Consumer Health Data Privacy Policy

• Documents you upload (lab reports, prescriptions, imaging and other medical documents), the text extracted from them, and the AI-generated explanations of them. Purpose: to give you plain-language explanations.
• Health conditions, medications, test results and markers found in those documents, and measures we derive from them (trends over time, alerts, calculators such as biological age). Purpose: to show you how your results change and to flag items worth discussing with your clinician.
• Health profile details you choose to enter (for example, date of birth, conditions, goals). Purpose: to personalize explanations.
• Your questions and our answers in the in-app assistant, where they concern your health. Purpose: to answer your questions and remember context you have already shared.
• Records you import from a connected health-records service, if you connect one. Purpose: to include those records in your timeline.

We do not collect precise location data, and we do not use a geofence around any health facility. We do not sell consumer health data.

We collect consumer health data from you (uploads and entries), from the records service you connect, and by deriving it from what you provide. We do not buy consumer health data from data brokers.

Service providers acting for us (processors), under contract and only to run MediWing: Anthropic (AI analysis; document text only, never your name or email), Voyage AI (search embeddings), Supabase (database and file storage), Vercel and Railway (hosting and background processing), and Upstash (caching). Our Privacy Policy lists what each receives.

Third parties, only with your consent: if you connect an AI assistant (for example, Meta Muse) to your account, the assistant platform receives the information you allow on the consent screen. That platform then handles it under its own policies. We do not share consumer health data with any other third party, and we do not share it with affiliates.

We may also disclose information when required by law or to protect safety, as described in the Privacy Policy.

We collect and use consumer health data to provide the service you request. We share it with a third party (such as a connected assistant) only after you give separate, specific consent on the consent screen, which you can withdraw at any time in Settings > Connected apps.

• Access: confirm whether we collect your consumer health data, see it, and get a list of all third parties and affiliates we have shared it with.
• Withdraw consent to collection or sharing.
• Delete: delete your documents, analyses and other data in the app, or delete your account in Settings. We delete within 45 days of verifying your request and notify the processors and third parties that hold your data so they can delete it too. Data held by an assistant platform you connected is controlled by that platform, so use its controls as well.
• Appeal: if we decline a request, reply to our decision to appeal. We answer appeals within 45 days. If you are still unsatisfied you can contact your state Attorney General (in Washington, atg.wa.gov).

We will not discriminate against you for exercising these rights. Rights apply to consumers as defined by each state’s law, including Washington and Nevada residents.

If we change how we collect or share consumer health data, we will update this page and ask for any consent the law requires before the change takes effect.