MedxAtlasSign in

XATLAS LLCEffective October 17, 2026

Privacy Policy

What XATLAS LLC collects when you use MedxAtlas, why, and how it is kept safe. Patient health information is governed by the Business Associate Agreement with your practice.

01Who we are

MedxAtlas is practice management, document intake and billing software for medical practices. It is owned and operated by XATLAS LLC, a New York limited liability company (“XATLAS”, “we”, “us”). This policy explains what information we collect through medxatlas.com and the MedxAtlas service, how we use it and the choices you have.

02What this policy covers

This policy covers information about the people who visit our website and the staff of the practices and billing teams who use MedxAtlas.

Patient health information is different. A practice that uses MedxAtlas for its patients is a covered entity under HIPAA, and we handle its patients’ information only as its business associate, under a signed Business Associate Agreement. That agreement, not this policy, governs protected health information. Until it is signed, MedxAtlas runs on synthetic data only, and no patient information is loaded into it.

03Information we collect

  • Account information. Name, work email address, role and the practice or billing company you belong to, provided by you or by the person who invites you.
  • Sign in and security information. Your password, stored only as a one way hash, the secret for your authenticator app, sign in attempts, and the network address and browser of each session.
  • The record of your work. MedxAtlas keeps an audit log of who viewed or changed what in the product and when, because practices need it to protect their records.
  • What you send us. Messages, support requests and any samples you share with us. Before a Business Associate Agreement is signed, please send only synthetic or de-identified samples, never real patient information.
  • Website visits. Our servers record standard request information, such as the address and browser that asked for a page, to keep the site running and secure.

04Cookies and browser storage

We use one kind of cookie: the session cookie that keeps you signed in, which the service cannot work without. MedxAtlas also remembers a few display choices, such as whether the sidebar is open, in your own browser. We do not use advertising cookies, we do not run third party analytics or tracking on medxatlas.com, and we do not follow you across other sites.

05How we use information

  • To provide, maintain and support MedxAtlas for your practice.
  • To secure accounts, detect and prevent misuse, and investigate incidents.
  • To communicate with you about your account, the service and changes to it.
  • To improve the service, using information about how features are used.
  • To meet legal, tax and regulatory obligations.

We do not sell personal information, we do not share it for advertising, and we do not use patient information for any purpose other than providing the service to the practice it belongs to, as its Business Associate Agreement allows.

06How we share information

We share information only in these cases:

  • Service providers that host and run MedxAtlas for us, such as hosting, document storage, text recognition, network security, and the delivery of faxes, texts and email. They may use the information only to provide their services to us, and any that handle patient information do so under their own business associate agreements.
  • Within your organization, according to the roles and permissions your practice sets.
  • When the law requires it, or to protect the rights, property and safety of our users, the public or XATLAS.
  • In a business transfer, such as a merger or sale, where the information stays under protections at least as strong as this policy.

07How we protect information

Every account signs in with a password and a code from an authenticator app. Each practice’s records are separated in the database itself with row level security, every view and change is written to an audit log, and traffic to MedxAtlas is encrypted in transit. Access inside XATLAS is limited to the people who need it to run the service. No system is perfectly secure, and if a breach affects your information we will notify you as the law and our agreements require.

08How long we keep information

We keep account information while your account is active and for as long as needed to meet legal, tax and audit obligations afterwards. Audit records are kept for the period the law requires of the practice. When a practice ends its agreement, its patient information is returned or destroyed as its Business Associate Agreement provides.

09Your choices and rights

You can ask us to show you, correct or delete the personal information we hold about you by writing to hello@medxatlas.com. Some information, such as audit records, may have to be kept to meet the practice’s legal obligations, and we will tell you when that applies.

If you are a patient, your practice controls your health information in MedxAtlas. Please contact your practice to see, correct or ask about it, and we will help them answer you.

10Children

MedxAtlas is a service for businesses and is not directed to children. We do not knowingly collect personal information from children through our website.

11Changes to this policy

We may update this policy as MedxAtlas changes. We will post the new version on this page with its effective date, and tell account holders about any material change before it takes effect.

12Contact

Questions about this policy or your information go to XATLAS LLC at hello@medxatlas.com.