Privacy Policy

1. Who we are and what this policy covers

AI Patient Guide (AIP) is operated by 916 Technologies. This policy covers our website, accounts, health-record features, AI explanations, billing and support. Contact us at support@aipatientguide.com.

AIP helps explain medical information. It does not independently diagnose conditions, confirm a diagnosis, prescribe or choose treatment. The service is currently in preview. Please use synthetic information and do not enter real health information while the preview notice is displayed.

Our Consumer Health Data Privacy Policy describes health information specifically.

2. Information we collect

• Account information: email address, profile name, account identifiers, preferences, sign-in and two-factor authentication information.
• Information you submit: patient profiles, birth dates, measurements, laboratory results, diagnoses and conditions, medications, visits, clinicians, notes, uploaded documents and other information you choose to provide. This can include sensitive information about physical, mental, reproductive or sexual health.
• AI interactions: questions, conversation history, explanations, summaries, extracted information, citations, provider choices and encrypted API credentials when you connect your own provider account.
• Sharing information: caregiver invitations, recipient email addresses, access permissions and actions taken on shared records.
• Billing information: subscription and payment status, billing contact details and identifiers supplied by Stripe. Payment details are collected through Stripe; AIP does not store full payment-card numbers.
• Technical and support information: requests and messages you send us, IP addresses and browser/device information processed by our infrastructure, timestamps, security and audit events, errors and service-usage metadata.

Information comes from you, people you authorize, records you choose to submit through supported features, and the operation of the service. AIP also generates explanations and derived information. The availability of an integration does not mean we can access records you have not authorized.

3. How we use information

We use information to provide the features you request; organize and display records; generate requested explanations; authenticate users and enforce permissions; manage subscriptions; answer support and privacy requests; maintain backups; protect the service; and meet legal obligations.

We do not sell your personal or health information or use your health information for behavioral advertising. Providing information for an AI explanation does not authorize its use for unrelated advertising.

4. When information is shared

We disclose information as needed to operate the service, carry out your instructions and comply with applicable law:

• People you authorize: caregivers can access a shared record according to the permissions you grant. You can change or revoke access. Revocation cannot take back copies someone already viewed or downloaded.
• Infrastructure providers: Supabase provides authentication, database and file storage; Vercel hosts the application; Google Cloud provides key management and encrypted backup infrastructure; and GitHub supports development and backup automation. These services can process account, technical or encrypted data as required for their roles. The application processes readable health information when serving authorized requests.
• AI providers: the provider used by your plan or selected in AI Configuration receives the content needed for your AI request. Supported integrations include Anthropic, OpenAI, Google and xAI; availability depends on the current configuration.
• Payments: Stripe processes payments and subscription services. Our billing integration sends billing identifiers and transaction information, rather than medical records, diagnoses or Guide conversations.
• Support: Google Workspace processes business email, including information you choose to send to support. Avoid sending medical records, passwords or API keys in ordinary email.
• Legal and security purposes: information may be disclosed where required by law or necessary and permitted to protect users, rights and service security. A corporate transaction does not remove applicable privacy obligations.

5. AI processing and your choices

When you request an AI explanation, AIP may send your question, relevant conversation history and selected record excerpts to the applicable provider. Record context can include measurements, diagnoses, conditions, medications and notes. Even if a profile name or birth-date field is omitted, free text and clinical details may identify a person.

Provider retention, training, safety-review and deletion practices depend on the provider, account, model, endpoint and settings. Connecting your own API key uses your provider account and its applicable terms. We do not promise that all requests have zero retention or that completed processing can be reversed.

Use AI Configuration to manage a connected provider. You can stop requesting AI explanations and contact us to withdraw permission for future processing or request deletion. Withdrawal does not undo processing already completed. Non-AI record features remain available where supported.

6. Security and access

We use application-level encryption for protected health-record content and files, key management, access controls and two-factor sign-in. The application decrypts information when needed for an authorized feature. Account details, relationship and access metadata, timestamps and some operational information are not protected by the same medical-content encryption.

This is not a promise that the application can never read your information or that security is guaranteed. Authorized operational access and service-provider processing may be necessary. We investigate suspected incidents and provide notices required by applicable law.

7. Cookies and operational records

We use cookies and browser storage for sign-in, sessions, security and workflows such as opening an invitation. Our infrastructure processes network and request metadata. Security, access, audit and AI-usage records support operation, abuse prevention and troubleshooting.

Application logging is designed to exclude medical content, full AI prompts and responses, passwords and API keys. This does not mean all metadata is anonymous or that infrastructure providers keep no logs.

8. Retention, export and deletion

We retain account and record information to provide the service while your account and records remain active. Retention also depends on deletion requests, security needs and applicable legal obligations. Limited billing, security, audit and request-handling records may need to be retained after other information is deleted, as permitted or required by law.

Data & Privacy settings provide controls to export information, delete health data while keeping your account, or close your account. Deletion requires verification. Once intentional deletion is completed, AIP does not offer restoration of that deleted health information.

Encrypted disaster-recovery backups can temporarily contain deleted information. Our application-managed backup process is configured for a 30-day lifecycle, and our restore process is designed to reapply deletion requests before restored data is used. This is not a promise of immediate destruction of every historical or third-party copy. Contact us for questions about a particular deletion or backup.

People who previously downloaded an export, and independent healthcare or AI providers, may retain their own copies under applicable obligations. We address requests to notify recipients or seek provider deletion where required by law.

9. Privacy requests and applicable rights

Depending on where you live and applicable law, you may have rights to know about processing and recipients; access, correct, export or delete information; withdraw consent; appeal a decision; or exercise other privacy choices. We do not unlawfully discriminate against you for exercising applicable rights.

Email support@aipatientguide.com with the subject “Privacy request” or “Privacy appeal.” You can use this contact even if you cannot sign in. Authorized representatives may contact us with appropriate proof of authority. Do not include passwords, API keys or full medical records. We may request information reasonably needed to verify identity and authority, respond within applicable legal deadlines, and explain any lawful limitation or denial.

10. Children and international use

Accounts are intended for adults aged 18 or older. AIP is not directed to children. Contact us if you believe a child has submitted information improperly so we can address it.

AIP is initially intended for U.S. users. Our providers may process information in the United States or other locations where they operate, subject to applicable requirements.

11. Updates and contact

We may update this policy as the service and our practices change. We will revise the effective date, provide notice of material changes as appropriate, and obtain additional consent where required. Posting this policy does not replace any separate consent required for a feature or new use of information.

Privacy, security and appeals contact: support@aipatientguide.com. Operator: 916 Technologies, operating AI Patient Guide.