What happens to your data

Medical data is not a case where "we care about your privacy" in the footer counts as an answer. So, point by point.

Who sees the record

You, and whoever you opened it to. A family member's access to your record is an action you take in your account, not a default setting: granting access is recorded in the profile's history, and who currently has it — and at what level — is shown in the profile's access list.

The doctor's link expires

You can show your record to a doctor through a link or a QR code without creating an account for them. That link has a lifetime: after it, the link returns "page not found" rather than a stale copy of your record. Expired links are cleaned up automatically instead of sitting around.

What deletion actually does

Deleting your account does not merely hide it from you while the rows stay in the database. The record is marked deleted, and after 30 days it is physically erased together with everything attached to it. Those 30 days are a window to change your mind and to investigate if the deletion was a mistake; after it, there is no recovery, by design.

What we keep to run the model

Model requests are logged — that is what an investigation into "why did the summary say this" is made of. Those records are kept for 90 days and deleted automatically, not "when someone gets to it".

What we do not do

We do not sell your data and do not hand it to ad networks. If that ever changes, you will read about it in this section before it takes effect, and we will ask for your consent again.