Privacy and data use
What happens to a document, step by step.
Here is what the app processes, which service providers may receive information, and what is encrypted when saved. Identifier removal is best-effort, not a guarantee.
Follow one document through the app.
Select a step to see the kind of processing involved.
You upload a photo or PDF.
Uploads are limited to 5 files, 10 MB per file, and 5 pages total. The server validates file content, not just its filename. When saving pages to the vault, stored page labels are generic rather than the uploaded filenames.
Your device to the application serverThe application server extracts text.
Text is extracted from documents and OCR is run by the application. The app sends extracted, scrubbed text for AI analysis; it does not send the original page image as the report-analysis prompt.
Processed by the applicationThe app tries to remove selected identifiers.
Rules attempt to remove names and other identifiers, and remove date of birth. Age and gender may be retained as clinical context. Rule-based scrubbing can miss details or remove useful text; review the original document and do not upload information you are uncomfortable sharing.
Example phone: 00000 00000
Example record ID: SAMPLE-123
Google Gemini is used for AI features.
Scrubbed document text is used for analysis and embeddings. Saved profile age and gender may also be included in analysis when available. For questions, the question and any selected report context may be sent for an answer. Embeddings support retrieval; they do not decode an answer by themselves.
Information sent to GoogleSaving to the vault is optional for analysis.
If you choose to save, report text, explanations, translations and stored page files are encrypted by the application before persistence. The application can decrypt them for an authorized user; this is not end-to-end encryption. Profiles and some identifying or search metadata are not application-encrypted.
Saved in the vault if you opt inSpeech is a separate action.
When you request spoken audio in the app, the selected text is sent to the Edge text-to-speech service to generate speech. It is not sent for speech unless you request it.
Text sent to the speech provider when requestedWhat may be stored, and whether it is encrypted.
Application encryption protects selected content in storage. It does not hide all metadata from database operators.
| Data | Stored by the app | Application-encrypted |
|---|---|---|
| Report text, explanations and translationsWhen saved to the vault | Optional | Yes |
| Compressed page filesWhen saved to the vault | Optional | Yes |
| Cached question answersUsed to reuse a matching answer | Yes | Answer payload encrypted; cache identifiers and some metadata are not |
| Family profile detailsName, relationship, age, gender, blood group and known conditions | Yes | No |
| Report dates, filenames, hashes and embeddings | Yes for saved reports | No |
| Google account name and email | Yes | No |
Household access is controlled by roles and profile scope.
Owners manage access. Viewers can view permitted records and ask questions; editors can also upload and edit permitted profiles. Access is tied to the invited Google email, and can be removed by the owner.
Questions people ask.
Can I delete a report?
How long are saved records kept?
How long does sign-in last?
Has the app been independently audited?
Is this medical advice?
Something unclear about data handling?
Support contact details are not configured in this deployment.