Privacy Policy

Dr. AI ("we," "our," or "us") respects your privacy and is committed to protecting the sensitive data you entrust to us. This Privacy Policy explains how we collect, use, and safeguard information when you use our desktop and mobile application.

1. Information We Collect

A. Account & Profile Information

When you register, we collect:

• Identity Data: Name, email address, and clinic name.
• Authentication Data: Google Account identifiers (via Firebase Auth) to verify your identity.

B. Clinical & Operational Data

To provide our core services, you may input:

• Patient Records: Names, demographics, contact details, and clinical notes.
• Reports & Evaluations: Assessment data, body map annotations, and generated reports.
• Calendar Events: Appointment schedules and team availability.
• Financial Records: Invoice and payment tracking data.

C. AI Interactions

When you use the "Copilot" or AI generation features:

• Input Data: Text prompts and data you submit for AI processing.
• Generated Content: Suggestions, summaries, and reports created by the AI.

D. Usage & Technical Data

• Device Info: Platform (Android, iOS, Windows, macOS, Web), app version.
• Crash Reports: Anonymous error logs to improve stability.

2. How We Use Your Information

• Service Provision: To create reports, manage appointments, and facilitate team collaboration.
• AI Processing: We transmit pseudonymized input data to our AI providers (Google Gemini) solely to generate the requested content. This data is not used to train public AI models.
• Payments: To process subscriptions via Paddle. We do not store your payment card information directly.
• Communication: To send important account updates, security alerts, or appointment reminders.
• Improvement: To analyze anonymous usage patterns and fix bugs.

3. Google API Services

Dr. AI's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we use Google OAuth to:

• Enable Google Sign-In for user authentication.
• Create and manage clinical report documents in Google Drive (with your explicit consent).
• Sync calendar events with Google Calendar (when enabled).

We access only the minimum data required and do not share Google user data with third parties for advertising or other non-essential purposes.

4. AI & Third-Party Processors

We use trusted third-party services to power our application. Your data is handled in accordance with their strict privacy standards:

• Google Firebase: For secure cloud storage, authentication, and database services (US-based, GDPR compliant).
• Google Gemini (Vertex AI): For generative AI features. Data sent to the API is transient and not used for model training.
• Deepgram: For speech-to-text transcription on Pro/Elite plans.
• Paddle: For secure payment processing and subscription management.
• AWS SES: For transactional email delivery (e.g., team invitations).

5. Data Security & Retention

• Encryption: All data is encrypted in transit (TLS/SSL) and at rest within Firebase infrastructure.
• Access Control: Strict Firestore security rules ensure only you and your authorized team members can access your clinic's data.
• Retention: We retain your data only as long as your account is active. You can request full data deletion at any time via the app settings or by contacting us.
• Backups: Firebase automatically backs up your data with point-in-time recovery.

6. Team Collaboration & Shared Data

Dr. AI includes team collaboration features. Messages and files shared in Team Chat are visible only to authorized members of your specific Clinic Team. We do not monitor private team conversations unless required by law.

7. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your account and all associated data ("Right to be Forgotten").
• Export your data in a machine-readable format.
• Withdraw consent for specific data processing activities at any time.
• Lodge a complaint with your local data protection authority (for EU/UK users).

To exercise your rights, go to Settings → Account → Delete Account in the app, or contact us at the email below.

8. Children's Privacy

Our service is intended for use by licensed healthcare professionals. We do not knowingly collect personal information from children under 13 directly. Patient data covering minors must be entered only by authorized professionals in compliance with valid consent and local regulations.

9. Changes to This Policy

We may update this policy to reflect changes in our service or legal requirements. We will notify you of significant changes via the app or email. Continued use of the app after changes constitutes acceptance of the updated policy.