Privacy Policy

Your data: collection, storage and deletion

What we collect. When you use Medi-Chi, we collect the account and contact details you provide, booking and payment status, and the clinical information you choose to enter or upload. That can include symptoms, patient intake forms, diagnoses, consultation notes, tongue photos and test results. Practitioners and supervised students may enter patient records. We also receive basic device and usage information. Stripe handles card numbers directly; Medi-Chi does not store full card numbers.

Where it goes. Account and clinical records are stored with our hosting and database provider, with access restricted according to the account and clinic permissions described below. The region and international-transfer arrangements are described in Data Residency & International Transfers. Clinical inputs sent for AI-assisted features are processed by the model provider to return a result; saved results remain in your account. We do not use patient data to train our own AI models. A practitioner may choose to connect their own HubSpot or Cliniko account; the relevant patient contact details can then sync with that service. See How We Share Data for recipients and choices.

How long we keep it. Account and saved clinical records remain while the account is active, unless a record is removed earlier. See Data Retention for the different periods that apply to share grants, logs and billing records. Optional tongue-photo research contributions have separate consent and removal rules.

How to delete it. You can remove individual records where that option is available, request deletion of your clinical data while keeping your sign-in, or request deletion of your whole account. The account and data deletion page explains the signed-in option, email request, what is removed and what may remain in encrypted backups or be retained for legal reasons. Before deleting, export anything you need and cancel an active subscription separately. Deleting Medi-Chi data does not automatically delete copies already sent to a practitioner’s connected HubSpot or Cliniko account; contact that practitioner about records in their system. Email support@medichi.online for access, correction or deletion help.

4a. AI Models & Your Clinical Data

Medi-Chi uses third-party large language models (currently Google Gemini via the Lovable AI Gateway) to generate diagnostic reasoning. We take a hard line on how your clinical inputs are handled:

• We do not use your patient data, symptom entries, tongue photos, or diagnostic outputs to train our own AI models. Full stop.
• Requests to model providers are made under enterprise API terms that prohibit those providers from using your prompts or responses to train their public foundation models.
• Diagnostic history you save to your account is stored so you can review it — it is not pooled into a training set.
• The only exception is the optional Tongue Photo Research Program (section 6), which is explicit opt-in and can be withdrawn at any time.
• We publish the current model, prompt version, and classical corpus date on the diagnosis output itself, so you always know which version generated a given result.

5. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law.

• Account records: kept while your account is open, then deleted within 30 days of account closure.
• Saved diagnoses, cases and patient-record episodes: kept while your account is open, or until you delete them individually.
• Share codes and access grants: expire automatically (7 days by default) and are deleted or anonymised within 12 months of expiry.
• Billing and tax records: retained for 7 years where Australian tax law requires it.
• Security and audit logs: retained for up to 12 months, with health details redacted.

5a. Legal Bases for Processing (GDPR / UK GDPR)

Where the EU General Data Protection Regulation or the UK GDPR applies to you, we rely on the following legal bases:

• Contract (Art. 6(1)(b)): creating and running your account, delivering subscriptions, purchases and downloads.
• Legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, and fixing faults — balanced against your rights.
• Consent (Art. 6(1)(a)): analytics and marketing tags, optional research programs, and optional email updates. You can withdraw consent at any time.
• Explicit consent for health data (Art. 9(2)(a)): any symptom, tongue-photo or clinical content you choose to enter is special-category data and is processed only with your explicit consent.
• Legal obligation (Art. 6(1)(c)): tax, accounting and lawful requests from regulators.

Medi-Chi is the data controller for your account and for content you enter directly. Where a registered practitioner uses Medi-Chi in their own clinic, that practitioner is the controller of the patient records they enter and Medi-Chi acts as their processor. Those records may include patient names and contact details, appointment information and clinical notes. Access is restricted to the relevant practitioner and authorised service operations. Patient-code sharing remains de-identified unless a patient or practitioner separately adds identifying information.

5b. Data Residency & International Transfers

Every account is pinned to a region when it is created. Your region determines where your records are stored and which rules apply to them.

• Australia, New Zealand and Asia-Pacific accounts: stored on infrastructure hosted in the Asia-Pacific region.
• United Kingdom and European Union accounts: stored and processed on infrastructure located within the EEA or the UK. Records pinned to an EU or UK region are not migrated to another region without notifying you first.
• Other supported regions: stored in the nearest region we operate, as disclosed at sign-up.

Where a transfer of personal data outside the EEA or the UK is unavoidable — for example, support engineering carried out from Australia — that transfer is made under the European Commission’s Standard Contractual Clauses (Decision 2021/914) together with the UK International Data Transfer Addendum, supported by a transfer impact assessment and by technical measures including encryption in transit (TLS 1.3) and at rest (AES-256), pseudonymisation, and strict role-based access. We do not transfer EU or UK health data to a country without an adequacy decision unless those safeguards are in place.

Mainland China is not a supported region at this time. If and when it is enabled, records for accounts pinned to mainland China will be stored on infrastructure located inside mainland China, and any cross-border transfer will follow the separate consent and security-assessment requirements of the Personal Information Protection Law (PIPL).

You can ask us which region your account is pinned to, and request migration to another supported region, by emailing support@medichi.online.

5c. How We Share Data

We do not sell your personal information, and we do not share it with advertisers or data brokers. We share only what is needed, with the following categories of recipient:

• Practitioners you choose: when you generate a share code, the practitioner who redeems it can see the de-identified clinical content in that episode until you revoke access. You can see and revoke every grant from your patient dashboard.
• Hosting and database provider: stores your account and records in your pinned region under a data processing agreement.
• AI model providers: receive your symptom text and images solely to generate a response, under enterprise terms that prohibit training on your content (see section 4a).
• Payments provider (Stripe): handles card details directly; we never see or store your card number.
• Email delivery provider: sends account and transactional email.
• Practice software a practitioner connects (HubSpot, Cliniko): where a practitioner connects their own HubSpot or Cliniko account, patient names, email addresses and phone numbers sync between Medi-Chi and that practitioner's own account in those services. This happens only at the practitioner's request, only for their own patients, and only while the connection is active. We never share patient data with HubSpot or Cliniko for their own purposes.
• Analytics and advertising tags: only after you opt in (see section 9).
• Legal and safety: where we are legally compelled, or to protect someone from serious harm.

A current list of sub-processors is available on request.

6. Optional Tongue Photo Research Program

If you choose to opt in, we may retain a copy of your tongue photo and related diagnostic data to help evaluate and improve future tongue-analysis quality. This program is optional and your diagnosis can still proceed if you do not consent.

• What we store: your uploaded tongue photo, the diagnostic output generated for that submission, relevant symptom questionnaire responses, image quality notes, and any practitioner label or correction linked to that contribution.
• How we use it: to review diagnostic quality, compare similar cases over time, identify patterns, and improve future model evaluation and internal research workflows.
• How long we keep it: research contributions are retained until they are no longer needed for these quality-improvement purposes, or until you ask us to remove them, unless a longer period is required by law.
• How to withdraw: you can withdraw consent by deleting your contributed research data from your account when that control is available, or by contacting us at support@medichi.online and requesting removal.

9. Cookie & Analytics Preferences

We use Google Analytics 4 to measure aggregate usage and improve the product. Analytics scripts are not loaded until you grant consent. You can change your decision at any time below.

Specifically, we use two third-party tags: Google Analytics 4 (aggregate usage measurement) and the Meta Pixel (measuring whether our advertising reaches the right people). Neither tag is present on the page when you first arrive. They are controlled by separate choices in the cookie banner — “Analytics” loads GA4, “Marketing” loads the Meta Pixel — and each script is downloaded only after you opt that category in. If you decline, accept only one category, or simply never make a choice, the corresponding script is never downloaded, no cookie is written for it, and no request is sent to that company from your device.

When you do accept, GA4 and the Meta Pixel receive page views, in-app feature events, search terms typed into the site search, page performance timings, and the browser or device identifiers those tools set for themselves. They never receive your clinical inputs, tongue photos, saved cases, patient profile records, or account email.

Your choice is stored locally on your own device and applied on every later visit. If you revoke consent, we clear the stored preference and stop loading both tags; any cookies already set by Google or Meta can be removed through your browser’s own site-data settings. The same rules apply in the Medi-Chi Android app, which runs the same service inside a secure app web view.