Crosscheck

Your medical. Crosschecked.

Security

How Crosscheck protects your information.

Crosscheck uses technical and organizational safeguards designed to protect the information you store with us.

Encryption

  1. Encrypted on your deviceYour records are encrypted before they're stored.
  2. Stored encryptedCrosscheck stores them in encrypted form.
  3. Available when you sign inThey become available to you after you sign in.

That covers your medical details, visits, medications, documents and everything else in My records.

Crosscheck doesn't save your records in your browser. While you're signed in, they're held only in the open tab, apart from the answers Crosscheck Fill-in holds in its memory while it fills your MedXPress application. Signing out, closing the tab or 15 minutes without activity clears them.

Crosscheck Fill-in, the optional browser extension that fills in your own MedXPress application, doesn't save what it types and sends nothing to Crosscheck's systems. When you press Start, Crosscheck gives Fill-in the answers for this fill. Fill-in keeps them only in memory while it fills, never saves them, and erases them when it stops. The Privacy Policy describes exactly what it does.

Account protection

  • Your account is protected by your password, or by your Apple or Google account if you sign in with one.
  • On Plus and Pro, each sign-in also needs a code we text you, because those plans keep more of your medical records. So does an account with a phone added, or with records still kept from a paid plan. A free account with only the medical tracker signs in with your email and password.
  • After 15 minutes without activity, Crosscheck signs you out. Closing the tab doesn't sign you out by itself. If you come back more than 15 minutes later, Crosscheck asks you to sign in again.
  • In the Crosscheck app for iPhone and Android you can turn on Sign in with Face ID (or your fingerprint) in Settings and my data. Then 15 minutes without a touch locks the app on that phone instead of signing you out, and Face ID reopens it for up to 30 days. After that, and at once if you sign out, change your password or phone number, or add a face or finger to the phone, you sign in with your password and a texted code again. Anyone who can pass Face ID on that phone can open Crosscheck while it is on.
  • Deleting your records or your account, and some other sensitive changes, ask for your password again, or for a fresh sign-in with Apple or Google.
  • If you forget your password, you can reset it by email. Your records aren't affected.

Anyone using your signed-in device may be able to see the records open there, so sign out when you finish on a shared computer. If you sign in with Apple or Google there, sign out of that account too: a browser still signed in to Google or Apple can sign you back in to Crosscheck.

Nobody from Crosscheck will ever ask for your password or for a code we texted you.

Limited access

Crosscheck does not provide staff with a normal tool for viewing readable records, and viewing them is not part of normal staff work. Because Crosscheck operates the service, however, we do not claim that technical access is impossible.

We maintain security logs related to access to your records for security and incident-response purposes. Support's tools don't show your records or your password.

Privacy by design

  • Crosscheck does not sell your health information or use it for advertising.
  • There are no ads, advertising trackers or tracking pixels on Crosscheck.
  • The public pages of the website count visits with Cloudflare Web Analytics. It isn't used on sign-in, in your account or in your records, and Crosscheck doesn't send it your account or your records.
  • An FAA letter you add is read on your device. It isn't sent to any outside reading service.

Some limited information has to stay readable so Crosscheck can work: for example your email address, your mobile number if you add one, the date you accepted our policies and, for each reminder you set, when to send it, the date it is about and whether it was delivered. Your automatic medical reminder also keeps your medical class readable, so its email can name it. Any other reminder doesn't say what the date is for; that stays encrypted in your records. A review you write about an examiner is meant to be published, so it is readable too, and we read it before it goes on the site. So is a message you send to support.

Security is ongoing

We review and update our safeguards as Crosscheck evolves. No online service can guarantee absolute security.

If a security incident requires notification, we will notify affected users and applicable authorities as required by law.

Report a security concern

Found a security issue? Please contact security@crosscheckmed.com.

For help with your account, email support@crosscheckmed.com from the address on your account.

Learn more