Privacy Policy

Concept Medical Practice Management Software

Last Updated: September 15, 2026

1. Introduction

Welcome to Concept Medical Practice Management Software ("Concept Medical", "we", "our", or "us"). We are committed to protecting the privacy, security, and confidentiality of your personal data and healthcare practice information. This Privacy Policy outlines how we collect, use, disclose, and safeguard your information when you use our web application, practice management portal, and integrated services.

2. Information We Collect

We collect information necessary to provide comprehensive medical practice management services:

  • Account & Practice Information: Practice names, clinician details, office email addresses, phone numbers, and administrative user credentials.
  • Patient & Clinical Records: Patient demographics, appointment schedules, consultation notes, prescription histories, and billing data provided by authorized healthcare staff.
  • Integrations & OAuth Tokens: When you connect third-party accounts (such as Microsoft 365 / Azure AD or Xero), we securely store encrypted access tokens, refresh tokens, and connected profile email addresses.
  • Technical & Log Data: IP addresses, browser types, access times, and system activity logs for security auditing.

3. How We Use Your Information

We use collected data solely for legitimate business and healthcare administrative purposes:

  • Facilitating medical practice scheduling, patient records management, and clinical documentation.
  • Enabling secure email communications with patients and consultants via connected Microsoft 365 or IMAP/SMTP services.
  • Processing billing, invoices, and accounting syncs.
  • Ensuring system security, preventing unauthorized access, and complying with healthcare regulatory standards (GDPR / Medical Data Compliance).

4. Microsoft 365 / Graph API Data Use & Protection

If your practice connects a Microsoft 365 / Azure AD account via OAuth 2.0:

  • Purpose: We access Microsoft Graph API permissions (such as Mail.Send, Mail.ReadWrite, and User.Read) exclusively to allow your authorized users to send and receive medical office emails directly within Concept Medical.
  • No Data Selling or Advertising: Data obtained via Microsoft Graph API is never shared, sold, transferred, or used for advertising, marketing, or training machine learning models.
  • Storage & Security: OAuth access and refresh tokens are encrypted at rest using industry-standard encryption protocols (AES-256).
  • Revocation: You can disconnect your Microsoft 365 integration at any time through the Company Email Settings tab, which immediately deletes stored OAuth tokens.

5. Data Sharing & Security

We do not sell or rent personal or medical data to third parties. Data is shared only with sub-processors essential to operating the software (such as secure cloud hosting providers) under strict data protection agreements.

We employ robust technical and organizational security measures, including data encryption in transit (TLS 1.2+) and at rest, regular security audits, role-based access control, and strict authentication procedures.

6. Your Rights & Data Retention

Under applicable data protection laws (including GDPR), authorized practice administrators and individuals have the right to access, rectify, export, or request deletion of their personal data. We retain practice data for the duration of your active subscription and as required by medical record retention laws.

7. Contact Us

If you have any questions regarding this Privacy Policy or our data handling practices, please contact us at:

  • Software: Concept Medical Practice Management
  • Address: Herbert Rd, Bray, Co. Wicklow, Ireland
  • Phone: +353 1 908 1220
  • Email: info@conceptmedical.ie