Privacy Policy

MVA.CARE is operated by McAllen Family Urgent Care, 110 E Savannah Ave A204, McAllen, TX 78503, (956) 686-4105.

MVA.CARE is a patient intake portal. It lets a patient injured in a motor vehicle accident submit their intake information once, and lets the clinic and the patient’s law firm work from that same record. It is not a medical record system, not a substitute for care, and not a source of legal advice.

From patients and their representatives: name, date of birth, phone number, email and mailing address; details of the accident including date, location, circumstances, vehicles and parties involved; health information you provide about your injuries, symptoms and treatment; insurance and claim information; the law firm representing you and the access code that firm gave you; documents and images you upload; and the consents you give during intake.

From clinic staff and law firm users: name and email address, supplied by Google when you sign in with a Google account, or the email and password you register directly; and a record of what you viewed and when.

Automatically: basic technical information needed to operate the service, such as the time of a request and whether it succeeded.

We do not sell your information. We do not use it for advertising, and we do not share it with advertisers or data brokers.

To route your intake to the clinic and to the law firm you identified; to schedule and coordinate your care; to let your law firm see the status of your case and request a reduction of the bill; to keep an audit record of who accessed health information and when; and to meet our legal and professional obligations.

Health information you submit is stored in encrypted storage operated by Amazon Web Services in the United States (US East / Ohio region), under a signed HIPAA Business Associate Agreement, encrypted with a key we control. The application layer that runs the site holds only operational information - the status of a submission, which firm it belongs to, how many patients it covers, and pointers to the encrypted record. It does not hold your clinical or accident details.

Clinic staff who are involved in your care or the administration of your case. Your law firm, and only your law firm - firm access is limited to that firm’s own patients by an access code issued to the firm, and a firm cannot see another firm’s patients. Service providers who host or transmit data on our behalf under contract, including Amazon Web Services. Others, when the law requires it, or when you ask us in writing to share it.

Every time health information is opened in the portal, we record who opened it.

We deliberately keep health information out of email. Notifications sent to clinic staff and to law firms say only that a submission or request has arrived and ask the recipient to sign in to the portal. Appointment emails to patients contain at most the appointment date and time plus general clinic contact information. If you receive an email claiming to be from MVA.CARE that contains detailed health or case information, treat it as suspicious and contact us.

Staff and law firm users may sign in with a Google account. When you do, Google shares your name, email address and profile picture with us. We do not receive your Google password, and we do not request access to your Gmail, Drive, Calendar or contacts.

We keep intake records for as long as needed to provide care and administer the related claim, and afterwards for as long as Texas medical record retention law and our professional obligations require. Access logs are kept for at least six years.

You can ask us to see the information we hold about you, correct it, or explain how it has been disclosed. Patients of the clinic have rights under HIPAA, including the right to a copy of your record and the right to file a complaint. Contact us at the address below, or file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.

Health information is encrypted in transit and at rest. Access is limited to named accounts, law firm access is scoped by access code, and access to health information is logged. No system is perfectly secure; if a breach affects your information we will notify you as required by law.

This service is intended for adults. Intake for a minor is submitted by a parent or legal guardian. We do not knowingly allow minors to create their own accounts.

If we change this policy we will update the effective date above and post the new version here.

McAllen Family Urgent Care, 110 E Savannah Ave A204, McAllen, TX 78503, (956) 686-4105, privacy@mva.care