With your authorization
Authorized recipients
Records are shared with attorneys, family members, employers, or other recipients only when the patient signs an appropriate authorization or another permitted basis applies.
Privacy
How InjuryDox handles your recovery information.
Authorization-based records, HIPAA-aligned workflow, and clear control over how information moves.
Read the policy →About this notice
This is the InjuryDox public privacy notice summary. The full HIPAA Notice of Privacy Practices, which applies to identifiable medical records held by the affiliated professional medical entity, is delivered through patient onboarding. This notice is reviewed periodically. Last updated 2026-05-04.
What information InjuryDox collects.
InjuryDox collects information needed to support recovery monitoring, clinical review, care coordination, records workflows, and platform operations. Categories below describe types of information at a high level. Detailed clinical record collection is governed by the affiliated medical practice's HIPAA Notice of Privacy Practices.
Patient-reported information
Symptoms, function, sleep, activity, medication, and recovery context shared by the patient through intake and remote check-ins.
Clinical and care-coordination information
Information generated through clinical review, care coordination, and authorized records workflows by the affiliated medical practice.
Account and contact information
Name, contact details, identifiers needed to operate the platform, and authentication information for patient and professional users.
Technical and platform information
Device, log, usage, and security information needed to operate, secure, and improve the platform.
How InjuryDox uses information.
Information is used to deliver the recovery workflow, support clinical and operational review, coordinate care, support records workflows, and operate and improve the platform. Uses are limited to purposes consistent with applicable law, the affiliated medical practice's HIPAA Notice of Privacy Practices, and the consents and authorizations the patient provides.
- Support patient intake, remote check-ins, and recovery monitoring.
- Support clinical review by licensed clinicians through the affiliated medical practice.
- Support care coordination, follow-up, optional service modules, and authorized records workflows.
- Operate, secure, monitor, troubleshoot, and improve the platform.
- Communicate about access, scheduling, billing, and recovery information.
- Meet legal, regulatory, accreditation, audit, and contract obligations.
How InjuryDox shares information.
Sharing is workflow-driven, not casual. Records are shared only through appropriate authorization, legal process, treatment, payment, healthcare operations, or another permitted pathway under applicable law and the affiliated medical practice's HIPAA notice.
Affiliated practice
Clinical workflow
Clinical information moves between the InjuryDox platform and the affiliated professional medical entity to support patient care and operations.
Service providers
Vendors under contract
Hosting, security, communications, analytics, and clinical operations vendors operate under business associate agreements or equivalent contractual safeguards where applicable.
Legal process
Required disclosures
Disclosures required by law, court order, subpoena, public health authority, or regulatory authority are made only as required and in accordance with applicable patient rights.
De-identified data
Research, analytics, improvement
De-identified, aggregated, or otherwise non-identifiable information may be used to study, evaluate, and improve recovery workflows, models, and platform performance, consistent with applicable law.
Not for sale
No sale of identifiable patient information
InjuryDox does not sell identifiable patient information. Marketing uses of identifiable patient information require appropriate authorization where required by law.
Patient rights.
Patients receiving care through the affiliated medical practice have rights described in the practice's HIPAA Notice of Privacy Practices. State privacy laws may provide additional rights. Patients may direct rights requests to the affiliated practice and to InjuryDox as applicable.
- Request access to and copies of records, subject to applicable requirements.
- Request amendments to records, subject to applicable requirements.
- Request restrictions or confidential communications.
- Request an accounting of certain disclosures.
- Revoke an authorization, with effect on future uses and disclosures.
- File a complaint with the affiliated practice, with InjuryDox, or with the U.S. Department of Health and Human Services Office for Civil Rights without retaliation.
Security and data handling.
InjuryDox uses administrative, technical, and physical safeguards designed to protect patient information consistent with applicable law and contractual obligations. No platform can promise that information is fully secure in every circumstance, but security review is an ongoing operational priority.
Privacy questions
Common questions, answered briefly.
Is this the full HIPAA Notice of Privacy Practices?
No. The full HIPAA Notice of Privacy Practices is provided by the affiliated professional medical entity through patient onboarding. This page summarizes the InjuryDox platform's broader privacy posture for the public website.
Does InjuryDox sell patient information?
No. InjuryDox does not sell identifiable patient information.
Are records shared with attorneys automatically?
No. Records are shared only through appropriate authorization, legal process, or another permitted pathway.
How can a patient request records?
Patients may direct records access requests to the affiliated medical practice through the channels described in the HIPAA Notice of Privacy Practices delivered at onboarding. General inquiries can also be sent through the contact below.
Privacy contact
Privacy questions are taken seriously.
For privacy-related questions about the InjuryDox platform, public website, or workflow.
Contact InjuryDox