Privacy Policy

MedMetric AI ("we", "us") operates the MedMetric AI application and is the data controller for the personal data described in this policy.

This policy explains what data we collect, why, who processes it, how long we keep it and the rights you have. For any privacy question or request, contact support@medmetricai.com.

Account data: your email address and password (stored only as a secure hash).

Health documents you choose to upload — lab reports, imaging reports, medical images (including DICOM studies), prescriptions and similar records — plus the structured values our AI extracts from them (test results, dates, findings, medications, demographics written on the documents).

Health information you enter yourself: vitals (such as blood pressure or blood sugar), medications, procedures/surgery history, and health-profile details you choose to provide (date of birth, sex, height, weight, smoking status, chronic conditions, allergies, family history).

Conversations with the AI assistant (text chat and voice-chat transcripts), which may reference your health data.

Payment data: handled by our payment processor (Stripe). We do not see or store your full card number.

Technical and consent data: your IP address, device/browser information, basic logs, and a record of the consents you gave (what, when, which document version).

Health data is a special category of personal data. We process it on the basis of your explicit consent, which you give at sign-up and can withdraw at any time.

We also process data to perform our contract with you (to operate your account and provide the service), for our legitimate interests in keeping the service secure and working, to comply with legal obligations, and — for marketing emails only — on the basis of your separate, optional consent.

To give you analysis, trends, reports and recommendations about your own health inside the app; to operate and secure your account; to process payments; and to send you service messages (such as verification and important notices).

We send product/marketing emails only if you opted in, and you can opt out at any time.

We do not sell your data, use it for advertising, or share it with insurers or employers.

To produce the analysis, relevant parts of your documents and extracted values are processed by third-party AI providers (such as Google, OpenAI and Anthropic) acting as our data processors. They process the data to generate the response on our instructions and do not receive your account identity beyond what appears in the documents themselves.

Payments are processed by Stripe. We also use infrastructure providers for hosting and email delivery. All such providers act as processors under data-processing terms and may only use the data to provide their service to us.

Some of our processors may process data in countries outside your own, including outside the European Economic Area. Where they do, we rely on appropriate safeguards — such as an adequacy decision or the European Commission’s Standard Contractual Clauses — to protect your data.

Strictly-necessary cookies always run: the login/session token that keeps you signed in, your language (locale) preference, and a record of your cookie choice.

With your consent (the cookie banner), we additionally use analytics and marketing cookies (for example Google Analytics or advertising pixels) on our public marketing pages only — never on the pages that show your health data. You can refuse or withdraw this at any time; refusing never limits the service. We never share your health data with advertising platforms.

Your documents and extracted health data are stored on our own servers, encrypted in transit (TLS) and at rest. Access is limited to your authenticated account and to the limited internal access needed to operate the service.

Your data is kept for as long as your account exists, so your health history and trends keep working.

When you delete a document, its stored file, extracted values and search vectors are deleted. When you delete your account, your documents, extracted values, conversations, vectors and the consent records stored in the app are permanently removed. Limited transaction records may be retained by our payment processor (Stripe) where required by law.

You have the right to access, correct, export (portability), delete, restrict and object to the processing of your data, and to withdraw any consent at any time — withdrawing consent does not affect processing already carried out.

You can view, export and delete your data directly in the app at any time, or email support@medmetricai.com. If you are in the EEA, the UK or a similar jurisdiction, you also have the right to lodge a complaint with your local data-protection supervisory authority.

MedMetric AI is not intended for children. You must be at least 18 (or the age of majority where you live) to use it, and we do not knowingly collect data from children.

We may update this policy from time to time. When changes are material we will update the "last updated" date and, where appropriate, notify you.

Questions about this policy, or to exercise your rights: support@medmetricai.com