, or sell consumer health data about you; access that data and a list of third parties and affiliates that received it; withdraw consent from future collection or sharing; or request deletion. Submit a request or appeal as described in Section 13. A deletion request may be subject to authentication, lawful exceptions, and the time permitted to remove information from archived or backup systems.

The Service is not designed to receive or maintain protected health information on behalf of a HIPAA covered entity or business associate, and The Medical Bay does not enter into a business associate agreement for ordinary marketplace use. Do not upload patient records, diagnoses, treatment records, or unnecessary prescription details. If a limited sensitive record is legally necessary for a transaction, use the specified secure process, provide the minimum necessary information, and redact patient identifiers whenever possible.

Retention and deletion

We retain personal information for no longer than reasonably necessary for the purposes described in this Policy, taking into account the nature and sensitivity of the information, account and transaction status, safety and fraud risks, legal and contractual requirements, limitation periods, and the time needed to exercise or defend rights. Retention is therefore determined by category and context rather than one period for all information.

• Account and profile records are generally retained while the account is active and for a reasonable period after closure to administer closure, prevent abuse, resolve support matters, and meet legal duties.
• Listing, message, offer, order, payment, shipping, refund, dispute, tax, and compliance records may be retained for the transaction lifecycle and applicable legal, tax, accounting, safety, fraud, evidence, and claim periods, including after an account closes or public content is removed.
• Verification and sensitive records are retained only as reasonably needed for the verification, transaction, safety, fraud, dispute, or legal purpose for which they were obtained, subject to provider and legal requirements.
• Security, diagnostic, cookie, and usage records are retained for periods appropriate to security, troubleshooting, measurement, fraud prevention, and operational needs.
• Integration credentials and access tokens are retained while the connection is active or as needed to complete a requested action, then deleted or disabled subject to reasonable security logs and backup cycles.

Deletion from active systems may not immediately remove encrypted backups, cached copies, deidentified information, public copies controlled by others, or records another user lawfully retained. When information is retained after a request, we limit its use to the purpose that justifies retention. We delete, deidentify, or securely dispose of information when it is no longer reasonably needed, subject to applicable law and technical constraints.

Security

We use administrative, technical, and organizational safeguards designed to protect personal information in light of its nature and the risks involved. Measures may include access controls, encryption in transit, credential protection, provider reviews, logging, monitoring, backups, and procedures for incidents and account recovery. No online service, transmission, or storage system is completely secure, and we cannot guarantee that information will never be accessed, lost, altered, or disclosed without authorization.

Protect your credentials, use unique passwords and available security features, verify unexpected communications, and do not send sensitive documents through an unapproved channel. Notify [email protected] promptly if you suspect unauthorized account access, a phishing attempt, or exposure of personal or patient information. We will provide legally required security-incident notices when applicable.

Your choices

• Account and profile. Review and update available information through account settings. Some public fields can be hidden or removed, subject to transaction and recordkeeping requirements.
• Communications. Use the unsubscribe method in marketing email or update communication preferences. You cannot opt out of essential account, security, transaction, support, safety, or legal messages while the relevant account or activity remains active.
• Cookies. Use browser controls to delete or block cookies. Necessary features may not work if cookies or local storage are disabled.
• Integrations. Disconnect a connected service through available settings or the provider. Disconnection does not delete previously imported information or transaction records.
• Account closure. You may request closure, subject to outstanding transactions, investigations, payment obligations, safety needs, and records we may retain as described in Section 10.

State privacy rights and requests

Depending on your state of residence and applicable exemptions or thresholds, you may have rights to confirm whether we process personal information; access it; correct inaccuracies; delete it; obtain a portable copy; obtain information about categories, sources, purposes, and recipients; withdraw consent; opt out of sale, targeted advertising, or certain profiling; limit certain uses of sensitive personal information; and appeal a refusal to act. You may also have a right not to receive discriminatory treatment for exercising a privacy right.

The Medical Bay does not currently sell personal information, share it for cross-context behavioral advertising, or use it for automated profiling that produces legal or similarly significant effects. If those practices change, we will provide any required notice and method to exercise an opt-out right before the change applies.

To submit a privacy request, email [email protected] with the subject line 'Privacy Request.' Include your name, account email, state of residence, the right you wish to exercise, and enough detail to identify the information involved. To appeal a decision, reply to the decision or email the same address with the subject line 'Privacy Appeal' and explain why you believe the decision should be reconsidered.

We will authenticate requests using information reasonably related to the request and may ask for additional information. Do not send a Social Security number, full payment credential, patient record, or unrelated identity document. If we cannot authenticate a request or an exception applies, we may deny or limit it and will explain as required by law. Response timing, extensions, fees for excessive requests, and appeal rights are governed by applicable law.

An authorized agent may submit a request where permitted by law. We may require proof of the agent's authority and may ask you to verify your identity or confirm the request directly. Rights may not apply to business-contact information, employment information, deidentified information, or information governed by another legal framework or exception.

California privacy notice

For purposes of California law, the categories of personal information we collect or may collect are: identifiers; customer-record information; commercial information; internet or other electronic network activity; approximate geolocation; audio, electronic, visual, or similar information; professional or employment-related information; sensitive personal information such as account credentials, government identifiers, financial details, and health-related information where provided or inferred; and inferences drawn from those categories. The examples in Section 2 describe these categories more specifically.

Sources are described in Section 3. Business and commercial purposes are described in Section 4. The categories of recipients to which information may be disclosed for business purposes are described in Section 5 and include service providers and contractors, transaction counterparties, payment and shipping providers, connected services, authorities, and parties to a business transaction. Retention criteria are described in Section 10.

During the period covered by this Policy, The Medical Bay has not sold these categories or shared them for cross-context behavioral advertising, and it does not have actual knowledge that it sells or shares personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes that require a separate right to limit under California law. California residents may exercise applicable rights through the process in Section 13.

Children

The Service is not directed to children and requires users to be at least 18. We do not knowingly collect personal information online from a child under 13 or knowingly sell or share personal information of anyone under 18. If you believe a child provided personal information to the Service, contact [email protected] so we can investigate and take appropriate action.

United States processing and third-party services

The Medical Bay is based in the United States, and the Service is currently intended for United States transactions. Personal information may be processed in the United States and other locations where our providers operate, subject to applicable law and contractual protections. Laws in those locations may differ from those where you live.

The Service may link to or integrate with third-party services. Those parties determine their own privacy practices for information they independently collect. Review their notices before using them. The Medical Bay is not responsible for a third party's privacy, security, availability, or use of information except to the extent applicable law provides otherwise.

Changes to this Policy

We may update this Policy to reflect legal, safety, product, technology, or business changes. We will post the updated Policy and change the effective date. If a change is material, we will provide additional notice through the Service, email, or another appropriate method before it takes effect when required. A prior version continues to govern conduct and processing that applicable law requires to remain under that version.

Contact

Questions, privacy requests, appeals, and security or data concerns may be sent to:

The Medical Bay LLC
[email protected]

For a request involving another user or provider, contact that party directly when it independently controls the information. If you have an unresolved concern, you may also contact the privacy regulator or attorney general with authority in your state.

Official privacy resources

The following official resources provide additional information about privacy and applicable rights:

• California Consumer Privacy Act (California Department of Justice)
• Colorado Privacy Act (Colorado Attorney General)
• Washington My Health My Data Act (Washington Legislature)
• Children's Privacy and COPPA (Federal Trade Commission)
• HIPAA Covered Entities and Business Associates (U.S. Department of Health and Human Services)

This Policy is intended for publication as part of The Medical Bay's marketplace terms. It is not a substitute for legal advice about a user's independent privacy, health-information, security, or recordkeeping obligations.