Privacy Policy

Effective date: August 3, 2025 · Last updated: October 5, 2026

DecodeMD ("we," "us," or "our") is committed to protecting your privacy and ensuring transparency in how we handle your personal data. This Privacy Policy describes how we collect, use, store, and share information when you access or use our website or the DecodeMD mobile app.

By accessing or using DecodeMD, you consent to the practices described in this Privacy Policy.

1. Scope of Policy

This Policy applies to all visitors and users of the DecodeMD platform, including individuals located in the United States, the European Economic Area (EEA), the United Kingdom (UK), and California. It complies with:

• The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
• The General Data Protection Regulation (GDPR) (EU Regulation 2016/679)

2. Information We Collect

We collect the following categories of information:

a. Information You Provide

• Medical report content: report text you paste or type, documents you upload (PDF, Word), and photos of report pages you take or choose from your photo library
• Translation settings: the role (for example, Patient or Caregiver) and reading level you choose
• Account information (if you create an account): your name, email address, password (stored securely by our authentication provider, never in plain text), and an optional profile photo
• Saved content (if you are signed in): your translations, the report text they came from, report names you add, and your questions for your doctor
• Marketing preference: whether you opt in to emails from us
• Feedback or inquiries submitted through contact forms or email

b. Automatically Collected Data

• IP address
• Device identifiers, including the iOS advertising identifier (IDFA) only if you allow tracking when the app asks
• App events such as app opens, sign-ups, paywall views, and purchases
• Device and browser type
• Operating system
• Referring URLs
• Pages visited and usage patterns
• Time spent on the site

This information is collected through cookies, analytics tools, server logs, and the software development kits (SDKs) described in Section 5.

3. Legal Bases for Processing (GDPR)

If you are located in the EEA or UK, we process your personal data under the following lawful bases:

• Consent (Article 6(1)(a)) — when you explicitly agree to our use of cookies or submission of text
• Legitimate Interests (Article 6(1)(f)) — for analytics, service improvement, and security
• Contract (Article 6(1)(b)) — when we provide services you request

4. How We Use Your Information

We use your data solely to:

• Translate complex medical language into plain-language summaries, generate optional illustrations, and compare saved reports
• Save your translations and history to your account, if you are signed in
• Process subscriptions and restore purchases
• Measure which links and ads bring people to the app
• Send emails you have opted in to
• Improve the user experience, performance, and interface
• Detect, prevent, and address technical issues and abuse

We do not:

• Sell your data to third parties
• Share your medical report content for advertising purposes
• Allow your medical report content to be used to train AI models

5. Who We Share Data With

We share data only with the service providers below, and only what each needs to do its job.

• OpenAI (third-party AI service). When you translate a report, compare two reports, or generate an illustration, we send the report text, page photos, your chosen role and reading level, and (for comparisons) your saved explanations to OpenAI through our server. OpenAI uses this only to produce your result. Under OpenAI's API data policies, it does not use this data to train its models, and it may retain it for up to 30 days for abuse and safety monitoring before deleting it. The app asks for your permission before sending anything to OpenAI, and you can turn this off at any time in Profile > AI data sharing.
• Supabase. Hosts our database, account sign-in, and server functions. Stores your account information and, if you are signed in, your saved translations.
• RevenueCat and Apple/Google. Process subscriptions and purchases. We never see your payment card details.
• AppsFlyer. Measures which links and ads lead to app installs and sign-ups. On iOS, AppsFlyer uses your advertising identifier only if you allow tracking. AppsFlyer never receives your medical report content.
• Loops. Sends account and marketing emails. Receives your name and email address, and marketing emails go only to people who opt in.

We require these providers to protect your data at least as well as we do and to use it only to provide their services to us.

6. Data Retention and Deletion

If you use the app without an account, report content is processed to create your result and is not saved to our servers. If you are signed in, your translations and the report text they came from are saved to your account so you can view, compare, and export them later. They stay until you delete them or delete your account.

You can delete your account and its saved data at any time in the app under Profile > Delete Account. Data sent to OpenAI may be retained by OpenAI for up to 30 days for safety monitoring, as described in Section 5.

Automatically collected analytics data may be retained for up to 12 months for system optimization and security audits.

You may request data deletion by contacting: privacy@decodemd.co

7. Your Rights

a. Under CCPA/CPRA (California Residents)

You have the right to:

• Know what personal data is collected and why
• Access your personal data
• Request correction or deletion
• Opt out of the sale or sharing of personal information
• Limit use of sensitive personal data (if applicable)
• Not be discriminated against for exercising these rights

To exercise these rights, email: privacy@decodemd.co

DecodeMD does not sell or share your data and is not subject to "Do Not Sell My Info" opt-outs at this time.

b. Under GDPR (EEA/UK Residents)

You have the right to:

• Access your personal data
• Correct inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing
• Lodge a complaint with your local Data Protection Authority

To make a request, email: support@decodemd.co

8. Data Transfers Outside the EU/UK

Our services may be hosted on servers in the United States or other jurisdictions. If you are located in the EEA or UK, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Appropriate safeguards to protect personal data transferred outside the EU

9. Cookies and Analytics

We use minimal cookies and analytics tools (e.g., Google Analytics) to understand traffic patterns and improve functionality. You can manage your cookie preferences through your browser settings or via any consent banner provided.

10. Children's Privacy

DecodeMD is not intended for individuals under the age of 13 (or 16 in the EU/UK). We do not knowingly collect or store data from children. If we learn that a child has submitted data, it will be deleted promptly.

11. Data Security

We implement reasonable technical and organizational safeguards, including:

• SSL/TLS encryption
• Limited session-based data handling
• Role-based access controls (where applicable)
• Use of reputable third-party processors with strong privacy commitments

That said, no system can guarantee 100% security. Use of this platform is at your own risk.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Effective Date." Continued use of our services after a change constitutes acceptance of the new terms.

13. Contact Us

If you have questions or wish to exercise your privacy rights, contact us at: support@decodemd.co

If you are in the EEA or UK, you may also contact your local data protection authority.