Privacy Policy

This Privacy Policy explains how Merge Network ("Merge Network," "we," "us") collects, uses, and protects information across two separate surfaces: this marketing website (mergenetwork.com) and the Merge Network application (app.mergenetwork.com), which law firms and medical providers use to coordinate referrals and share case information. We've kept the two separate below because they handle very different kinds of data.

This Website (mergenetwork.com)

What mergenetwork.com collects

This marketing website uses Google Analytics (GA4) and Google Tag Manager to understand how visitors use the site — page views, general traffic patterns, and referral sources. These tools do not load until you accept our cookie banner; if you decline, no analytics scripts run and no data is sent to Google from this site.

If you submit the "Book a Demo" form, the information you provide (name, email, phone, organization, role, and message) is used to schedule and prepare for that demo call, and to follow up with you about Merge Network. It is not sold to third parties, and is not shared with anyone outside of scheduling and preparing for that call.

This marketing website does not process, store, or transmit Protected Health Information (PHI) or any patient/client case data. That only happens inside the Merge Network application itself, described below.

The Merge Network Application (app.mergenetwork.com)

What the application collects and why

Merge Network is built and hosted on Salesforce's platform (Salesforce Experience Cloud). We do not run our own separate servers or data centers for the application — the underlying infrastructure, physical security, and platform-level compliance controls (including Salesforce's own HIPAA, SOC 2, and ISO certifications) are Salesforce's responsibility as our infrastructure provider, backed by a signed Business Associate Agreement (BAA) between Merge Network and Salesforce for handling of Protected Health Information.

Information we collect through the application:

• Account information — name, email, phone number, firm or provider organization, and role, provided when your organization is onboarded to Merge Network.
• Referral and case coordination data — information law firms and medical providers enter or exchange to coordinate a referral: case status, treatment updates, appointment scheduling, and related notes.
• Documents — files uploaded by firms or providers to a case (such as records requests, treatment notes, or billing/lien documentation), which may include Protected Health Information.
• Usage and access logs — who accessed which record and when, used for the audit logging described in our Security page.

How access is controlled: access to any case is limited to the specific law firm and medical provider(s) actively connected to that referral — not shared platform-wide. A provider removed from a case loses access to it immediately. Full detail on how this is enforced is on our Security page.

What we do not do: we do not sell case data, PHI, or account information to third parties. We do not use case data to train third-party AI models. We do not share data across unrelated firms or providers.

Data retention and deletion: case and account data is retained for as long as your organization has an active account with Merge Network, plus a reasonable period afterward to comply with legal, insurance, and recordkeeping obligations common to legal and medical record handling. If your organization needs a specific retention period, deletion timeline, or data export on account closure — for your own compliance documentation or a client's requirements — we address that directly as part of onboarding or on request, since the right answer can depend on your state's legal and medical recordkeeping rules.

Your own Business Associate Agreement: law firms and medical providers that require their own signed BAA directly with Merge Network (in addition to the Salesforce infrastructure BAA described above) can request one — this is a standard part of onboarding a new firm or provider organization.

Your Choices

Access, correction, and questions

If you're an individual whose information appears in Merge Network through a law firm or medical provider's use of the platform, requests to access, correct, or delete that information should generally go through that firm or provider directly, since they control the underlying case relationship. If you're a firm or provider administrator, contact us directly using the information below for any account-level request.