Privacy Policy

1. Who we are and what laws apply

SelfMD.ai ("selfMD", "we", "us") provides an app where you can keep your own health records and ask for general health information. You can reach us at privacy@selfmd.ai.

selfMD is not a "covered entity" or "business associate" under the U.S. Health Insurance Portability and Accountability Act (HIPAA), so HIPAA's rules do not govern the information you give us, and you do not have HIPAA rights against us. Instead, the rules that apply to us include:

• FTC Act, section 5. We must not mislead you about how we handle your data or share it in ways that are unfair.
• FTC Health Breach Notification Rule (16 CFR Part 318). If your health information is acquired without your authorization, including by an unauthorized disclosure, we must tell you, the FTC, and in larger incidents the media, within the deadlines in the rule (no later than 60 calendar days after we discover it).
• State health-privacy and consumer-privacy laws, depending on where you live. Examples are the Washington My Health My Data Act, California's Confidentiality of Medical Information Act and California Consumer Privacy Act, and similar laws in other states. These can give you rights to access, delete, and control the use of your health data. See section 8.

2. What we collect

• Account information: name, email address, phone number if you add one, and a password (stored only as a one-way hash). If you sign in with Google or Facebook, we receive the profile details that service shares with us.
• Health information you give us: conditions, medications, allergies, family history, symptoms, vital signs, documents you upload, and health profiles for yourself or for family members you manage.
• Questions and answers: the questions you ask the AI assistant and its answers, to the extent the feature saves them.
• Billing information: payments are handled by Stripe. We receive your plan and payment status, not your full card number.
• Technical information: IP address, browser type, and records of who accessed which health record (an access log that contains identifiers, not the health content). We use cookies needed to keep you signed in. As of this update we do not run advertising trackers or third-party advertising cookies.

3. How we use it

• To run your account, store your records, and show them to you.
• To generate general health information and answers when you ask for them.
• To send account emails (verification, password reset) and text messages for phone verification.
• To process payments for paid plans.
• To keep the service secure, prevent abuse, and investigate incidents.
• To meet legal obligations.

We do not sell your health information. We do not use it for advertising, and we do not use your records to train AI models.

4. Who else handles your data

We use these service providers. Each receives only what it needs for its job.

• Amazon Web Services (AWS). Bedrock runs the AI model; KMS protects your encryption keys. When you ask the AI assistant a question, the text of your question, and your age and gender if you have set them, are sent to AWS Bedrock. We do not send your name or date of birth. We replace your identity with an internal identifier. The question itself is sent as you typed it, the symptom checker also sends the conditions, medications, allergies, family history and surgeries on record for the person you selected, and the signed-in dashboard chat can include their recorded conditions and medications. Please do not type names or other identifying details into questions.
• MongoDB Atlas stores your account and your encrypted records.
• Pinecone hosts a search index built from your records so the app can find relevant items. The content in the index is encrypted with a key specific to you.
• Vercel hosts the website and application. Our hosting logs record requests; we work to keep health content out of them.
• Resend sends our emails. We do not put health information in emails.
• Twilio sends text messages for phone verification. It receives your phone number and the code.
• Stripe processes payments.
• Google and Facebook, if you choose to sign in with them.

We also disclose information when the law requires it (for example a valid court order), to protect someone's safety, or to investigate a security incident. If we are ever involved in a sale or merger, your information would stay protected by this policy, and we would tell you before it became subject to a different one.

5. How we protect it

• Encryption at rest. Your health records are encrypted with AES-256-GCM. Each user has their own data key, and that key is itself wrapped (protected) by a master key held in AWS KMS.
• Encryption in transit. All traffic uses TLS.
• Access logging. Access to health records is logged with who, what kind of access, and when.
• Passwords are stored as one-way hashes.

This is server-side encryption, not end-to-end encryption. selfMD's systems can decrypt your records in order to show them to you and to run the features you use. No system is perfectly secure, and we cannot promise that a breach will never happen. We do not hold a third-party security certification.

6. If something goes wrong

If your health information is acquired by someone without your authorization, we will notify you without unreasonable delay and no later than 60 calendar days after we discover it, as the FTC Health Breach Notification Rule requires. The notice will say what happened, what information was involved, what you can do, what we are doing, and how to reach us. We will also notify the FTC and, where the rule requires, the media.

7. How long we keep it

We keep your information until you delete your account. When you delete your account in Settings, we delete your health records, saved consultations, encryption keys, profile, login data, and the search-index entries described in section 4. If the search-index entries cannot be removed at that moment, the confirmation tells you so, and we record the request and finish removing them afterward. One exception:

• We keep an access log of events, and anonymized records that you gave consent, for security and legal reasons. These contain identifiers and event types, not your health content.

Copies in backups may remain for a limited period after deletion.

8. Your choices and rights

• Access and download. You can export your records from Settings.
• Correct. You can edit your records and profile in the app.
• Delete. You can delete your account in Settings, or email privacy@selfmd.ai.
• Withdraw consent. You can stop using any feature, including the AI assistant, at any time.
• State rights. Depending on your state (for example Washington, California, and others), you may have additional rights, such as to know which third parties receive your health data, to limit the use of sensitive information, to opt out of sale or sharing (we do neither), and to appeal a decision. Email privacy@selfmd.ai to use them. We will not treat you worse for exercising a right.

If you think we have mishandled your information, contact us first. You can also contact the Federal Trade Commission (reportfraud.ftc.gov) or your state attorney general.

9. Children

selfMD is for adults. You must be 18 or older to create an account. We do not knowingly collect information from children under 13 and will delete it if we learn we have. If you keep records for a child in your care, you confirm that you are their parent or legal guardian.

10. Not medical care

selfMD gives general health information. It does not diagnose, treat, or replace a clinician, and it is not for emergencies. If you may be having an emergency, call 911. In the U.S. you can call or text 988 for mental-health crisis support, and call Poison Control at 1-800-222-1222. See our Terms of Service.

11. Changes

If we change this policy in a way that matters, we will post it here, update the date at the top, and tell you in the app or by email before it applies to information you have already given us.

12. Contact