How we protect your data

Encryption before your records are stored

AIP encrypts protected health-record content, uploaded files, and Guide conversations on our server before storing them. We use AES-256-GCM encryption, which also checks for changes to encrypted content. Each patient record has its own data-encryption key.

The master key used to protect those record keys is managed separately in Google Cloud Key Management Service. A copy of the database alone does not provide the master key needed to read protected content.

Your connection to the live site uses HTTPS to protect information in transit. Some information needed to run the service, such as account identity, access permissions, timestamps, and usage metadata, is outside our medical-content encryption. AIP decrypts information to display it to authorized users and carry out requested features.

A password is only the first step

Access to records requires both your password and an authenticator-app code. AIP checks your permission for the specific record on the server and again through database access rules. Having an account, knowing a record address, or holding an app administrator role does not by itself grant access to someone else’s medical content.

Sensitive actions, including exporting data, deleting health data, and closing an account, require a recent two-factor verification. Operational access to the systems running AIP is separate from ordinary app access.

You control caregiver access

Record owners choose who can access a record and which permissions they receive. Invitations are tied to the recipient’s confirmed email address. You can change or revoke access; sharing a Family plan does not automatically share medical records.

Revoking access prevents future access through AIP. It cannot retrieve information someone already viewed, copied, or downloaded.

Clear boundaries for AI and payments

When you request an AI explanation, the applicable AI provider receives your question and the conversation or record context needed for that request. Requests are sent from our server. Omitting a profile name or birth date does not make clinical notes or free text anonymous.

AI providers have their own retention, training, and processing practices, which depend on the provider, account, and settings. Using your own API key uses your provider account and its terms. See our AI processing disclosure for details.

Connected AI API keys and health-system access tokens are encrypted when stored. Our billing integration uses Stripe for payment details and sends billing information rather than medical records or Guide conversations.

Protection while the service runs

AIP checks encrypted content for tampering and requires server verification before the database accepts protected changes. Change history supports accountability. Application logs are designed to record operational details rather than medical content, full AI questions and answers, passwords, or API keys.

Optional visit analytics are limited to eligible signed-out Home and About pages after you allow them. Health-record and Guide pages are excluded.

Signed-in pages and record downloads instruct browsers and shared caches not to store their contents. Browser security headers help prevent pages from being embedded in other sites and restrict unnecessary device permissions. Downloads, screenshots, and information you copy onto your own device still need your protection.

Encrypted backups and careful deletion

Our backup process copies encrypted records and files into an additional encrypted archive protected by a separate backup key. Application-managed backup storage is configured for a 30-day lifecycle.

Deleted information can remain temporarily in older backups until those backups expire. Our restore process is designed to reapply deletion requests before restored data is used. Deletion does not instantly remove every historical or third-party copy.

Your records, your choices

In Data & Privacy settings, you can export your information, delete your health data while keeping your account, or close your account. Export and deletion controls do not depend on a paid subscription. Store downloaded exports carefully: they contain readable information.

Use a unique password, keep authenticator codes private, and review caregiver permissions. For privacy or security questions, contact support@aipatientguide.com. Please do not email passwords, API keys, or full medical records.

What these protections mean

These controls reduce risk; no online service can guarantee absolute security. AIP and the providers needed to deliver a requested feature may process readable information. Encryption is one part of protection, alongside access rules, operating practices, and your choices.

This page explains our technical safeguards. Our Privacy Policy and Consumer Health Data Privacy Policy explain collection, use, recipients, and privacy rights.