MedBos™ is a service of XBoson, Inc. ("MedBos," "we," "us," or "our"). This Privacy Policy explains what information we collect, how we use and protect it, and the choices you have — including how we handle Medicare claims information that you choose to share with us through the U.S. Centers for Medicare & Medicaid Services (CMS) Blue Button 2.0 program.
This policy applies to individuals who use MedBos, including Medicare beneficiaries who connect their Medicare account to MedBos, and to authorized users at the health plans and organizations that use the MedBos platform. It applies to our websites, applications, and services that link to this policy (collectively, the "Services").
If you are a Medicare beneficiary and choose to connect your Medicare account, MedBos uses the CMS Blue Button 2.0 API to retrieve your Medicare claims information only after you sign in to your own Medicare account and grant consent through CMS. We never see or store your Medicare login credentials — authentication and consent happen on CMS's own systems.
With your authorization, we may receive:
We do not sell your personal information, and we do not use your Medicare claims data for advertising or marketing.
We share information only as described here:
We do not share your Medicare claims data with third parties for their own marketing.
Connecting your Medicare account is voluntary. You may revoke MedBos's access to your Blue Button 2.0 data at any time by:
Revoking consent stops future retrieval of your Medicare data. It does not affect processing that already occurred, and we will delete previously retrieved data as described in Section 8 unless we are required to retain it.
We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, access controls, least-privilege access, and audit logging. No system is perfectly secure, but we work to protect your information consistent with applicable law and industry practice.
We keep information only as long as needed to provide the Services and for legitimate business or legal purposes. When you disconnect your Medicare account or close your account, we delete or de-identify the associated Medicare claims data within a commercially reasonable period, except where retention is required by law or by a contract with your health plan.
Depending on where you live, you may have the right to access, correct, delete, or port your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at [email protected]. We will respond consistent with applicable law. We will not discriminate against you for exercising these rights.
When MedBos processes protected health information on behalf of a health plan or other covered entity, we act as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA) and handle that information in accordance with our Business Associate Agreement and applicable law. Medicare data you share directly with MedBos through Blue Button 2.0 is handled as described in this policy and under your authorization.
The Services are not directed to children under 13, and we do not knowingly collect personal information from them.
We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice.
XBoson, Inc. — MedBos™
Email: [email protected]
Support: [email protected]