Privacy notice

1. Who this applies to

HealthScan is a personal health-document tool. You are the owner of your account and of every document you upload. We process that information only to provide the service you requested, and only after you accept this notice at sign-up.

2. Information we collect

• Account data: email, password (stored as a one-way hash, never in plain text), optional name, phone, date of birth, and similar profile fields.
• Health documents: PDFs and images you upload, plus text extracted from them (OCR), structured labs, medications, diagnoses, and related notes.
• Consent and audit records: which versions of this notice and our AI terms you accepted, when, and from which IP address; access logs when original files are downloaded.
• Technical data: session tokens, device/user-agent, and operational job IDs needed to run processing securely.

3. Why we process your data

• Create and authenticate your account.
• Store, classify, and display your medical documents.
• Run on-server OCR so we can read document text without sending the original file to an AI provider.
• Extract structured facts (labs, medications, and similar) after identifiers have been removed from any text sent to a model.
• Show your timeline, My Health, and related insights to you only.
• Meet security, consent, and account-deletion obligations.

4. Consent we record at sign-up

Creating an account records versioned consent for:

• Data processing — storing and using your health documents to operate HealthScan.
• Terms of service — the rules of using the product.
• AI processing — sending de-identified clinical text to a third-party model so we can extract structured data. Identifiable names, record numbers, and similar identifiers are not included in that prompt.

If consent is missing, withdrawn, or out of date, health features that need it are blocked until you agree again.

5. How we protect your information

• Your data is isolated. Each account can only read its own records. Guessing another person's document ID does not grant access.
• Encryption in transit. Staging and production require TLS for the app, database, and related services.
• Encryption at rest. Uploaded files are stored in private object storage with server-side encryption. Sensitive storage pointers and identifier fields are additionally encrypted in the application database.
• Passwords are hashed. We never store or log your password in readable form.
• OCR stays on our servers. Original PDFs and images are not sent to the AI provider.
• De-identification before AI. Names, contact details, medical record numbers, dates, and other HIPAA-style identifiers are replaced with placeholders (for example PATIENT_1) before any model call. Real values are restored only inside HealthScan after the model responds.
• Fail-closed AI calls. If identifiable information is still detected after scrubbing, we do not send the prompt to the model.
• Access audit. Downloads of original documents are logged (who, what, when). Audit records are append-only.
• Least-privilege storage paths. File locations use your account id, not your name, and are not exposed as public URLs.

6. Third parties and AI

We may use a third-party large-language-model provider to help structure clinical text. Under the default policy that provider receives only de-identified prompts — not your original file, and not your real name or record numbers. We do not sell your health information. We do not use your documents for advertising.

7. Retention and deletion

• We keep your account and documents for as long as the account is active so you can use the product.
• You can delete individual documents from Medical Docs. That removes the record, extracted data, and stored file.
• You can delete your account from Settings. We then erase account data, consents, documents, files, and related processing jobs across our systems — not merely disable login.

8. Your rights

• Access the documents and profile data stored in your account.
• Correct profile information from Settings.
• Download original documents you uploaded.
• Delete documents or the entire account.
• Withdraw consent by deleting the account (health processing cannot continue without it).

9. Important limits

HealthScan helps you organize records; it is not a medical device and does not provide diagnosis or treatment. Extracted values can be wrong — always review them against the original document. This notice describes how the product is designed to handle data; it is not a claim that HealthScan is a HIPAA covered entity or that a business associate agreement is in place with every subprocessor.