Scope
What this page covers
This page covers the security posture of the public MedRx Pro website and pilot intake flow. It does not claim that the public website is a production clinical record system, patient portal, or regulated medical database.
The website is used to assess clinic demand, understand follow-up workflows, and start founder-led pilot conversations with clinics that may be a fit for the first rollout.
Public Form
What the public site stores
The public pilot form is intended for clinic business contact information and workflow context only. That includes items such as clinic name, work email, WhatsApp number, city, consent status, and basic lead attribution or analytics events needed to operate the site.
- Lead requests are saved server-side so inbound interest can be reviewed and answered.
- Confirmation and owner notification emails are sent through server-side mail handling.
- Basic analytics events may be collected for page visits, CTA clicks, and form submissions.
- Development-only metrics remain hidden from production visitors.
Important Boundary
Do not submit patient records, diagnoses, or protected health data through the public form
The public MedRx Pro website is not intended for patient case details, prescriptions, lab values, scans, treatment history, or any other medical records. Public lead capture is for business contact and workflow discovery only.
If a clinic reaches the point where real patient workflows, integrations, or operational data access are being discussed, those requirements need a separate implementation review, access model, and documented security process before any rollout proceeds.
Transport
How website traffic and configuration are handled
MedRx Pro is designed to run behind HTTPS on a production host and to keep operational configuration on the server side. Public pages do not expose database credentials or private configuration values.
- Site configuration is resolved on the server, with support for private override files or environment variables.
- Analytics and lead capture endpoints are server-side routes, not direct database access from the browser.
- Admin-only metrics require a token outside local development.
- Static assets are versioned so production deploys can update cache safely.
Notifications
How lead notifications work
When a clinic submits the form, MedRx Pro first attempts to save the lead. Once saved, the site can send a confirmation email to the clinic contact and a notification email to the founder inbox.
The website uses those emails for operational follow-up only. They are part of the pilot review flow, not a patient messaging system or claims about clinical delivery readiness.
Pilot Rollout Review
What happens before any deeper clinic deployment
If a clinic moves beyond the public intake stage, MedRx Pro treats security and compliance as a separate workstream. That includes defining what data is needed, who can access it, what logs are required, what integrations exist, and what contractual terms must be in place.
- Define the workflow boundary before touching operational clinic data.
- Review access controls and staff roles for any pilot execution environment.
- Document retention, deletion, and reporting expectations before onboarding.
- Match legal and compliance requirements to the clinic’s market before handling regulated data.
Contact
Questions about rollout or data handling
If your clinic needs clarity on security expectations before starting a pilot, use the contact form and note that you want to review data handling or rollout requirements first.
Get free setup