Platform Privacy Policy

Overview & scope

This Privacy Policy explains how Medicodio Inc., the operator of the GlobalCodio platform ("GlobalCodio", "we", "us", or "our"), handles information within the GlobalCodio application — the authenticated product at app.globalcodio.ai and its associated portals. Medicodio Inc. is a Delaware corporation.

This policy is separate from the privacy policy that governs our public marketing website (www.globalcodio.ai). The marketing-site policy covers visitors, contact forms, and website analytics only. This policy governs accounts, immigration case data, documents, and integrations within the product. Where the two differ, this policy controls for the application.

Our roles: controller and processor

GlobalCodio serves law firms, corporate HR teams, service providers, and applicants. Our privacy role depends on the data:

If you are an applicant or employee whose data was entered by a law firm or employer, that organization is the controller of your case data. Requests about that data are routed to them (see “Your rights & choices”).

Information we collect

Account & profile information

• Name, work email, phone number, role, and the firm/organization you belong to.
• Authentication data — password hashes, multi-factor authentication (MFA) settings, and single sign-on (SSO) identifiers.

Client & immigration case data (processed as a processor)

• Immigration case details, beneficiary and petitioner information, and foreign-national personal data.
• Uploaded documents (e.g. passports, identity documents, supporting evidence, forms, and letters).
• Communications, notes, questionnaires, and case-status history.

Integration data

• Google account data when you connect Google sign-in or Gmail send (see “Google user data”).
• Calendar and meeting data when you connect Google Meet scheduling.

Usage, device & log data

• Product usage and feature telemetry used to operate, secure, and improve the service.
• Information collected automatically, such as IP address, browser type, operating system, device identifiers, referring pages, and date/time stamps, gathered via cookies and similar technologies.
• Diagnostic and error logs (including crash and performance data captured for reliability monitoring).
• Essential cookies for authentication, session, and security (see “Cookies & analytics”).

Aggregated & de-identified data

We may aggregate or de-identify information so that it no longer identifies you. We may use and share such aggregated data (for example, total usage trends) for lawful business purposes; it is not treated as personal information.

Google user data

Scopes we request and why

Limited Use

What we never do with Google user data

• We never use Google user data to train or improve any AI/ML models — ours or any third party’s.
• We never use Google user data for advertising or remarketing.
• We never sell Google user data.
• We do not transfer Google user data except as needed to provide or improve the user-facing feature you enabled, to comply with applicable law, or as part of a merger or acquisition (with notice, as described in “How we share”).

Token storage & retention

• Google access and refresh tokens are encrypted at rest using AES-256-GCM and transmitted only over TLS 1.2+.
• When you unlink your Google account or close your account, we revoke the tokens with Google and delete them from our systems immediately.
• We do not retain the contents of emails sent through the `gmail.send` integration beyond standard delivery logs (metadata such as recipient, timestamp, and delivery status) needed to operate and audit the service.

Human access

We do not access Gmail-scope data for any routine purpose. A human at GlobalCodio may access this data only: (a) with your explicit consent; (b) for security purposes or to investigate abuse; (c) to comply with applicable law; or (d) in an aggregated or de-identified form.

How we use information

• To provide, operate, secure, and maintain the GlobalCodio platform and its portals.
• To process immigration cases on the documented instructions of our customer (the controlling firm or organization).
• To authenticate users, enforce access controls, and protect against fraud and abuse.
• To provide customer support and respond to your requests.
• To monitor reliability and diagnose errors (using diagnostic/crash logs).
• To comply with legal obligations and enforce our agreements.

Legal bases for processing

Where the GDPR / UK GDPR applies, we process personal data on one or more of the following legal bases:

• Contract — to provide the service you or your organization have signed up for and to administer your account.
• Legitimate interests — to operate, secure, and improve the platform, prevent fraud and abuse, and communicate with you, where these interests are not overridden by your rights.
• Legal obligation — to comply with applicable laws, regulations, and lawful requests.
• Consent — where we ask for it (for example, before enabling an optional integration); you may withdraw consent at any time.

For immigration case data we process as a processor, the legal basis is determined by the controlling firm or organization, and we act on their documented instructions under our agreement with them.

How we share information

We share information only as described below. We do not sell personal information.

• Service providers — vendors that help us run the platform (hosting, storage, email delivery, AI/LLM providers, and support tooling), under contracts that require them to process data only on our instructions.
• CodioNetwork partners — where you use partner features, we share the data needed to deliver them, under confidentiality obligations.
• Legal requirements — when required by law, regulation, legal process, or to protect rights, safety, and security.
• Business transfers — in connection with a merger, acquisition, or sale of assets, with notice as required by law.

Data retention

Security

• Encryption in transit (TLS 1.2+) and at rest; OAuth tokens encrypted with AES-256-GCM.
• Role-based access control (RBAC), multi-tenant isolation, and least-privilege access.
• Multi-factor authentication (MFA) support and audit logging of sensitive actions.
• Continuous monitoring and a documented incident-response process.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal-data breach likely to present a risk to affected individuals, we will notify the relevant data-protection authorities without undue delay — and, where feasible under the GDPR, within 72 hours — and will notify affected individuals where required.

We are actively working toward recognized security certifications, including SOC 2 and ISO 27001. We do not currently claim to hold these certifications and will update this policy as any are formally achieved.

Your rights & choices

Depending on where you live, you may have rights over your personal data. Under the GDPR / UK GDPR, these include:

• The right to be informed about how we store, use, and share your data.
• The right to access your data.
• The right to rectify (correct) your data.
• The right to erase your data.
• The right to restrict or object to our processing of your data.
• The right to data portability — to receive your data in a commonly used, machine-readable format.
• The right not to be subject to solely automated decision-making that produces legal or similarly significant effects.

We do not charge for responding to a request and aim to respond within 30 days. We may decline or charge for requests that are manifestly unfounded or excessive, and will explain why if we do. You also have the right to lodge a complaint with your local data-protection supervisory authority.

How to exercise your rights

• For data we control (account, profile, billing), contact us at info@globalcodio.ai.
• For immigration case data, the controlling firm or organization is responsible. We will route your request to them, or assist them in responding, as a processor.
• You can unlink your Google account at any time from your in-app integration settings, which revokes our access and our stored tokens.
• You can request export or deletion of your account data; account deletion purges or returns controller data within our stated timelines.

California privacy rights

If you are a California resident, the CCPA / CPRA gives you the right to know what personal information we collect, use, and disclose; to request access to and deletion of your personal information; to correct inaccurate information; and to not be discriminated against for exercising these rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. To exercise your California rights, contact us at info@globalcodio.ai. We will verify your request and respond within the timeframe required by law (generally 45 days).

International data transfers

GlobalCodio operates in the United States and India, and may process information in both. Where we transfer personal data across borders, we rely on appropriate safeguards, including the EU/UK Standard Contractual Clauses (SCCs) where applicable.

Cookies & analytics

The application uses only essential cookies required to operate — for authentication, session management, and security. These are exempt from consent because the service cannot function without them. We use both session cookies (which expire when you close your browser) and short-lived persistent cookies needed to keep you signed in.

We use an error-monitoring tool to capture diagnostic and crash data so we can keep the service reliable. The application does not use advertising, marketing, or behavioral-tracking cookies, and does not load non-essential analytics. Because there is no non-essential tracking, we do not display a cookie-consent banner in the application. If we introduce non-essential analytics in the future, we will add consent controls (default-denied, opt-in) before doing so.

Do Not Track

Because the application does not perform cross-site tracking, it does not respond differently to browser "Do Not Track" signals. If that changes, we will describe our response here.

Third-party links & services

The application may link to or integrate with third-party services (for example, Google sign-in, Gmail send, and Google Meet). This policy does not cover the practices of those third parties, and we are not responsible for their privacy practices. Your use of a linked third-party service is governed by that party’s own terms and privacy policy.

Children's privacy

GlobalCodio is a business platform and is not directed to children. Consistent with the U.S. Children’s Online Privacy Protection Act (COPPA) and the GDPR (which sets the age of consent at up to 16), we do not knowingly create accounts for or collect personal information directly from children. If you believe a child has provided us personal information through an account, contact us at info@globalcodio.ai and we will take appropriate steps.

Immigration cases may include information about minor beneficiaries (for example, dependents) provided by our customers as part of a case. Such data is processed as case data on the customer’s instructions (we act as a processor), not collected from the minor directly.

Changes to this policy

We may update this policy from time to time. We will revise the effective date above and, for material changes, provide notice through the application or by email.

Contact & DPO

For privacy questions or to exercise your rights, contact us at info@globalcodio.ai. We aim to respond within 30 days.

Medicodio Inc. (operator of GlobalCodio) Delaware (registered office): 16192 Coastal Hwy, Lewes, DE 19958, USA · California: 2603 Camino Ramon #200, San Ramon, CA 94583, USA · India (operations): B-Block, 8th Floor, Brigade Tech Park, 134/1, Whitefield, Bangalore – 560 066, India