Terms & Privacy

Effective: May 13, 2026

Plain English. If anything below is unclear, email armaan@melangescience.com and we'll explain.

1. What Melange Labs does

Melange Labs is a company that builds training environments for medical AI. We work with patients who voluntarily share their own electronic health records (EHRs) with us. We pay patients for participating. We use the records — after de-identification — to construct datasets and simulation environments that we license to AI research labs.

2. How we get your records

You give us your records in one of two ways, each of which requires your explicit consent:

• Connect MyChart. You sign in to your hospital's MyChart and authorize Melange Labs to access your records via SMART on FHIR. Your hospital sends a copy of your data directly to us. We never see your MyChart password.
• Send from your portal. You use your hospital's MyChart "Request a Copy" feature to send your records to a delivery address we provide.

Either way, you are the one authorizing the transfer. You can stop the process at any point before it completes, and you can request that we delete your records after they arrive (see §6).

3. What we collect

If you complete the sharing process, the records you transfer to us may include:

• Clinical notes (consult notes, progress notes, discharge summaries, H&Ps, imaging narratives, pathology narratives, lab narratives, procedure notes)
• Diagnoses and the problem list
• Medications and treatment history
• Lab results and vital signs
• Procedures, surgeries, immunizations
• Allergies and intolerances
• Encounter information (visit dates, providers, locations)

We also collect minimal information from you directly: your name, email, the condition you're sharing records for, the hospitals you receive care at, an approximate count of your visits, and identity-verification data needed to confirm that the records actually belong to you and to prevent fraud.

4. How we use it

We de-identify your records before any use. De-identification follows the HIPAA Safe Harbor standard (45 CFR 164.514(b)(2)) — names, dates of birth, contact information, and other direct identifiers are removed. Where the Safe Harbor method doesn't fully cover free-text notes, we apply additional automated and human review.

De-identified data is then used to build training environments for medical AI. We license these environments to AI research labs. We do not license your individually-identified data — only de-identified data.

Be aware: once data has been de-identified, it is no longer considered personally attributable. De-identified records and the training environments built from them may be retained indefinitely and may already be in use by AI labs we have licensed to. This is true even if you later request deletion of your identifiable records (see §6).

5. What we don't do

• We do not resell your identified records to pharmaceutical companies, insurers, advertisers, or any third party for marketing.
• We do not run advertising or tracking pixels (Meta Pixel, Google Analytics, etc.) on pages that handle your records or onboarding.
• We do not contact your providers about your care.
• We do not access your records after the initial pull unless you authorize a follow-up share.

6. Your rights

• Revoke at any time. Email us to revoke. We stop using your records and delete them within 30 days, except as required by law.
• Access and correction. Request a copy of the records we hold on you, or correct inaccuracies, by emailing us.
• Deletion. Request deletion at any time. We will delete your identifiable records within 30 days, except as required by law. However, de-identified derivatives already built from your records — including training environments licensed to AI research labs — cannot be recalled. They are no longer attributable to you and may persist indefinitely in licensee systems. We retain identifiable records for up to 7 years from collection or until deletion is requested, whichever is earlier.
• State law rights. If you live in Washington (My Health My Data Act), California (CCPA/CPRA), Connecticut (CTDPA), Nevada (SB 370), or another state with consumer health-data rights, the rights in those statutes apply on top of what we offer here.

7. Compensation

We pay participating patients for their participation. Payment amounts and timing are communicated before you complete the sharing process. Compensation is taxable income; if cumulative payments to you in a calendar year reach $600, we issue a Form 1099-MISC as required by IRS rules. Compensation does not constitute medical advice, treatment, or any form of healthcare service from Melange Labs.

8. Security

We adhere to the HIPAA Security Rule's standards even though, as a patient-directed app, Melange Labs is not a HIPAA covered entity. Specifically:

• Encryption in transit (TLS 1.2+) and at rest.
• Access controls and audit logging on systems that touch your records.
• Business Associate Agreements (BAAs) with our cloud provider and any vendor that handles your records.
• No advertising/analytics pixels on health-related pages, per FTC Health Breach Notification Rule expectations.

If we ever experience an unauthorized acquisition of your records, we will notify you, the U.S. Federal Trade Commission, and any required regulators within 60 days, per the FTC Health Breach Notification Rule.

9. Eligibility

You must be 18 or older and a resident of the United States to use Melange Labs. We do not knowingly accept records from minors. If you are sharing records on behalf of a person you have legal authority to represent, you certify that you have that authority.

10. Disclaimers

Melange Labs is not a healthcare provider. We do not provide medical advice, diagnosis, or treatment. The training environments we build are for research purposes and are not intended for clinical decision-making with individual patients.

We make no warranty regarding the AI products built on data licensed from us by third parties. Those third parties are independently responsible for their own products and clinical claims.

11. Changes to these terms

We may update these terms. We'll notify you by email at the address you provided if changes materially affect your rights. If we make a change that you do not accept, you may revoke and request deletion under §6.

12. Contact

Email armaan@melangescience.com with any question, concern, complaint, or request related to these terms or your data.

Melange Labs LLC. Massachusetts, USA.