Trust & Compliance
How we handle your medical data
We built MedFast.AI around four principles, each with concrete engineering choices behind them. This page is the public record of what we've done, when it was last reviewed, and where to ask questions.
We don't give medical advice
The AI is configured as an explainer only. It cannot diagnose, prescribe, or instruct action — every result tells you to consult your doctor.
Encrypted, only readable by you
Reports, family vault, notes, passport, medications — encrypted at rest with AES-256-GCM. The sensitive synced rows are encrypted at the row level before they even hit our database.
DPDP-compliant by design
India's Digital Personal Data Protection Act, 2023. Consent recorded with version + timestamp; rights of access, correction, erasure honoured.
AI can be wrong — we say so
Every user must acknowledge a 3-checkbox safety notice before first use. Every result page repeats the reminder.
What we've done — and where to verify it
| Area | What we've done | Where |
|---|---|---|
| Privacy Policy | Live, versioned. Last updated: 2026-11-14 (v4). | Open |
| Terms of Service | Live, versioned. Last updated: 2026-11-05 (v2). | Open |
| Grievance Officer | Named in privacy policy + footer. 48-hour acknowledgement, 30-day resolution. | Contact |
| Right of access (DPDP §11) | One-click JSON download of everything we hold on you. Account info, every AI call, audit events, and your encrypted content — decrypted for you as the account holder. | Account → Your data |
| Right of erasure (DPDP §12) | Delete your account to close it at once; permanent erasure on request, within 30 days. | Account → Delete |
| Proof of consent | Privacy policy version + timestamp recorded per user at signup. Safety-notice acknowledgement recorded with version + timestamp on first launch. | Server-side audit trail |
| Adult-only accounts | Account holders must be 18+. Server-enforced. Children added to the Family Vault are covered by the parent's consent and lawful-guardian acknowledgement. | Enforced at /signup |
| Guardian consent | When adding a person to the Family Vault, account holder acknowledges consent / lawful guardianship. | Family vault |
| Data minimisation + encryption | Our database stores: account row, salted IP hash, per-analysis usage row (no content), admin audit events, and encrypted medical content (AES-256-GCM) so users can see their history across devices. Your original files are stored encrypted so you can download them later. | Architectural |
| Processing commitments | Your medical content is encrypted at rest and private to your account across the devices you sign in on. We don't publish infrastructure specifics on this page — reach us at support@medfast.ai for the technical architecture document under NDA. | Privacy §13 |
| Cross-border transfers | Only one thing crosses a border: the document text or image sent to an AI provider for analysis. Providers may keep it for a limited time under their terms, as our privacy policy explains. Payments route through Cashfree, an Indian gateway, so card and UPI data stay inside India. | Privacy §6, §13 |
| Breach notification | 72-hour DPBI + affected-user notification runbook, including templates and contact tree. | Internal: docs/breach-runbook.md |
| Data Protection Impact Assessment | Documented risks, mitigations, and residual risks. Reviewed every 6 months. | Internal: docs/dpia.md |
| Security baseline | bcrypt password hashing, HttpOnly JWT cookies, HTTPS + HSTS, CSP, salted IP hashing, defence-in-depth prompt-injection filtering, parameterised SQL via Drizzle. Application secrets held in AWS SSM Parameter Store as SecureString. | Privacy §10 |
| Encryption at rest | AWS RDS Postgres volumes encrypted with an AWS KMS customer-managed key (not AWS-managed). The medical columns inside the database are additionally encrypted at the application layer with AES-256-GCM so a database dump yields ciphertext. | Infrastructural |
| Encryption in transit | TLS to RDS from application nodes; TLS to every external API we call (Gemini, Bedrock, SES, Cashfree, PostHog); HTTPS + HSTS for every browser connection. | Infrastructural |
| Backups | RDS automated snapshots with a 14-day retention window. Snapshots inherit the same KMS customer-managed key, so a restored backup is unreadable without it. | Infrastructural |
| Access control | Human and machine access to AWS is via IAM — scoped roles, no shared credentials, no long-lived keys shared between people. The runtime task role is the only identity with permission to use the KMS key. | Infrastructural |
| AI safety prompts | Every AI route is configured as an information-only explainer. Explicit rules forbid diagnosis, prescription, and imperative instructions. | lib/prompts.ts and others |
| First-launch safety gate | 3-checkbox forced acknowledgement before any use. Cannot be dismissed without ticking. | In-app, all routes |
| Right to withdraw marketing consent | Separate, optional opt-in at signup. Withdrawn by emailing the Grievance Officer. | Email us |
| No advertising, no third-party trackers | We do not show ads. We do not embed third-party analytics or trackers. Cookies used only for authentication. | Architectural |
What we don't do
- We don't train AI models on your medical content. The text and image you send go to the AI provider for one analysis, come back as a response, and are not reused for anyone's training.
- We don't keep a card on file. Every purchase is a one-time pack checkout. No subscription, no auto-renewal, no recurring charge — your card details leave with the Cashfree checkout page and we never see them.
- We don't show ads. No medication ads, no doctor-referral ads, no sponsored lab tests. The business model is one-time pack purchases; the user is the customer, not the product.
- We don't embed third-party trackers. Cookies are used only for authentication. Our product analytics tool (PostHog) masks all input values and never receives medical content.
What MedFast.AI is NOT
- Not a medical device within the meaning of the Drugs & Cosmetics Act / CDSCO regulations. We do not diagnose.
- Not telemedicine under the Telemedicine Practice Guidelines 2020. We do not advise; we translate.
- Not an emergency service. In a medical emergency, call 112 (India) — do not rely on this app.
- Not always right. AI explanations can be wrong. Confirm with a qualified medical professional before acting on anything.
The architectural promise
Your medical content — reports, family vault, notes, passport, medications, trends, vaccinations, lifestyle profile — is stored encrypted at the application layer with AES-256-GCM on our servers in Mumbai, using an operator key that lives only in the application's runtime environment. The underlying RDS volumes are also encrypted with an AWS KMS customer-managed key, and automated snapshots (14-day retention) inherit that key, so a database dump or restored backup yields ciphertext, not medical data. Original files you upload are stored encrypted too.
The browser holds your data only in memory while the tab is open. Close the tab and your device is clean — nothing medical persists to local storage or session storage. Sign in on a new device and your history is there.
Delete your account and it's closed at once, with nothing visible to anyone; ask us and we erase your data permanently within 30 days. We don't train AI models on your data.
Questions, audits, or partnership conversations
For DPDP grievances, audit requests, or B2B partnership conversations (hospital, lab, insurer), write to grievance@medfast.ai. The Grievance Officer / Data Protection contact is Harkirat Singh Lamba, India.
For responsible security disclosures (vulnerabilities, suspected abuse, dependency reports), write to security@medfast.ai. We acknowledge within 48 hours and will not threaten legal action for good-faith research that respects user data.
This page is a living summary. Last reviewed on 2026-10-18. Current consent version: 2026-11-14 (v4).