Privacy policy

1. Who we are

MedSays (medsays.com and the MedSays apps for Android and iPhone) explains medical and lab reports in plain words. This policy is published by the MedSays team, the controller of your data. Contact: [email protected].

2. Using MedSays as a guest

When you attach a report or ask a question without an account, what you share is sent over an encrypted connection to our server. There it is read in memory, sent to our AI provider to write the answer, and discarded. We do not save reports, explanations or questions to a database, a file or a log. The conversation stays in your browser tab (session storage) until you close it.

3. Using MedSays with an account

An account is optional. If you create one, we keep:

• Account details: your email address, your first name if you give it (encrypted), your password as a one-way Argon2id hash (we cannot read it), your language, and when you agreed to these terms.
• Your conversations: the titles, your questions, the answers, the explanation of each report and the text read from it (up to about 12,000 characters per report). They are encrypted with AES-256 using a key that belongs to your account alone. The names of the files you upload are kept the same way, encrypted, so you can see them in the chat; rename a file before uploading if its name says who you are. The uploaded files themselves (PDFs and photos) are not kept: we read them and throw them away.
• Sign-in and security: your signed-in devices (a label like “Chrome on Windows” and dates), and security events such as sign-ins, password changes and wrong passwords, kept for 180 days. If you turn on two-step sign-in, the authenticator secret is encrypted and recovery codes are stored as hashes.
• Daily usage counts (how many reports and messages today) for the fair-use limit, kept for 60 days. When you delete your account, only the totals for each day stay, with nothing that links them to you.

Nobody at MedSays reads your conversations. We keep them until you delete them. You can delete one conversation, all of them, or your whole account at any time in the app (Account and privacy). Accounts that never confirm their email are removed after 7 days. Our encrypted backups roll over within 14 days, so deleted data also disappears from them by then.

4. Health information and your consent

Reports and questions about your health are sensitive information. We process them only to explain them to you, and only with your explicit consent: the tick box before a guest’s first upload, and a separate tick box when you create an account. You can withdraw consent at any time by deleting your conversations or your account. We suggest removing your name, date of birth and ID numbers from a report before you upload it; the explanation does not need them.

5. Who else processes your data

• OpenAI (AI provider, United States): receives the report or question to write the answer, under its API terms. OpenAI does not use API data to train its models and may keep it for up to 30 days to detect abuse, then deletes it. See OpenAI’s API data usage policy. Your data is processed in the United States for this.
• Hostinger (server and email): our server and database run on a server we rent from Hostinger, and our emails (sign-up and reset codes) are sent through Hostinger mail.
• Cloudflare (delivery and protection): delivers the site and protects it from attacks. It handles connection data such as IP address and browser type.

We do not sell or rent your data, share it with advertisers, or use it for marketing. We would only disclose data if the law required it.

6. Technical data

• IP address: used in memory for fair-use limits and abuse protection, and forgotten within 24 hours. It is not saved with your account.
• Error logs: if something breaks, the server may log the time and a technical error code. Report content is never part of these logs.

7. Cookies and storage on your device

No analytics, advertising or tracking. Only what MedSays needs to work:

• ms_session: keeps you signed in (essential, httpOnly, only when you have an account);
• ms_in: tells the page you are signed in, holds no personal data;
• local storage: a guest’s consent tick, your language choice, your appearance settings (text size, theme, spacing) and whether the chat list is open; session storage: a guest’s conversation in the open tab.

The phone apps keep your sign-in token in the phone’s secure storage (Keychain or Keystore).

8. Why we may process your data

Health information: your explicit consent. Account details: to provide the account you asked for (our contract with you). Security and abuse protection: our legitimate interest in keeping MedSays safe.

9. Your rights

Depending on where you live (for example under the GDPR in Europe or PIPA in Korea), you can access, correct, export and delete your data, object, and withdraw consent. Most of this is built in: Account and privacy > Download my data gives you everything we hold, readable, and Delete my account removes it. For anything else, write to [email protected]; we answer within 10 days. You can also complain to your local data protection authority.

10. Security

Encrypted connections everywhere, chats encrypted at rest with a key per account, passwords hashed with Argon2id, sign-in codes that expire, limits on wrong attempts, optional two-step sign-in, and a private AI service that is not reachable from the internet. No system is perfect; if a breach ever affected your data, we would tell you and the authorities as the law requires.

11. Children

Accounts are for people 16 and older. Younger people should use MedSays only with a parent or guardian.

12. Changes

If we change how MedSays handles data, we will update this page and the date at the top, and tell account holders by email about important changes. See also our terms, the medical disclaimer and your data.