Privacy Policy

1. Introduction

Welcome to mygastro.ai / AI Gastro ("we," "our," or "us"). We are committed to protecting your privacy and handling your personal and health information with care. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our AI-powered gastroenterology health assistant platform (the "Service").

If you do not agree with this Privacy Policy, please do not use the Service.

2. Information we collect

2.1 Personal Information

We collect information that you provide directly to us, including:

• Account information (name, email address, phone number)
• Profile information (date of birth, gender, location)
• Authentication/session data (for sign-in and security)

2.2 Health information

You may choose to provide health information, including:

• Medical symptoms, conditions, and health concerns you share with our AI assistant
• Conversation history with our AI health assistant
• Medical documents, reports, and images you upload
• Appointment information and medical history
• Treatment plans and medication information

2.3 Technical Information

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, features used, time spent)
• Log data (access times, error logs, performance metrics)
• Voice input: when you use voice features, your browser may process audio for speech-to-text. We do not sell voice data and we aim to minimize any audio retention.

3. How we use information

We use the information we collect to:

• Provide, maintain, and improve our AI health assistant services
• Generate personalized health information and recommendations
• Facilitate communication between you and healthcare providers
• Schedule and manage appointments
• Process and analyze medical documents you upload
• Respond to your inquiries and provide customer support
• Send administrative communications (security alerts, updates)
• Conduct research and analytics to improve the Service (preferably using de-identified data)
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations and enforce our Terms of Service

4. AI & model improvement

The Service uses AI to generate responses. AI can be wrong or incomplete. Always confirm important medical decisions with a qualified clinician.

We may use conversations and uploaded content to improve the Service. Where feasible, we use de-identified or aggregated data. If we offer an opt-out or controls for model improvement, those controls will be described in-product.

5. HIPAA / healthcare compliance (if applicable)

Depending on how you use the Service (for example, via a clinic account), certain health information may be treated as Protected Health Information (PHI) under HIPAA or similar laws. We implement appropriate administrative, physical, and technical safeguards to protect sensitive health data.

• Access controls and least-privilege permissions
• Implement encryption for data in transit and at rest
• Conduct regular security risk assessments
• Maintain audit logs of PHI access
• Have incident response procedures for potential breaches

6. How we share information

We do not sell your personal or health information. We may share your information in the following circumstances:

5.1 With Your Consent

With your explicit authorization, we share information with:

• Healthcare providers you choose to consult through our platform
• Family members or caregivers you designate

5.2 Service Providers

We share information with trusted third-party service providers who assist us in operating our platform, including:

• Cloud infrastructure providers (Google Cloud Platform)
• AI and machine learning services (for example, model hosting/inference)
• Authentication services (Firebase)
• Communication services (email, SMS, voice providers)
• Analytics and monitoring services

All service providers are contractually obligated to maintain the confidentiality and security of your information and are prohibited from using it for any purpose other than providing services to us.

5.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal processes (subpoenas, court orders)
• Government or regulatory requests
• Emergencies involving danger to health or safety
• Protection of our rights, property, or safety

7. Security

We implement industry-standard security measures to protect your information:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access with multi-factor authentication
• Monitoring: Continuous security monitoring and logging
• Infrastructure: Secure cloud infrastructure with Google Cloud Platform
• Regular Audits: Periodic security assessments and penetration testing
• Incident Response: Established procedures for security incidents

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

8. Retention

We retain your information for as long as necessary to:

• Provide our services and maintain your account
• Comply with legal, regulatory, or contractual obligations
• Resolve disputes and enforce our agreements

Typical retention periods:

• Active account data: Duration of account plus 7 years (medical record retention standard)
• Chat conversations: 7 years from last interaction
• Medical documents: 7 years from upload date
• Technical logs: 90 days
• Voice: we aim to minimize audio retention; transcripts may be stored if you choose to submit them

9. Your rights & choices

You have the following rights regarding your information:

• Access: Request a copy of your personal and health information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your information (subject to legal retention requirements)
• Restriction: Request limitation on how we use your information
• Portability: Request your data in a structured, machine-readable format
• Objection: Object to certain processing of your information
• Withdraw Consent: Withdraw consent for specific uses
• Accounting of Disclosures: Request a list of disclosures of your PHI

To exercise these rights, contact us at privacy@aigastro.com.

10. Children

Our Service is not intended for children. If we learn we have collected personal information from a child without appropriate consent, we will delete it.

11. International transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from your country. We ensure appropriate safeguards are in place for such transfers, including:

• Standard contractual clauses approved by relevant authorities
• Other lawful transfer mechanisms where applicable
• Adequacy decisions by regulatory bodies

12. Cookies

We use cookies and similar tracking technologies to:

• Maintain your session and remember your preferences
• Understand how you use our service
• Improve user experience and performance
• Provide security features

You can control cookies through your browser settings. However, disabling cookies may limit your ability to use certain features of our service.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we will provide prominent notice or obtain your consent where required by law. We encourage you to review this Privacy Policy periodically.

14. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

15. Notice of privacy practices

For a complete Notice of Privacy Practices as required by HIPAA, including detailed information about how your health information may be used and disclosed, please request a copy by contacting us at the above address.