Privacy & Data Protection

1. Who we are (Data Fiduciary)

MedFast.AI is operated by Harkirat Singh Lamba, India. We are the Data Fiduciary for the personal data described in this policy. Contact: grievance@medfast.ai.

2. Grievance Officer

Under the DPDP Act, you have the right to raise grievances about how your personal data is handled. Our Grievance Officer is:

3. What personal data we collect

From our database, only:

• Account information: your name, email, optional phone number (with country code), a securely hashed password (bcrypt, 10 rounds), age confirmation, and your marketing consent flag.
• Per-analysis usage row: timestamp, your account ID, language used, document type label (e.g. “Blood Test Report”), text length, tokens consumed, AI provider/model used, and whether the call succeeded or errored. No medical content is stored.
• Salted hashed IP address — for rate-limiting and abuse prevention only. We cannot reverse it to your real IP.
• Acknowledgement records — when you accepted this privacy notice and the in-app safety notice (timestamp + version).
• Admin actions about you — e.g. approval status changes — for audit trail.

What we DO store (encrypted at the application layer with AES-256-GCM, with keys we manage and rotate): your analysis history, family-vault members, medication list, symptom log, notes, passport data, reminders, and vaccination records. This lets you sign in on a new device and see your data — the single most common request from Indian families managing multiple people's health.

Your original files: we also store the PDF or image you upload, encrypted, so you can download it later from your history.

What encryption protects you from: even if our database is dumped or backed up, the medical fields inside it (analysis JSON, notes body, passport contents, symptom notes, reminder messages) are opaque ciphertext. Reading them requires our operator key, which lives only in the application's runtime environment, never in the database or in backups.

Nothing medical touches the browser's disk. When you close the tab, your device is clean — data lives only on our encrypted server. This is stricter than most consumer apps, which cache health data in browser storage.

4. How analysis works (and what we store)

For typed PDFs (most lab reports and discharge summaries): the text is extracted in your browser using PDF.js. The extracted text, plus the original PDF itself, is sent to our server, where the original is written to an encrypted-at-rest (AWS KMS, India region) bucket under your account so you can download it later from your history. The extracted text is forwarded to an AI provider for analysis. Section 6 explains where that happens and what the provider may keep.

For photos and scanned images (including handwritten doctor's notes): the image is compressed in your browser, sent to the AI for visual reading, and the original image is also written to the same encrypted bucket under your account. Section 6 explains what the AI provider may keep.

The AI's response is sent back to your browser, shown to you, and stored encrypted on our server so you can see it on any device you sign into. Your original file stays available from your report history until you delete the report or your account. Deleting removes it from your history and from our storage straight away; the encrypted copy kept for recovery is erased automatically within 30 days.

5. Purpose of processing

We process personal data only for these explicit purposes:

• To operate your account (login, session management).
• To run the AI analysis you requested (the document text / image is sent to an AI provider).
• To enforce rate limits and prevent abuse (IP hashing, daily caps).
• To send service emails (signup notification, account-status updates, security incidents) — these are necessary for the service and do not require separate consent.
• To send optional product updates — only if you ticked the marketing-consent box at signup. You can withdraw this at any time by emailing us.

6. Cross-border data transfers

Everything we store sits in India. Our application, database, file storage and email sending run on Amazon Web Services in Mumbai. Your account record, encrypted history, uploaded files, rate-limit hashes and audit logs are stored in India.

What crosses a border, and why: the document text or image you submit, and other content needed for the AI features you use, is sent to an AI provider outside India. We use two:

• Google Gemini API (primary): processed by Google outside India, including in the United States. Under Google's API terms it can log prompts and responses for a limited time to detect policy violations and meet legal requirements.
• Anthropic Claude via Amazon Bedrock (fallback): used when Gemini is unavailable. Amazon routes each request to whichever of its regions worldwide has capacity, and may keep it there for a limited time to detect abuse. Anthropic does not receive your content.

Payments are processed by Cashfree Payments, an Indian payment gateway, so card and UPI details stay within India's payments system and never touch our servers.

The DPDP Act permits cross-border transfers unless the Central Government restricts a specific destination. As of the review date, no such restriction applies to the destinations above.

7. Data retention

Account data: kept while your account is active. When you delete your account it is closed at once: you're signed out, auto-pay is cancelled, and your shared links, caregiver access and referral code stop working. Your data, including uploaded files, is kept, closed and not visible to anyone, so a deletion made by mistake can be recovered and billing questions answered. To have it erased permanently, email grievance@medfast.ai; we erase it within 30 days, except records the law requires us to keep (such as GST invoices).

Per-analysis usage rows: retained for 12 months then auto-deleted. Aggregated, anonymised counts may be kept indefinitely for product analytics.

Salted IP hashes: retained for 30 days for rate-limit enforcement.

Audit logs of admin actions: retained for 2 years for compliance review.

8. Your rights under the DPDP Act

You have the right to:

• Access the data we hold about you. Use the “Download my data” button on your account page to get a JSON file of everything on our server. (Your in-browser data — reports, family vault, notes etc. — is exported separately from each feature's page.)
• Correct any inaccuracy in your account information. Edit it from the account page or email us.
• Erase your data. Email grievance@medfast.ai and we erase it within 30 days, except records the law requires us to keep. “Delete my account” on the account page closes your account straight away.
• Withdraw consent for marketing emails at any time by emailing us. Service emails (security, account status) cannot be opted out of while you have an account.
• Nominate another individual to exercise your rights in case of death or incapacity (write to the Grievance Officer).
• Raise a grievance with our Grievance Officer (above) and, if unresolved, with the Data Protection Board of India.

9. Children & minors

You must be 18 or older to create an account. We ask for age confirmation at signup.

Family members under 18: as the account holder, you may add your minor children to the Family Vault. The medical data for those children (reports, notes, vaccinations, passport, etc.) is stored encrypted on our server under your account, and you are responsible, as the parent or lawful guardian, for the lawful processing of your minor's data through this service.

Under the DPDP Act, we will not track minors, target them with advertisements, or take any action specifically directed at minors' data on our server (we don't have any to begin with).

10. Security measures

• Passwords are hashed with bcrypt (10 rounds, OWASP baseline).
• Sessions are issued as signed JWTs (HS256) stored in httpOnly, SameSite=Strict cookies.
• HTTPS-only with HSTS for all connections.
• Content Security Policy headers to prevent injection & clickjacking.
• Defence-in-depth prompt-injection filtering on AI inputs.
• IPs are salted & SHA-256 hashed before storage.
• Family-vault, notes, passport, medication, vaccination, and lifestyle data are encrypted at the application layer with AES-256-GCM (per-record random IV) before being stored — offline database dumps yield only ciphertext.

11. Personal data breach notification

If we discover a personal data breach that affects you, we will notify both you and the Data Protection Board of India within 72 hours of becoming aware of it, as required under the DPDP Act.

12. What we'll never do

• Sell or rent your information to anyone.
• Use your medical content to train AI models.
• Show you ads for medications, doctors, or hospitals.
• Send marketing emails without your explicit opt-in.
• Combine your data with data from third-party trackers — we don't use trackers.

13. Sub-processors

We rely on the following sub-processors. Each has its own privacy policy and security posture. Where a provider has multiple regions, we have named the region we actually use.

• Amazon Web Services (Mumbai) — runs the application, the database, encrypted file storage and transactional email (signup, security, account-status).
• Google Gemini API (outside India, including the United States; primary AI provider) — processes document text or images for analysis. See section 6 for what Google may keep.
• Anthropic Claude via Amazon Bedrock (any Amazon region worldwide; fallback AI provider) — used only when the primary provider is unavailable or returns an error. See section 6.
• Cashfree Payments (India) — payment gateway for subscriptions and top-ups. We never see your card number, CVV or UPI PIN; Cashfree returns an order status, which is what we record.
• PostHog (self-service product analytics, hosted in the region configured by the operator — see NEXT_PUBLIC_POSTHOG_HOST) — product usage events only, with session-replay inputs masked. We never pass medical content, document text, notes, passport data, or symptom entries to PostHog. If no PostHog key is configured in your deployment, nothing is sent.

We do not pass your account information to the AI providers — only the extracted document text or image needed for the one analysis you asked for.

14. Changes to this policy

We will update this policy when we change how we handle data. If the change is material, we will require you to re-acknowledge it via the in-app safety notice. The version date at the top of this page indicates the current version.

15. Contact us

For any privacy question or to exercise any right under this policy, email grievance@medfast.ai. Acknowledgement within 48 hours; resolution within 30 days where possible.