Privacy Policy

1. Introduction

MedicalGPT ("we," "our," "us") provides an AI-assisted health companion available on the web and as a mobile app ("Service"). See Section 12 for the legal entity operating the Service. Because the Service is built around your health information, this policy is deliberately specific about what we collect, why, and who it's shared with — not just a generic outline. By creating an account or using the Service you agree to the practices described here.

2. Information We Collect

We collect the following categories of information:

Account & identity data

• Email address, username, and password (stored as a salted hash, never in plain text)
• Authentication data if you sign in via Google or a one-time emailed "magic link"
• Basic profile details you provide (name, date of birth, sex, height/weight)

Health & medical information you provide

• Symptoms, severity, duration, and body location you log for your urgency awareness check
• Existing conditions, medications, dosages, and schedules you record
• Health timeline entries, lab reports, and documents you upload
• Family member health records you add to a shared family vault
• "Second opinion" requests and the case details you submit with them
• Wearable device data you choose to sync (e.g. steps, heart rate, sleep), where supported
• Calorie/diet log entries and workout plan data
• Voice recordings you submit for transcription, and the resulting transcript
• Your conversations with the AI assistant/chat, including any files you attach

Technical & usage data

• Device type, operating system, app version, and crash/error diagnostics
• General usage patterns to help us fix bugs and prioritize improvements
• IP address and approximate location derived from it, for security and fraud prevention

Payment data

• Subscription/plan status and billing history. Card numbers are never collected or stored by us — see Section 8.

3. How We Use Your Information

• To generate AI-powered health insights, urgency awareness check results, and chat responses
• To let you track, and share within your family vault, ongoing health information over time
• To send you account, security, and magic-link sign-in emails
• To process payments and manage your subscription/credits
• To detect, investigate, and prevent fraud, abuse, and security incidents
• To fix bugs, monitor uptime, and improve the Service

We do not use your health data to train third-party general-purpose AI models, and we do not sell your personal or health information to anyone, for any purpose.

4. Who We Share Data With

We do not sell your data. We share the minimum data necessary with the following categories of service providers:

• AI providers — relevant parts of your request are sent to our AI providers, Fireworks AI and OpenAI, to generate responses.
• Cloud hosting & storage — data and files are stored on our cloud infrastructure including AWS S3.
• Payments — Stripe processes all payments; we never see or store your full card number.
• Email delivery — transactional emails are sent through a third-party email provider.
• Authentication — Google sign-in is brokered through Supabase.
• Crash & error monitoring — technical crash reports (not your health data) are sent to our error-monitoring provider.

5. Sensitive Health Information

We treat everything in Section 2's "Health & medical information" category as sensitive. Where our infrastructure supports it, particularly sensitive fields are stored encrypted at rest, and access is restricted to what each part of the Service needs to function.

6. Security Measures

We use industry-standard safeguards including encryption in transit (HTTPS/TLS), encryption at rest for sensitive stored fields, hashed password storage, access controls, and monitoring for suspicious activity.

7. Your Rights & Choices

• Access & correction — view and update most information directly in the app.
• Deletion — request full deletion by contacting us (Section 12).
• Data export — request a copy of your data by contacting us.
• Marketing emails — non-essential emails include an unsubscribe option.

8. Payments

Subscription payments are processed by Stripe. We store your subscription status and billing history, but we never receive or store your full card number, CVV, or bank details.

9. Data Retention

We retain your account and health data for as long as your account is active. If you delete your account, we delete your data within a reasonable period, except for records we're legally required to keep.

10. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us (Section 12) and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy as the Service changes. Material changes will be reflected by an updated Effective Date at the top of this page.

12. Contact Information

For privacy questions, access/deletion requests, or anything else in this policy, contact us at hello@askmedicalgpt.com.

TangentX LLC
30 N Gould St Ste N, Sheridan, WY 82801
(650) 300-0125