Privacy Policy

Last updated: July 15th, 2026

This Privacy Policy explains how MarchAI Health, Inc. ("MarchAI Health," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with our website, our communications, and our web application (collectively, the "Services").

Scope note. MarchAI Health provides data-ingestion and canonicalization services to hospitals and healthcare organizations. When we process patient health information on behalf of our customers, we act as their service provider and HIPAA business associate, and that processing is governed by our agreements with those customers (including any Business Associate Agreement and Data Processing Addendum) and applicable law — not by this Policy. This Policy describes the personal information we handle in our own right, as described below.

1. Information we collect

We collect personal information in the following categories.

1.1 Website visitors

When you visit our public website, we may collect:

• Device and connection data (IP address, browser type, operating system, referring URLs, pages viewed, timestamps).
• Information you submit through contact, demo-request, or newsletter forms (such as name, work email, company, and your message).
• Cookie and similar-technology data (see Section 6, Cookies).

1.2 Customer and prospect personnel

When we engage with current or prospective customers, we may collect business-contact information about employees and representatives of those organizations, such as name, job title, work email, work phone, and records of our communications.

1.3 Product users

When authorized users access our web application, we may collect:

• Account and authentication data (name, work email, role, and credentials managed by our authentication provider).
• Usage, audit, and log data generated as you use the application (actions taken, timestamps, and access events).

2. How and why we use information

We use personal information to:

• Provide, operate, secure, and improve the Services.
• Authenticate users and manage access and accounts.
• Respond to inquiries, demo requests, and support requests.
• Communicate about the Services, including service and security notices, and (where permitted) marketing messages you can opt out of.
• Maintain audit logs, monitor for security events, and prevent fraud and abuse.
• Comply with legal obligations and enforce our agreements.

3. How we share information

We do not sell personal information. We share it only as follows:

• Subprocessors and service providers that process data on our behalf under contract. As of the last-updated date, these include:
  • Cloud infrastructure: Amazon Web Services (AWS), us-east-1.
  • Authentication and Identity: Google and AWS
  • Email: Google Gmail
  • Analytics provider: AWS
  • Error monitoring: AWS
• Customers, where the data relates to that customer's account or personnel.
• Legal and safety disclosures required by law, legal process, or to protect rights and safety.
• Business transfers, in connection with a merger, acquisition, or sale of assets, subject to this Policy.

A current list of subprocessors is available on request at privacy@marchaihealth.com.

4. Data retention

We retain personal information only as long as needed for the purposes described in this Policy, then delete or de-identify it.

• Website inquiry / form data: retained while we engage with your inquiry.
• Account data: for the life of the account plus one year maximum.
• Logs and audit records: six years maximum.

Retention of customer health data is governed by the applicable customer agreement and BAA, not this Policy.

5. Your rights and how to contact us

Depending on your location, you may have rights to access, correct, delete, port, or restrict the use of your personal information, to object to certain processing, and to withdraw consent. To exercise these rights, contact us at privacy@marchaihealth.com.

We will respond within the time required by applicable law. You may also have the right to lodge a complaint with your data protection authority.

6. Cookies and similar technologies

We use cookies and similar technologies to operate the website, remember preferences, and (where enabled) measure usage. You can control cookies through your browser settings and, where applicable, our cookie banner.

7. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest. See our Security page for more detail. No method of transmission or storage is completely secure.

8. Children's privacy

The Services are intended for business use and are not directed to children. We do not knowingly collect personal information from children.

9. Changes to this Policy

We may update this Policy from time to time and will review it at least annually. We will post the updated version with a new "Last updated" date and, where required, provide additional notice.

10. Contact

MarchAI Health, Inc.
218 East 30th St. #1, New York, NY, 10016
Email: privacy@marchaihealth.com