QuestLynk Privacy Policy

QuestLynk, LLC (“QuestLynk,” “we,” “us,” or “our”) offers medical-record retrieval, provider follow-up, record organization and indexing, missing-record review, medical-record review, and chronology services.

This Privacy Policy explains how QuestLynk collects, uses, discloses, retains, and protects information through our website, client portal, communications, and services.

By using our website or services, you acknowledge that you have reviewed this Privacy Policy.

1. Information We Collect

Depending on how you interact with QuestLynk, we may collect:

  • Account information: Name, organization, job title, email address, phone number, login information, and authorized-user information.

  • Request information: Patient name, date of birth, contact information, case or claim information, provider information, dates of treatment, insurance information, and request status.

  • Medical-record information: Signed authorizations and medical, pharmacy, billing, treatment, review, and chronology information submitted or received in connection with a requested service.

  • Communications: Messages, forms, documents, and other information submitted through our website, client portal, email, fax, mail, or other communication methods.

  • Billing information: Billing contacts, invoices, transaction information, and payment status. Payment-card information may be processed by third-party payment providers.

  • Technical information: Information automatically collected by our website or technology providers, which may include IP address, browser or device information, website activity, login activity, and cookies.

2. Third-Party Service Providers

QuestLynk uses third-party platforms and service providers to operate certain parts of its website, client portal, communications, file handling, payments, and other business functions.

These providers may process information as necessary to provide their services to QuestLynk.

Third-party providers may also collect or process information according to their own privacy policies and terms. QuestLynk does not control the independent privacy practices of third parties.

3. Protected Health Information

QuestLynk may receive protected health information (“PHI”) in connection with medical-record retrieval, review, chronology, and related services.

PHI may be submitted or received through QuestLynk's client portal, business email, fax, physical mail, or other methods identified by QuestLynk for the requested service.

QuestLynk uses PHI only for the applicable service, related communications, and other purposes permitted or required by applicable law or contractual obligations.

When a Business Associate Agreement (“BAA”) applies to a particular client relationship, the BAA governs QuestLynk's handling of PHI to the extent applicable.

This Privacy Policy does not replace or expand the terms of a BAA.

4. How We Use Information

QuestLynk may use information to:

  • Create and manage client accounts.

  • Provide requested services.

  • Review submitted authorizations and request information.

  • Submit medical-record requests.

  • Communicate with healthcare providers, records custodians, and other parties involved in a request.

  • Follow up on outstanding requests.

  • Receive and verify records.

  • Organize and index records.

  • Identify potentially missing or incomplete records.

  • Prepare medical-record reviews and chronologies.

  • Communicate with clients about requests, payments, support, and services.

  • Process payments and maintain business records.

  • Maintain and improve QuestLynk's website, portal, services, and processes.

  • Help prevent unauthorized use or access.

  • Comply with applicable legal and contractual requirements.

QuestLynk does not use generative artificial intelligence to prepare medical-record reviews or chronologies. These services are performed by a human reviewer.

QuestLynk does not use client medical records or PHI to train public artificial-intelligence models.

5. How We Disclose Information

QuestLynk does not sell or rent personal information.

QuestLynk may disclose information when reasonably necessary to:

  • Provide services to the client and its authorized users.

  • Communicate with healthcare providers, pharmacies, medical facilities, billing departments, records custodians, release-of-information companies, and other parties involved in an authorized request.

  • Allow a medical reviewer or contractor engaged by QuestLynk to perform a requested service.

  • Use third-party providers that support QuestLynk's website, portal, communications, file handling, fax, mail, billing, or payment functions.

  • Comply with applicable laws, legal processes, or governmental requirements.

  • Protect the rights, property, security, or operations of QuestLynk or others.

  • Complete a sale, merger, financing, reorganization, or transfer involving QuestLynk if such a transaction occurs.

QuestLynk does not permit a medical reviewer or contractor to use client information for purposes unrelated to the service being performed.

6. Cookies and Website Technology

QuestLynk's website and technology providers may use cookies and similar technologies to operate website functions, maintain security, remember preferences, and understand website usage.

You may be able to limit certain cookies through your browser settings or controls made available through the website.

Disabling certain cookies may affect website or portal functionality.

Third-party services integrated with the website may also use cookies or similar technologies according to their own policies.

7. Data Retention

QuestLynk retains information for as long as reasonably necessary to provide requested services and meet applicable business, legal, accounting, or contractual requirements.

Medical records and related service files are generally retained for 90 days after completion or delivery of the applicable service and are then securely deleted from systems under QuestLynk's control, unless longer retention is required by applicable law, contract, or client instruction.

Certain non-medical information, including invoices, payment records, account information, request records, and business communications, may be retained longer when reasonably necessary for business, accounting, legal, or recordkeeping purposes.

Third-party service providers may maintain information according to their own retention practices.

8. Security and Account Responsibility

QuestLynk takes reasonable steps to protect personal information and PHI from unauthorized access, use, or disclosure.

QuestLynk uses third-party technology platforms that maintain their own security controls. However, no electronic transmission, communication method, or storage system can be guaranteed to be completely secure.

Users are responsible for:

  • Protecting their login credentials.

  • Using only accounts they are authorized to use.

  • Limiting account access to authorized personnel.

  • Keeping account information accurate.

  • Promptly notifying QuestLynk of suspected unauthorized access or disclosure.

QuestLynk will address security incidents in accordance with applicable legal and contractual requirements.

9. Privacy Requests

Depending on the information involved and applicable law, you may contact QuestLynk to request:

  • Access to certain personal information.

  • Correction of inaccurate personal information.

  • Deletion of certain personal information.

  • A copy of certain personal information.

QuestLynk may verify the identity and authority of the person making the request before responding.

QuestLynk may be unable to complete a request when information must be retained or handled differently because of applicable law, contractual obligations, an active service request, accounting requirements, or other legitimate obligations.

Marketing communications, if sent, may include instructions for opting out of future marketing messages. Service, payment, account, and security communications may still be sent when necessary.

10. Minors' Records

QuestLynk's website and services are not directed to children for their own use.

QuestLynk may process medical records concerning a minor when those records are submitted or requested by an authorized client and supported by appropriate legal authority, authorization, or other lawful basis.

Clients are responsible for ensuring that they have appropriate authority to request or provide information concerning a minor.

11. Client Responsibilities

Clients are responsible for:

  • Having appropriate authority to submit information to QuestLynk and request the applicable service.

  • Providing accurate information.

  • Limiting submissions to information reasonably necessary for the requested service.

  • Protecting their account credentials.

  • Limiting portal access to authorized personnel.

  • Adding only authorized users to their account.

  • Promptly asking QuestLynk to remove access when a user should no longer have access.

QuestLynk is responsible for its own handling of information but is not responsible for the independent privacy or security practices of clients or unrelated third parties.

12. Changes to This Policy

QuestLynk may update this Privacy Policy as its services, practices, technology, or legal obligations change.

When the Policy is updated, the revised version will be posted with an updated effective date.

Effective and last updated: September 16, 2026

QuestLynk, LLC
Miami, Florida 33194
Email: info@questlynk.com