Service Privacy Policy

Medform Software Israel Ltd. (the "Service Operator" or "we") respects the privacy of the customers and authorized users of "MEDFORM" – a software system for managing clinics and practices (the "System") – which is accessed either through a local installation on the customer's clinic computers or through an online access portal at online.medform.co.il (the "Login Site"). The System and the Login Site, including the services and information provided through them, are referred to together below as the "Service".

The Service Operator is committed to protecting and safeguarding the privacy of the Service's customers and users ("you" or the "Customer") and the personal information they provide to us, including the personal information they store in the Service about their own customers and patients.

When the System is installed locally at your clinic, we have no access to personal information you store in the System, unless you grant us such access for maintenance or troubleshooting. In any event, including when you store personal information in the online System, the Service Operator will not process or use personal information about your patients and customers except for the purpose of providing the Service, and for no other purpose.

The privacy policy of the Service (the "Policy") is intended to inform you about the way we collect, manage, store and use personal information that you provide to us through the Service, or that we collect while you use the Service.

You should always exercise caution and judgment when providing personal information that may identify you or others. The Policy is an integral part of the General Terms of Use of the System and of the price quote. The Hebrew original of this Policy is written in the masculine form for convenience only and applies equally to all genders. Anything stated in the singular also refers to the plural, as the context requires.

The term "personal information" in this Policy means any information or data about a person that identifies them, or that can reasonably be used to identify that person, such as full name, email address, phone number, ID number, address, medical information, payment details and the like.

The price quote – The price quote you sign with the Service Operator mainly sets out the commercial terms of the engagement, but we will also ask you to complete the Customer's details and those of a contact person on its behalf. If the Customer is an individual (including a licensed sole proprietor), these details will also include the Customer's ID number and contact details, such as phone, email and address. In addition, we will ask you to provide the contact details of your contact person, and you confirm that you have received their explicit consent to provide their details to the Service Operator.

The Login Site – The Login Site serves as an online access portal to the System for customers who have chosen this option. To access the System you will need to enter your access credentials, which may include personal information. Mandatory fields will be clearly marked.

The System – Access to the System is available only to registered customers and authorized users on their behalf, by entering access credentials that the Service Operator provides to the Customer. The access credentials may include the email address and phone number provided by the Customer. We may also use the email address and phone number to send verification and identification messages from time to time. In addition, our accounting systems will store the Customer's payment history for use of the System and the payment methods used for that purpose, including the services consumed.

Personal information and documents you upload to the System – If you upload information and documents to the System, including patients' medical documents and information about them, visit summaries and more, they may include extensive personal information and even information of a particularly sensitive nature. For the avoidance of doubt, the Service Operator does not collect any personal information from the information and documents you upload to the System and does not use it except for the purpose of providing the Service.

Additional services in the System – If you use System services that allow sending messages to recipients, as well as other services that allow entering personal information, these tools may include personal information fields, such as full names, medical condition, address, contact details and more, depending on the nature of the relevant System tool and its data fields.

Contacting us – If you wish to contact us on any subject, through any of the contact methods listed in this Policy, we will usually collect your identification and contact details, as well as preliminary information about the nature of your inquiry.

You are not legally required to provide us with the personal information described in this Policy, and you may refuse to provide it. Providing it depends on your consent and free will. Providing incorrect information or not providing the requested information may prevent you from completing the requested action, including registering for the System, may impair the quality of the service provided to you, and may impair our ability to contact you when necessary.

When you provide us with personal information of third parties – and in particular the list of authorized users – you must inform them that their details are being provided to the Service Operator, and the Customer confirms and declares that it has received the explicit consent of the authorized users to provide their personal information to the Service Operator for use in accordance with this Policy, and in particular to arrange their registration for the Service.

When you use the System, we may collect information about your usage habits, including information or content you read, pages you viewed, search queries you performed, the online tools and sections that interested you, how often you use them, the computer's location and the internet address (IP address) data through which you accessed the Login Site, the type of operating system you use, the type of end device you have, and more. In addition, the Service Operator may collect, and use the services of third parties such as Google Analytics to collect and analyze, anonymous, statistical or aggregate information in connection with use of the Service. The Service Operator will not and cannot collect such information from a local installation of the System at your clinic, but the Service Operator may store information about the hardware on which the System was installed.

If you use AI features in the Service, which are operated through third-party providers such as the Google API (Gemini models):

• Processed data: The input data (prompts/queries) and the output data generated by the AI are transferred to third-party servers for real-time processing.
• No use for model training (Customer Data): In accordance with the service agreement in place with Google and/or the privacy settings we have chosen, we confirm that Google will not use your Customer Data transferred for the AI services to train or fine-tune its generative artificial intelligence models, unless you have given explicit prior instructions to do so.
• Purpose of processing: The third party processes the data solely for the purpose of providing the required service (generating the relevant output) in accordance with our instructions.
• Subject to third-party terms: Use of AI features is also subject to the privacy policy of the API provider (Google). We recommend reviewing those terms.

Medform is committed to protecting user privacy and operates in accordance with Google's "Limited Use" policy (Limited Use Policy). Below is a description of how data received through Google interfaces (such as Google Calendar) is handled:

• Purpose of use: Information received through the Google API (such as calendar event details and appointment availability) is used solely for two-way synchronization between the user's calendar and Medform's appointment management system.
• Complete separation from artificial intelligence (AI) systems: We explicitly declare that information coming from Google interfaces is not transferred to, processed by or exposed to artificial intelligence (AI) systems, whether third-party or internal.
  • Google data is used for administrative scheduling purposes only.
  • The System's AI services (such as the clinical documentation engine) operate solely on the basis of data entered manually by the user or internal clinical data in the System, and have no technical access to information coming from Google.
• No use for model training: Data obtained through the Google API is not used, under any circumstances, to train, improve or develop artificial intelligence models (Generalized AI Models).
• Information security: Information transferred from Google is stored in a secure working environment that is technologically isolated from the System's other processing services, to prevent data leakage or use beyond the user's permissions.

• To enable you to use the Login Site, the System, their features and the various services they offer, including giving you access to these services and enabling the Service Operator to provide these services to you;
• To identify you or verify your identity before you access the Service, or during repeat visits to areas that require registration;
• To arrange payment of the consideration for use of the System;
• To improve and enrich the Service and its content, including creating new services and content that suit customers' requirements and expectations, and changing or discontinuing existing services and content. The information the Service Operator uses for this purpose will be mainly statistical information that does not identify you personally;
• To enable you to tailor the Service to your preferences;
• To send you, from time to time, information about the System's services and content, the Service Operator's services and activities, advertising, direct mail messages, surveys, newsletters and the like. Such information may be promotional in nature and may be sent to you in writing, by text message, by email or by other electronic means, as described in detail in the General Terms of Use of the System;
• To contact you when we believe there is a need to do so;
• For the proper operation and development of the Service, including training, technical support and customer service;
• To enforce the provisions of the binding documents, and to comply with the requirements of any law, regulation or other legislation;
• For any other purpose set out in the Policy or in any of the binding documents.

We will not disclose, sell or share the personal information you provide to us, or that we collect, with third parties without your consent, except in the following cases –

• We may, and might, share personal information with third parties on our behalf who help us operate the Service or provide the services offered to you, such as subcontractors and outsourced service providers. These third parties may use and process your personal information only as necessary to perform the services they provide to us, and they must take information security measures to protect and keep your personal information confidential;
• If you breach the provisions of the General Terms of Use of the System or any of the binding documents, or if you perform, through or in connection with the Service, actions that the Service Operator considers to be unlawful, or attempt to perform such actions;
• If the Service Operator receives a court order, or a demand from an authority empowered to do so, instructing it to disclose your details or personal information relating to you to a third party or to the relevant authority;
• In any dispute, claim, lawsuit, demand or legal proceedings, if any, between you and the Service Operator or anyone on its behalf;
• For the purpose of providing and sharing anonymous, aggregate and statistical information with other companies or organizations affiliated with the Service Operator, as well as with suppliers, business partners, advertisers and any third party. The Service Operator will not knowingly disclose your identity to these parties without your consent;
• If the Service Operator reorganizes its activities or the activities of the Service within another framework, or if the Service Operator changes its legal corporate structure, including if it transfers its activities, or part of them, to a third party – we will be entitled to transfer a copy of the personal information about you to the additional or new entity, provided that this entity undertakes toward you the provisions of this Policy;

The information the Service Operator collects is stored in the Service Operator's databases, which it hosts with server hosting and data backup providers that may also be located outside Israel. Additional information, as described in this Policy, is collected and stored by other companies (such as analytics companies and the like). They too may store the information outside the country. Your consent to this Policy also constitutes consent to the storage of information abroad and its transfer outside Israel.

The Service Operator attaches great importance to the security of information in its systems. To store and protect the information, the Service Operator operates information security systems, applications and procedures designed to minimize the risks of theft, damage, loss or unauthorized access to information. However, these measures do not absolutely guarantee that personal information will not be exposed or stolen from the databases. Therefore, the Service Operator does not undertake, and you cannot reasonably expect, that the Service and the information systems used by the Service Operator will be immune to unauthorized access to the information stored in them. By using the Service, you are aware of and agree to these limitations.

In addition to the System operator's obligations under any law, the Customer is obligated to take all information security measures required by law to protect the System from unauthorized access and information security incidents, in accordance with the provisions of the Protection of Privacy Law, 5741-1981, and its regulations, and in particular the Protection of Privacy Regulations (Information Security), 5777-2017, both when the System is installed locally and when accessing the online System.

We use cookies in the Service. Cookies are text files that your browser creates on instruction from the Service's computers. Some cookies expire when you close the browser (session cookies) and others are stored on the hard drive of the end device you use, and are used when you return to the Service (persistent cookies). Cookies can contain a variety of information, such as the pages you visited, how long you stayed in the Service, where you came to the Login Site from, the information you ask to see in your personal area, and more.

If you prefer that cookies not be stored on your end device, you can change your browser settings to reject certain types of cookies, or remove them manually. However, after rejecting cookies or deleting them from your end device, you may not be able to get the full benefit of the services the Service Operator provides to you, including the System's services, or some of these services may not be available to you or suited to your preferences.

Under the Protection of Privacy Law, every person is entitled to review, personally or through a representative authorized in writing, or through a guardian, information about them that is held in a database. A person who has reviewed information about them and found that it is not correct, complete, clear or up to date may ask the database owner to correct or delete the information. If the database owner refuses, it must notify the requester in the manner prescribed in the regulations under the Protection of Privacy Law. The requester may appeal a database owner's refusal to allow review, or a notice of refusal to correct or delete information, in the manner prescribed in those regulations.

In addition, if the information in the Service Operator's databases is used to approach you personally, based on your belonging to a population group determined by one or more characteristics of people whose names are included in the database ("direct mail approach"), you are entitled under the Protection of Privacy Law to demand in writing that the information relating to you be deleted from the database. In this case, the Service Operator will delete information it needs only in order to approach you with direct mail.

The Service Operator may change the terms of this Policy from time to time (just as it may change any of the binding documents, as described in detail in the General Terms of Use of the System).

If you believe your privacy has been violated while using the Service, or if you have any question, suggestion, complaint or other matter regarding this Policy or the Service Operator's privacy practices, please contact us through any of the following contact methods, and we will try to handle your inquiry as soon as possible –

• Phone: 09-3811122 (between 09:00 and 18:00 on business days and hours);
• Email:info@medform.co.il
• Or through the online contact form in the System;
• Mail: Medform Software Israel Ltd. – 2 HaShunit St., Herzliya 4655502.