Privacy Policy

We use your data to:

• Provide the service: process your documents and generate plain-language explanations
• Operate and improve the service: improve our software, prompts, and product features using aggregate, non-identifying usage metrics and diagnostic logs
• Communicate with you: send account notifications, analysis-completion notices, and support responses
• Process payments: manage subscriptions and billing through Stripe
• Maintain security: prevent fraud, abuse, and unauthorized access
• Meet legal obligations: comply with applicable law, including GDPR and CCPA where they apply

We do not sell your personal information to anyone. We do not use your medical documents, extracted text, or health information to train artificial intelligence models — not our own, and not those of our AI provider; your document text is processed only to return an analysis to you, on a transient basis, and is never used for model training. We do not show third-party advertising or allow advertisers to target you based on your health information.

We design for defense-in-depth and apply security controls aligned with recognized healthcare-security practices:

• Encryption in transit: all traffic is protected with HTTPS/TLS
• Encryption at rest: sensitive health information — including extracted document text, analysis results, conversation history, and health-timeline data — is encrypted at rest using AES-256-GCM
• Password protection: passwords are hashed using bcrypt; we never store them in plain text
• Access isolation: database row-level security ensures you can access only your own data; no cross-user access is possible
• Audit logging: access to protected health information is recorded in an append-only audit log, consistent with the HIPAA Security Rule audit-controls standard (45 CFR § 164.312(b))
• Session protection: account lockout after repeated failed logins, automatic idle-session timeout, and rate limiting on authentication, upload, and analysis endpoints
• Audited infrastructure: private documents are served via expiring, signed access links; our database provider (Supabase) maintains SOC 2 Type II and our payment provider (Stripe) maintains PCI DSS Level 1; security issues are monitored and remediated on an ongoing basis

Important: No system can guarantee absolute security. We work hard to protect your data, but we cannot promise that it will never be compromised. Please use a strong, unique password.

We retain your data only as long as necessary:

• Active accounts: documents, analyses, and account data are retained while your account is active
• Deleted accounts: personal data is permanently deleted within 30 days of account deletion
• Billing records: transaction and billing records are retained for up to 7 years to meet tax and legal obligations
• Aggregate metrics: non-identifying, aggregate usage statistics (which cannot be linked back to you) may be retained to operate and improve the service
• AI processing cache: extracted document text may be cached for up to 30 days to avoid redundant processing; this cache is encrypted and access-controlled

MediWing is intended for adults (18 and older) and is not directed to children. We do not knowingly collect personal information from anyone under 18.

If you are under 18, please ask a parent or guardian to manage any account on your behalf.

If we learn that we have collected information from a person under 18, we will delete it. Contact privacy@medimindlab.com if you believe this has occurred.

MediMindLab, Inc. is based in the United States. Your data may be processed in the United States and in other countries where our service providers operate.

For EU / EEA / UK users: For transfers of personal data outside your region, we rely on appropriate safeguards, including Standard Contractual Clauses where applicable. You have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. To exercise these rights, contact privacy@medimindlab.com.

For California users: Consistent with the CCPA/CPRA, you have the right to know what personal information we collect, to request deletion, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share your personal information. Contact us for a full CCPA disclosure.

For users in Israel, Mexico, and other markets: MediWing is offered as an educational tool operated under U.S. law and is not registered as a medical device or regulated health software in your jurisdiction. Please confirm compliance with your local health-IT and data-protection regulations before use.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice before they take effect.

The "Last Updated" date above reflects the most recent revision.

Continued use after changes take effect indicates acceptance of the updated policy.

Questions, concerns, or requests about your privacy?