This Privacy Policy describes how EzMedSource LLC ("EzMedSource," "we," "us") handles information in connection with its websites, marketplace, buyer and vendor portals, and related services (the "Service"). It applies to visitors, prospective customers, buyers, vendors, and authorized organization users.
1. Information we collect
Information you provide
- Account and organization information, such as name, business email, phone number, organization, role, and membership details.
- Vendor onboarding and catalog information, including business classifications, capabilities, service areas, listings, prices, lead times, specifications, photographs, and supporting documents.
- Marketplace and operations information, including RFQs, quantities, delivery requirements, quotes, orders, service records, work orders, inventory records, messages, and files you choose to submit.
- Contact and sales-inquiry information, including the category and message you submit. We store contact submissions so an authorized team member can respond even if an email notification is delayed.
- Meeting-booking information you choose to provide on our Calendly scheduling page, including your name, email, scheduled time, booking status, and the website link that led to the booking. We receive booking and cancellation updates for website-attributed meetings so our team can follow up and measure completed bookings.
Information collected automatically
- Required operational data such as IP address, user agent, request path, timestamps, authentication events, rate-limit data, browser errors, and sampled performance measurements. We use this data to secure, operate, diagnose, and improve reliability of the Service.
- Required cookies or similar storage used for authentication, security, session continuity, and your privacy preferences.
- Optional analytics, only after you consent, such as page paths, product and form interactions, RFQ milestones, CTA clicks, and scroll milestones. We exclude URL query strings and redact access tokens from analytics paths.
Information from other sources
- WorkOS, our identity provider, supplies verified identity and organization-session information when you sign in.
- Vendors, manufacturers, and public or licensed catalog sources may supply business and equipment information. A public profile or listing does not imply that its owner has claimed or approved it.
2. How we use information
- Provide, secure, support, and personalize the Service.
- Authenticate users and enforce organization, role, and tenant access controls.
- Respond to contact requests, qualify buyer or vendor interest, and arrange meetings requested by prospective customers.
- Create, route, source, compare, and fulfill RFQs, quotes, orders, and service workflows.
- Send required transactional and service messages about accounts, RFQs, listings, orders, and security. Marketing messages, if offered, use separate choices where required.
- Detect abuse, investigate incidents, debug failures, and measure reliability. We use optional behavioral analytics only with consent.
- Comply with law and enforce our agreements.
3. RFQ and contact-information sharing
Before a quote is accepted, matched vendors receive an anonymous buyer reference and the product, quantity, requested listing type, and delivery information needed to prepare a response. We do not append the buyer's profile organization or contact identity at that stage. Free-text messages and delivery/application fields are shared as the buyer enters them, however, and may identify the buyer if the buyer includes names, addresses, phone numbers, or email addresses despite the form warning. Items without vendor coverage remain in an internal sourcing queue for authorized EzMedSource operators.
When a buyer accepts a quote, we disclose the buyer organization and appropriate contact and delivery details to the selected vendor so the parties can complete the transaction. Contact-form submissions are visible only to authorized EzMedSource operators and service providers needed to store and deliver the request.
4. Service providers and other disclosures
Depending on the features you use, our providers include:
- Google Cloud for hosting, databases, storage, logging, and enabled AI processing; WorkOS for authentication; and SendGrid for email.
- Sentry for operational crash diagnostics. Browser session replay is disabled, default PII collection is disabled, and browser performance tracing is disabled.
- Google Analytics 4, PostHog, and our first-party beta analytics only after you allow optional analytics.
- Calendly when you choose to book a meeting, and YouTube in privacy-enhanced mode for embedded videos. Those providers process information under their own privacy terms when their service loads.
- AI, voice, or meeting providers identified in an enabled feature at the time you choose to use it.
We may also disclose information when legally required, to protect the Service or people from harm, or as part of a merger, financing, acquisition, or sale subject to appropriate confidentiality and notice. We do not sell personal information or use it for third-party behavioral advertising.
5. Analytics choices
Optional analytics remain off until you choose "Allow analytics." Your choice is stored in this browser and can be changed below at any time. Disabling analytics stops new optional events, opts this browser out of PostHog capture, and removes the first-party analytics session cookie. Required security, sign-in, error, and reliability processing continues.
Loading analytics preference…
6. Data retention
We retain information for the period reasonably necessary to provide the Service, respond to inquiries, complete transactions, maintain security and audit records, resolve disputes, and meet legal or contractual obligations. The period varies by record type: unresolved contact and sourcing records remain available for follow-up; RFQ, order, service, and audit records may be retained longer than routine diagnostic logs. Backups expire according to their configured lifecycle. We delete or de-identify information when it is no longer needed, where doing so is technically and legally feasible.
7. Your choices and rights
You may update information available in your account, change analytics consent above, or contact us to request access, correction, deletion, restriction, or portability. We may need to verify your identity and may retain information where law, fraud prevention, security, or an active transaction requires it. Depending on where you live, you may have additional privacy rights and a right to appeal our response.
Submit a privacy request at privacy@ezmedsource.com.
8. Security and sensitive information
We use safeguards including TLS in transit, encryption at rest, access controls, tenant isolation, secret management, logging, and dependency and deployment checks. No service is perfectly secure; report a suspected incident to security@ezmedsource.com.
Do not include patient names, medical-record numbers, or other protected health information (PHI) in public listings, contact messages, RFQs, or uploads unless a written agreement and specifically approved workflow expressly allow it. Marketplace participation or vendor approval is not a regulatory certification.
9. AI-enabled features
Some accounts may have optional AI features such as EzBot, document assistance, or voice tools. Content you submit to an enabled AI feature is sent to the configured model and infrastructure providers to produce a response and may be stored with the related account, thread, audit, or safety record. Do not submit PHI or confidential information unless your organization has approved the feature and workflow. AI output can be inaccurate and is not medical, legal, regulatory, or purchasing advice.
10. Children and international use
The Service is intended for businesses and is not directed to children under 18. The Service is primarily hosted in the United States; using it from another country may transfer information to the United States and other locations used by our providers.
11. Changes and contact
We may update this policy as the Service changes. The effective date above identifies the latest revision, and we will provide additional notice when required. Questions may be sent to privacy@ezmedsource.com.