Privacy Policy

Effective Date: January 2025

My Health Copilot ("we," "our," or "the App") is committed to protecting your privacy and securing your Protected Health Information (PHI). This Privacy Policy explains how we collect, use, store, and protect your health information in compliance with the Health Insurance Portability and Accountability Act (HIPAA) and other applicable privacy laws.

1. Introduction

My Health Copilot is designed as a personal health management tool that keeps your medical information private and secure. We believe that your health data belongs to you and should remain under your complete control.

2. Information We Collect

Protected Health Information (PHI)

As you use the app, you may enter the following health information:

Medical Visit Data:

• Audio recordings of doctor appointments
• Transcriptions of medical conversations
• AI-generated visit summaries
• Appointment dates, times, and locations
• Doctor names and contact information

Medication Information:

• Prescription names and dosages
• Medication schedules and reminders
• Photos of pill bottles or medication packaging
• Side effects and notes

Health Measurements:

• Vital signs (blood pressure, heart rate, temperature, weight, etc.)
• Laboratory test results
• Medical imaging reports
• Health trends and history

Device and Usage Information

We may collect limited technical information to improve app functionality:

• Device Type: iOS or Android device model
• Operating System Version: To ensure compatibility
• App Version: To provide appropriate support
• Error Logs: To diagnose and fix technical issues (no health data included)

Important: Usage data is stored locally on your device and is never transmitted to our servers.

3. How We Use Your Information

Primary Uses

Your health information is used exclusively for:

• Display your health records and appointment history
• Generate AI summaries of medical visits
• Provide medication reminders and health tracking
• Calculate health trends and visualizations

What We DON'T Do With Your Data

• Never sell your information to third parties
• Never share with advertisers or marketing companies
• Never use for research without your explicit consent
• Never upload to cloud servers
• Never share with insurance companies or employers

4. HIPAA Compliance

My Health Copilot is designed to meet the security and privacy standards required by the Health Insurance Portability and Accountability Act (HIPAA).

Technical Safeguards

• AES-256 encryption for all data at rest
• Secure password hashing (Argon2 algorithm)
• Biometric authentication (Face ID, Touch ID, fingerprint)
• Automatic session timeouts
• Access controls and audit logging

Your HIPAA Rights

Under HIPAA, you have the right to:

• Access: View and export your health information at any time
• Amend: Correct inaccurate or incomplete information
• Restrict: Limit how your information is used
• Breach Notification: Be notified if your information is compromised

5. Data Security and Encryption

Encryption Standards

All your health data is protected using military-grade encryption:

• AES-256-bit encryption: Encrypts all data stored in the app's database
• SQLCipher: Encrypted SQLite database for maximum security
• Hardware-backed key storage: Encryption keys stored in iOS Keychain or Android Keystore
• No cloud backup: Data excluded from iCloud and Google Drive backups

Authentication Security

• Argon2id hashing: Industry-leading password hashing algorithm
• Biometric Authentication: Face ID, Touch ID, or fingerprint via secure enclave
• Local only: Biometric data never leaves your device

6. Data Storage and Retention

Where Your Data is Stored

Local Device Storage:

• All health data is stored exclusively on your device
• Located in the app's secure, sandboxed directory
• Encrypted with AES-256 encryption
• Isolated from other apps and processes

No Cloud Storage:

• Data is NOT uploaded to our servers
• Data is NOT backed up to iCloud or Google Drive
• Data is NOT synchronized across devices

Data Retention Policy

• Your health information is retained indefinitely while you use the app
• When you delete information, it is immediately and permanently erased
• If you delete your account, all data is permanently erased within 24 hours

7. Your Privacy Rights

You have complete control over your health information:

• Right to Access: View all your stored health information at any time
• Right to Modify: Edit or correct any information in the app
• Right to Delete: Delete individual records or all data with account deletion
• Right to Export: Export complete health records in PDF, text, or spreadsheet formats

Opt-Out Rights

Optional features that can be disabled:

• AI-powered medication descriptions
• Cloud-based AI features
• Analytics and error reporting
• Push notifications

8. Third-Party Services

Google AI Studio (Optional)

When you use AI-powered medication descriptions:

• What is Sent: Medication name and dosage only
• Not Sent: No patient name or identifying information
• Your Control: This feature can be completely disabled

Platform Services

• Apple HealthKit (iOS): If you grant permission, data is processed locally and never leaves your device
• Maps: When you tap on an address, it opens in your preferred maps application

No Other Third Parties

• No advertising networks
• No social media integrations
• No marketing platforms
• No data brokers

9. Children's Privacy

My Health Copilot is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes:

• Major Changes: In-app notification with summary of changes and 30-day notice
• Minor Changes: Update on this page with new effective date

11. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us through the App Store (iOS) or Google Play Store (Android) listing for My Health Copilot.

Since all your data is stored locally on your device, you can exercise your privacy rights directly within the app—no request to us is needed.

State-Specific Privacy Rights

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights:

• Right to Know: What personal information we collect and how it's used
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of sale of personal information (we don't sell data)
• Right to Non-Discrimination: Equal service regardless of privacy choices

European Residents (GDPR)

If you are in the European Economic Area, you have rights under GDPR:

• Right to Access, Rectification, and Erasure
• Right to Restrict Processing
• Right to Data Portability
• Right to Object