Privacy policy

Who we are

This policy explains how MedTality ("MedTality", "we", "us") collects, uses, shares and protects personal information. MedTality assesses healthcare candidates against published standards, issues credentials anyone can check, and matches candidates with the employers who are hiring.

For the information described here, MedTality decides how and why it is used, so we are responsible for it. The one exception is information an organization controls, explained below.

Who it applies to

• Visitors. People who visit this website or check a credential.
• Candidates. People who build a profile, practice, take assessments, earn credentials and apply for roles, on the website or in the mobile app.
• Employers and their teams. People who set up an organization, post roles, review candidates and hire, and the colleagues they invite.
• Program members. Staff, new hires and students an organization invites to a credentialing program.
• Virtual staff. Candidates placed with a practice through a Virtual Staff program.

When an organization invites you to a credentialing program or places you through Virtual Staff, it also decides how it uses your results and records. Its own privacy notice covers what it does with them, and this policy covers what we do.

Patients' health information

MedTality is not a healthcare provider, and the app is not built to hold patients' health information. We do not ask for it and do not need it. Please keep real patients' names and details out of your profile, your assessment answers, your messages and your uploads.

The exception is Virtual Staff. A person placed with a practice may work with that practice's patient records, inside the practice's own systems. For that work we sign a Business Associate Agreement with the practice, and that agreement, not this policy, governs the patient information involved.

Information you give us

• Account details. Your name, email address, phone number and password, or the account you sign in with if you use Google, Apple or LinkedIn. Passwords are stored only in a form that cannot be read back.
• Your profile. Your address, work history, education, licenses, certifications, skills and languages, and the roles, specialties, schedules and locations you are looking for, including whether you would relocate.
• Your resume. If you upload a resume, we keep the file and read it with an AI model to fill in your profile for you to check. Nothing it suggests is saved until you confirm it.
• Documents. Certificates, licenses and other files you upload, and files shared in messages, offers and contracts.
• Messages. What you write to candidates or employers through MedTality, and any message you report to us.
• Employer details. Your organization's name, logo and details, the roles you post and the documents you attach to them, the people you invite, and the notes, ratings, tags and decisions your team records about candidates.
• Preferences. Your time zone, language, accessibility settings, notification choices and quiet hours.
• Billing details. The plan or credential you buy and the record of each payment. Card details are collected and held by our payment processor, Stripe, and never reach MedTality.

Your assessments

A readiness assessment is a spoken conversation with an AI examiner. Before you start, you agree to the conversation being transcribed and confirm you understand that you are speaking with AI and that AI scores it. We record the time of each of those agreements.

• What we keep. The transcript of the conversation, any corrections you make to it, and the scorecard: an overall score, a score for each of five dimensions, the evidence each score rests on, written feedback and a verdict.
• What we do not keep. Your voice is streamed to the AI model so it can hear and transcribe you. We do not store the audio.
• Integrity. The scorer notes signs in the transcript that an answer was read out or given with help. It works from the words alone, never from how you sound.
• Your progress. How your evidence for each competency builds over time, the learning pathways suggested to you and what you complete in them.

Practice sessions are kept so you can review them, and are never shown to employers. If an employer invites you to a spoken screening interview as part of an application, that employer can read its transcript and evaluation.

Credentials and checks

When you add a license or certificate, we record its type, issuer, number, state or country, and dates. We may read an uploaded copy with an AI model to check that it matches what you entered. Where a credential can be checked against an official public source, such as the National Provider Identifier registry, we record the result and check it again from time to time, so a lapsed credential does not stay marked as verified.

Hiring and placements

• Matches and applications. How well you fit each role, your applications and their stages, interview times and links, offers, and the reasons an employer gives for a decision.
• Talent pools and searches. The pools an employer adds you to and the searches it saves.
• Virtual Staff placements. Your placement, staffing contract, pay rate, working hours, timesheets and pay records.
• Credentialing programs. The programs you are invited to, and your progress and results in them.

Information collected automatically

• Sign-in and security. The IP address, device and browser of each session, and when you signed in, so we can keep your account secure and show you where you are signed in.
• Security activity. A record of important actions on your account, such as signing out a device, exporting your data or asking to delete your account.
• Log data. Your IP address, browser type and the pages you request, recorded by our hosting providers when you use the website or the app.
• Mobile devices. If you use the mobile app, an identifier for the installation, the device's platform and name, and, if you allow notifications, a token that lets us send them.

We do not use analytics, advertising or tracking tools on the website or in the app.

Information from others

• Organizations. If an organization invites you, we receive your name and email address from it.
• Sign-in providers. If you sign in with Google, Apple or LinkedIn, we receive your name, email address and profile picture from them.
• Calendars. If you connect a Google or Microsoft calendar to schedule interviews, we read when you are busy and add the events needed to do that. We do not read what your other events are about.
• Public registries. The result of checking a credential you add against an official source.
• Stripe. Whether a payment succeeded, failed or was refunded.

We use personal information to:

• Run your account and the service: your profile, assessments, scorecards, credentials, matches, applications and messages.
• Score assessments against the standard for each role and explain each score.
• Match candidates with roles, and show employers the candidates who fit what they asked for.
• Apply for you, if you leave "Apply for me" on, as explained below.
• Suggest learning that targets the areas a scorecard names.
• Check credentials, and remind you before one expires.
• Schedule interviews, and run Virtual Staff placements and credentialing programs.
• Send the emails, texts and notifications you need, such as sign-in codes, interview times, application updates and replies to your messages.
• Take payment for plans, courses and credentials.
• Keep MedTality secure, prevent fraud, abuse and cheating, and investigate reports.
• Test and improve how scoring and matching work, so they stay accurate and fair.
• Meet our legal obligations, resolve disputes and enforce our terms.

We do not send marketing email today. If we start, we will ask first where the law requires it, and every such email will let you unsubscribe.

"Apply for me" is on unless you turn it off. While it is on, we apply on your behalf to open roles you are ready for and hold every required credential for. Each application shares the same evidence an application you send yourself would: your profile and the scorecards for that role.

You see each one in your applications, marked as sent for you, and we tell you when it goes. You can withdraw any application, and turn "Apply for me" off at any time in Settings, under Applying.

We use AI models from OpenAI for the examiner in spoken assessments and screenings, to transcribe them, to score answers, to read resumes and credential documents, to explain matches, and to draft learning and role descriptions. We send each request only what that task needs.

OpenAI processes this information to provide its service to us. It does not use it to train its models, and under its terms keeps it only for a limited time to detect abuse.

AI never makes a hiring decision. Employers decide who to interview and hire, and every scorecard shows its reasons so a candidate and an employer can both see why it reads as it does. We do not score personality, appearance, voice, accent or background. Our Assessment and AI policy explains how scoring works in full.

Employers

An employer can see your profile and scorecards only when you have applied to one of its roles, you match a role it has posted, or it has added you to one of its talent pools. Matching needs your profile to be open to it, which it is unless you hide it.

Employers see your scorecards, but not the transcript of your readiness assessment, and never your practice sessions. They do see the transcript of a screening interview they ran with you.

You can hide your profile from matching at any time in your profile details. Employers then stop finding you, though those you have already applied to keep your application.

Organizations you join

Inside an organization, the members it invites can see its roles, applicants, notes and messages. An organization that runs a credentialing program sees the progress and results of the people it invited. A practice you are placed with through Virtual Staff sees your placement, timesheets and the records it needs to pay you.

Anyone with a code

Every credential you earn has a verification code. Anyone you give it to can check it and see the credential's title, whether it is valid, expired or withdrawn, and when it was issued and expires. They do not see your name or anything else about you.

We share personal information only in these cases:

• With employers and organizations. As described in "Who can see what" above.
• With service providers. Companies that host MedTality, run its AI, send its emails and texts, take payments and help us run the service. They may use the information only to provide their service to us. Our subprocessors page lists each one and what it does.
• With services you connect. Google, Apple or LinkedIn when you sign in with them, and Google or Microsoft when you connect a calendar.
• For legal reasons. When the law, a court order or a lawful request from an authority requires it, or when we believe it is needed to protect someone's safety or the rights and property of MedTality or others.
• In a business transfer. As part of a merger, acquisition, financing or sale of the business, in which case this policy continues to apply to your information.
• With your consent. In any other case, only when you ask us to.

We do not sell personal information, and we do not share it for advertising.

We send text messages only for sign-in: to confirm your phone number, to let you sign in with a code, and for two-step sign-in. We do not send marketing texts. Your phone number and any consent to receive texts are never shared with anyone for marketing, except the provider that carries the messages for us.

We use only the cookies needed to keep you signed in and to run the site. We do not use advertising or analytics cookies, or track you across other websites. Our cookie policy lists each one.

Information is encrypted on its way to and from MedTality. Every request is checked against who is asking before anything is returned or changed, uploaded files are scanned for malware before they are accepted, and you can turn on two-step sign-in for your account. No system is perfectly secure, and if something goes wrong we will tell you as the law requires. Our security page has the details.

While your account is open

We keep your information while your account is open, so your evidence can build over time and your credentials stay checkable.

When you delete it

When you ask us to delete your account from Settings, we delete it 30 days later. Until then you can change your mind and keep it. Deletion waits while you have an active placement, subscription or payment, and goes ahead once that ends.

When it runs, we delete your sign-in details, profile, work history, education, credentials, skills, documents and files, profile picture, devices and preferences.

Some records are kept after that, no longer linked to your name or contact details:

• What you shared with others. Applications an employer received and messages in conversations with other people stay in their records.
• Assessment records. Scorecards, transcripts and the credentials they earned, so that a credential code you gave someone still shows its status, and so we can keep scoring accurate and fair.
• Payments and placements. Payment, staffing and pay records, for as long as tax, employment and accounting law requires.
• Security records. The record of important actions, to protect the service and investigate abuse.

Set periods

In the app

• See and correct. Change your profile, credentials and preferences at any time.
• Take a copy. Download your data from Settings. The download link lasts 7 days.
• Hide. Hide your profile from matching in your profile details, without deleting anything.
• Stop applying for you. Turn "Apply for me" off in Settings.
• Notifications. Choose which emails and notifications you receive, and set quiet hours, in Settings. A few, such as sign-in codes, cannot be turned off.
• Sessions and devices. See where you are signed in and sign out any session or device in Settings.
• Deactivate. Step away without deleting anything: employers stop finding you and notifications stop.
• Delete. Delete your account from Settings. It is deleted 30 days after you ask.

Your rights

Depending on where you live, including in states such as California, Colorado, Connecticut, Virginia and Texas, and in Kenya and the Philippines, you may have the right to:

• Know what personal information we hold about you and how we use it, and get a copy.
• Correct information that is wrong or incomplete.
• Have your information deleted.
• Object to or restrict how we use it, and withdraw consent you have given.
• Opt out of any sale, sharing for advertising or profiling with significant effects, as those laws define them. We do none of these.
• Ask for a person to review a decision made only by automated means. On MedTality, people make hiring decisions, and you can ask us to look again at any verdict.
• Appeal if we turn down your request.

Making a request

Most requests can be done yourself in Settings. For anything else, ask us through Support. We will confirm it is you before we act, answer within the time the law sets, and not treat you differently for using your rights. You may use an authorized agent, and we honor Global Privacy Control signals.

If your request is about information an organization controls, such as a credentialing program's results, we will pass it to that organization and help it respond.

MedTality is run from the United States, and our service providers store and process information mainly there. If you use MedTality from another country, including Kenya, the Philippines or Haiti, your information is transferred to the United States, where privacy law may differ from yours. We protect it as this policy describes wherever it is handled.

Where your country's law requires a legal basis for using your information, we rely on our contract with you to run your account and the service, on your consent for the assessment recording and anything else we ask you to agree to, on our legitimate interests in keeping the service secure and scoring fair, and on legal obligations where the law requires us to keep or share information. You can complain to your country's data protection authority, such as the Office of the Data Protection Commissioner in Kenya or the National Privacy Commission in the Philippines, though we would welcome the chance to help first.

Some state laws, such as Washington's My Health My Data Act, protect health information that HIPAA does not cover. MedTality does not collect information about your own health, and asks you not to share it. If you choose to tell us about a disability so we can adjust an assessment, we use that only to make the adjustment, and share it with no one without your permission.

MedTality is for adults looking for work or hiring in healthcare. It is not meant for anyone under 18, and we do not knowingly collect their information. If you believe someone under 18 has an account, tell us through Support and we will delete it.

When this policy changes, we will update the date at the top of the page. If a change matters to how your information is used, we will tell you in the app or by email before it takes effect.

For questions about this policy or your information, ask us through Support.