Two separate things end up in our hands: whatever gets typed into this storefront, and whatever the security services produce once running inside a clinic. Both are set out below station by station, since a notice that files everything under one heading tells a reader nothing useful.
This note is current from 28 August 2026Fortify 24x7 trades as MediDefense IT and makes every decision about information arriving here. Where this page says we, read Fortify 24x7. No separate company sits behind the brand and nobody else makes these calls on our behalf.
Questions about anything below go to support@medidefenseit.com, which a person reads.
Three things get stored while you use this site, and all three live in your own browser rather than on our servers.
No advertising code runs on this site. No analytics either, and no profiling of visitors of any kind. That is a design decision, not a stage we intend to grow out of.
Checkout belongs to Stripe. Number, expiry and security code go into a form Stripe serves off its own infrastructure. None of those three values touches this site or enters any system of ours.
Back comes the bare minimum for an account to exist: an email address, the practice name, which lines got tagged and a quantity beside each, whether payment is healthy, and two reference strings pointing at you and at the subscription inside Stripe.
Operating these services means our engineers may encounter protected health information. A Business Associate Agreement with Fortify 24x7 is signed before anything at all is switched on, and it is that document, not this page, which governs how the information gets handled.
Anything of that kind is held as a business associate, on your instruction, for the purpose you set. None of it is mined. None of it trains or improves anything we sell. None of it is available to buy at any figure. Where the agreement is unsigned, connect nothing and come and ask us why.
Different stations touch different material, so here is the split rather than one vague paragraph covering all six.
Open a consult, either at the portal or by mail. Its subject, its description, anything our engineers wrote, and any attachment all sit together inside our service management system. No other arrangement keeps a problem's history fastened to the problem.
Leave patient identifiers out where the question can be asked without them. Where it genuinely cannot, send them, and they are handled under the agreement like everything else.
A managed service is put together out of other people's software, and every one of those companies is contracted to process data on our behalf. The list sits here so anybody can go and read what they publish rather than accept a summary from us.
Nothing reaches anybody beyond that list unless a court or a statute requires it. Selling personal information is something we do not do, and none of it goes out to feed advertising anywhere.
Account and billing material outlives the subscription, then persists while tax rules and accounting practice insist on it. Telemetry follows whatever retention its own station note prints, or whatever scoping settled on. Copies follow the schedule the clinic picked.
Closing an account starts a conversation, not a countdown. Say the word and written confirmation follows, setting out what gets destroyed and on which date. Timings vary between platforms, so the answer describes how your own clinic is configured instead of offering a general reassurance.
Where somebody lives decides what they may require. Typically: a copy of what is on file, a correction to it, its deletion, or an objection to one particular use. Ask, and it gets worked through. No charge attaches to the asking, and no consequence to having asked.
Where we act as a business associate for a practice, patients and staff of that practice go to the practice first. We then help the practice answer, which is how the arrangement was designed to run.
Engineers reach into a customer environment because a job demands it, never for any other reason. Signing in on our side takes more than a password alone. Administrative work within a tenant is recorded, and the recording belongs to you on request.
None of that promises nothing will ever go wrong. It describes how the work is done. Treat any provider offering the promise as a sales problem rather than a security one.
Anything material shifts the date shown above. Should a change touch information already given to us, account holders get told outright, never left to work it out for themselves.