Privacy Policy

MaryForward (“MaryForward,” “we,” “us,” or “our”) operates an online platform that connects patients with qualified specialists for second opinion consultations in rare and complex disease. This Privacy Policy describes how we collect, use, share, and protect information when you use our website and services.

Because our services involve your health information, we also maintain a Notice of Privacy Practices describing your rights with respect to protected health information.

Account information. When you create an account we collect your name, email address, password (stored only as a cryptographic hash), and optionally your phone number and mailing address. Clinicians additionally provide their specialty, medical license number, and institution.

Health information. When you submit a case for review, we collect the medical information you choose to provide, which may include your diagnosis, symptoms, medical and family history, current medications, allergies, treating providers, and uploaded medical records such as lab results, imaging, pathology reports, and genetic test results.

Communications. Messages and attachments you exchange with clinicians through the platform, and inquiries you send through our contact form.

Newsletter. If you subscribe to our newsletter, we collect your email address.

Technical information. We use essential cookies to keep you signed in and to secure the service. Public forms are protected by Google reCAPTCHA, which may collect device and usage information subject to Google’s privacy policy. We do not use advertising cookies and we do not sell personal information.

• To provide second opinion consultations, including sharing your case with the clinician assigned to review it
• To operate, secure, and improve the platform
• To communicate with you about your case, your account, and service updates
• To support clinician research on your case, such as searching medical literature and clinical trial registries
• To comply with legal obligations and enforce our terms
• In de-identified form, for quality improvement, research, and statistics, as described in the consent you provide

Reviewing clinicians. Licensed specialists on our platform who are involved in reviewing your case.

Service providers. We use third-party providers to operate the platform, including cloud hosting and database services, email delivery, Google (sign-in and reCAPTCHA), and research tools that query medical literature and clinical trial registries (such as PubMed and ClinicalTrials.gov) and AI services used to assist clinician research. Service providers are permitted to use information only to provide services to us.

Legal requirements. We may disclose information when required by law, such as in response to a lawful subpoena or to protect the rights and safety of our users.

We do not sell your personal information, and we do not share your health information with advertisers.

• Encryption in transit (TLS) for all connections
• Encryption at rest, including AES-256 encryption of uploaded medical documents and message attachments
• Role-based access controls limiting access to authorized personnel and your assigned clinician
• Multi-factor authentication for clinician and administrator accounts
• Automatic session expiration and temporary account lockout after repeated failed sign-in attempts
• Audit logging of access to medical records
• Passwords stored only as cryptographic hashes

No method of transmission or storage is completely secure; we cannot guarantee absolute security.

We retain your account and case information for as long as your account is active and as required to comply with legal and medical record retention obligations. You may request deletion of your account and data as described below; some information may be retained where the law requires it.

• Access and receive a copy of the information we hold about you
• Correct inaccurate information
• Request deletion of your account and personal information
• Withdraw your consent to the use of your medical information (which may limit our ability to provide services)
• Unsubscribe from the newsletter at any time

To exercise any of these rights, contact us at team@maryforward.com. Depending on where you live, you may have additional rights under applicable law.

Our services are intended for adults. We do not knowingly collect information directly from children under 18. Information about a minor patient may only be submitted by a parent or legal guardian.

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised “Last updated” date, and where changes are material we will provide additional notice.

Questions about this Privacy Policy can be sent to team@maryforward.com or submitted through our contact form.