This policy applies to:

• Merchants who install and use the Medpaid Shopify App.
• Data collected through interactions with the Shopify platform and the merchant’s store.

This policy does not apply to end-customer data collected by the merchant’s store, except as it pertains to the functionality of the App and is required for services to function.

A. From the Shopify API

When you install the App, we access certain store data via the Shopify API, including:

• Store name and domain
• Store owner name and contact information
• Installed theme information
• Product data (title, tags, pricing, eligibility info)
• Order and transaction data (only if needed for verification or eligibility processing)
• Customer tags or custom metafields (if used for functionality like HSA/FSA tagging)

We request only the minimum permissions necessary to operate the App.

B. From You Directly

You may provide additional information via:

• Support requests
• Onboarding forms or configuration pages
• Feedback or feature requests

We use collected data to:

• Enable HSA/FSA eligibility tagging and display
• Verify product types for health spending account integration
• Support integration with Medpaid Market (optional)
• Offer merchant support and respond to inquiries
• Monitor app usage for diagnostics, performance, and abuse prevention
• Comply with Shopify App Store policies and applicable regulations

We do not sell or share your store’s data with third parties for advertising or profiling purposes.

We only share data with:

• Medpaid Market (if merchant opts in to product syncing or listing)
• Infrastructure providers (e.g., hosting, cloud storage, analytics) who are contractually bound to confidentiality
• Legal or regulatory bodies, if required by law

All third parties are required to handle data securely and only for specified business purposes.

We retain merchant data only as long as:

• The App is installed and actively used
• Necessary for performance monitoring, support, or compliance

Upon uninstallation:

• We automatically revoke access via the Shopify API
• All merchant-identifiable data is deleted within 30 days

Merchants can request earlier deletion by contacting us directly at info@medpaid.com.

We implement reasonable physical, technical, and organizational safeguards to:

• Prevent unauthorized access, alteration, or destruction of your data
• Secure API tokens and encryption of sensitive information at rest and in transit

As a Shopify merchant, you have the right to:

• Request access to the data we store about your store
• Request data correction or deletion
• Withdraw consent to data processing (may affect app functionality)

To exercise your rights, contact us at info@medpaid.com or call 435.200.9698.

Our App may link to or integrate with other services (e.g., Medpaid Market). We are not responsible for their privacy practices. Please review their privacy policies before enabling optional integrations.

We may update this Privacy Policy from time to time. We will notify you of significant changes via the App admin or email. Continued use of the App after updates constitutes your acceptance of the changes.

If you have any questions or concerns about this policy or your data, please contact:

• Medpaid LLC
• 📧 info@medpaid.com
• 📞 435.200.9698

Let me know if you want this policy in a Shopify App Embed block, App Store listing format, or as a hosted public URL for review during app approval.