RevMaxx

GDPR overview

There is none. RevMaxx never mentions the GDPR anywhere on its site: no data protection officer, no Article 27 EU representative, no standard contractual clauses, no EU address. The framework it claims is entirely American: HIPAA, HITECH and the Privacy, Security and Breach Notification rules at 45 CFR 160 and 164, backed by a published Business Associate Agreement. Article 7 of the privacy policy states that the website and platform are operated in the United States and that users outside the US consent to their information being transferred, processed and stored there. The only named individual rights are Californian (Civil Code 1798.83, disclosure of data sharing) and Nevadan (opt-out of data sales), and the company states it does not respond to Do Not Track signals. Data protection questions go to hello@revmaxx.co. A European buyer should treat the published BAA as a HIPAA instrument, not a GDPR data processing agreement.

Who owns the data?

Patient data entered into the platform stays with the healthcare provider, who remains the HIPAA Covered Entity. RevMaxx describes itself as a Business Associate rather than a controller, and states that it treats all protected health information in compliance with HIPAA and only uses PHI as permitted under Business Associate Agreements. The published BAA commits Revmaxx LLC to return or destroy all PHI on termination, unless that is infeasible, in which case the PHI stays protected under the agreement. Ownership of the software, site content and trademarks remains with Revmaxx LLC under article 8 of the terms. Nothing on the site transfers ownership of clinical records to the vendor.

Reuse rights

The practice keeps its clinical records and can reuse the generated notes freely: they are the provider's own documentation, designed to be edited and exported into the EHR. No permission request is described anywhere, but the terms are clear that the platform gives no medical advice and does not substitute for professional medical judgment, so the clinician remains responsible for what is reviewed and signed. On the vendor's side, RevMaxx states that it uses data to operate and improve the site and platform, generate clinical documentation such as SOAP notes, ICD-10 and CPT coding and RAF scoring, create and authenticate accounts, handle billing, provide support, maintain security and meet HIPAA and legal obligations. Article 3b of the BAA allows Revmaxx LLC to de-identify PHI in accordance with 45 CFR 164.514 and then use or disclose that de-identified data for analytics, research or service improvement, and the privacy policy allows limited, non-identifiable or aggregated data to be shared with partners and affiliates. Support transcripts are retained for training, quality and compliance. Payments are not stored directly but handled by an unnamed third-party processor, and Google Analytics, Hotjar and Meta Pixel are named as third-party analytics. The site states that RevMaxx does not currently sell personal information. Nothing is declared about whether customer data is used to train the AI models.

Data retention & training

Hosting summary

RevMaxx states that its website and platform are operated in the United States, and article 7 of the privacy policy asks users outside the US to consent to their information being transferred, processed and stored there. Protected health information is described as stored and transmitted using secure, HIPAA-compliant infrastructure, with encryption, secure storage, access controls, access logging and monitoring cited as safeguards. No hosting provider, cloud region or data center is ever named, and no third-party audit report, SOC 2 or ISO 27001 certification is published to support the claim. The marketing site itself is served behind Cloudflare (anycast IP 104.21.63.142, registered in the United States), but that describes the public website and not necessarily where the clinical platform runs. In practice, a buyer should assume US jurisdiction over patient data, with the HIPAA Business Associate Agreement as the only published contractual instrument and no European hosting option on offer.