Privacy Policy

4a. AI Models & Your Clinical Data

Medi-Chi uses third-party large language models (currently Google Gemini via the Lovable AI Gateway) to generate diagnostic reasoning. We take a hard line on how your clinical inputs are handled:

• We do not use your patient data, symptom entries, tongue photos, or diagnostic outputs to train our own AI models. Full stop.
• Requests to model providers are made under enterprise API terms that prohibit those providers from using your prompts or responses to train their public foundation models.
• Diagnostic history you save to your account is stored so you can review it — it is not pooled into a training set.
• The only exception is the optional Tongue Photo Research Program (section 6), which is explicit opt-in and can be withdrawn at any time.
• We publish the current model, prompt version, and classical corpus date on the diagnosis output itself, so you always know which version generated a given result.

5a. Legal Bases for Processing (GDPR / UK GDPR)

Where the EU General Data Protection Regulation or the UK GDPR applies to you, we rely on the following legal bases:

• Contract (Art. 6(1)(b)): creating and running your account, delivering subscriptions, purchases and downloads.
• Legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, and fixing faults — balanced against your rights.
• Consent (Art. 6(1)(a)): analytics and marketing tags, optional research programs, and optional email updates. You can withdraw consent at any time.
• Explicit consent for health data (Art. 9(2)(a)): any symptom, tongue-photo or clinical content you choose to enter is special-category data and is processed only with your explicit consent.
• Legal obligation (Art. 6(1)(c)): tax, accounting and lawful requests from regulators.

Medi-Chi is the data controller for your account and for content you enter directly. Where a registered practitioner uses Medi-Chi in their own clinic, that practitioner is the controller of their identified patient records; Medi-Chi never receives patient names, addresses, or other direct identifiers from clinics, and acts only as a processor for the de-identified clinical content shared through the patient-code system.

5b. Data Residency & International Transfers

Every account is pinned to a region when it is created. Your region determines where your records are stored and which rules apply to them.

• Australia, New Zealand and Asia-Pacific accounts: stored on infrastructure hosted in the Asia-Pacific region.
• United Kingdom and European Union accounts: stored and processed on infrastructure located within the EEA or the UK. Records pinned to an EU or UK region are not migrated to another region without notifying you first.
• Other supported regions: stored in the nearest region we operate, as disclosed at sign-up.

Where a transfer of personal data outside the EEA or the UK is unavoidable — for example, support engineering carried out from Australia — that transfer is made under the European Commission’s Standard Contractual Clauses (Decision 2021/914) together with the UK International Data Transfer Addendum, supported by a transfer impact assessment and by technical measures including encryption in transit (TLS 1.3) and at rest (AES-256), pseudonymisation, and strict role-based access. We do not transfer EU or UK health data to a country without an adequacy decision unless those safeguards are in place.

Mainland China is not a supported region at this time. If and when it is enabled, records for accounts pinned to mainland China will be stored on infrastructure located inside mainland China, and any cross-border transfer will follow the separate consent and security-assessment requirements of the Personal Information Protection Law (PIPL).

You can ask us which region your account is pinned to, and request migration to another supported region, by emailing support@medichi.online.

5c. How We Share Data

We do not sell your personal information, and we do not share it with advertisers or data brokers. We share only what is needed, with the following categories of recipient:

• Practitioners you choose: when you generate a share code, the practitioner who redeems it can see the de-identified clinical content in that episode until you revoke access. You can see and revoke every grant from your patient dashboard.
• Hosting and database provider: stores your account and records in your pinned region under a data processing agreement.
• AI model providers: receive your symptom text and images solely to generate a response, under enterprise terms that prohibit training on your content (see section 4a).
• Payments provider (Stripe): handles card details directly; we never see or store your card number.
• Email delivery provider: sends account and transactional email.
• Analytics and advertising tags: only after you opt in (see section 9).
• Legal and safety: where we are legally compelled, or to protect someone from serious harm.

A current list of sub-processors is available on request.

6. Optional Tongue Photo Research Program

If you choose to opt in, we may retain a copy of your tongue photo and related diagnostic data to help evaluate and improve future tongue-analysis quality. This program is optional and your diagnosis can still proceed if you do not consent.

• What we store: your uploaded tongue photo, the diagnostic output generated for that submission, relevant symptom questionnaire responses, image quality notes, and any practitioner label or correction linked to that contribution.
• How we use it: to review diagnostic quality, compare similar cases over time, identify patterns, and improve future model evaluation and internal research workflows.
• How long we keep it: research contributions are retained until they are no longer needed for these quality-improvement purposes, or until you ask us to remove them, unless a longer period is required by law.
• How to withdraw: you can withdraw consent by deleting your contributed research data from your account when that control is available, or by contacting us at support@medichi.online and requesting removal.

9. Cookie & Analytics Preferences

We use Google Analytics 4 to measure aggregate usage and improve the product. Analytics scripts are not loaded until you grant consent. You can change your decision at any time below.

Specifically, we use two third-party tags: Google Analytics 4 (aggregate usage measurement) and the Meta Pixel (measuring whether our advertising reaches the right people). Neither tag is present on the page when you first arrive. They are controlled by separate choices in the cookie banner — “Analytics” loads GA4, “Marketing” loads the Meta Pixel — and each script is downloaded only after you opt that category in. If you decline, accept only one category, or simply never make a choice, the corresponding script is never downloaded, no cookie is written for it, and no request is sent to that company from your device.

When you do accept, GA4 and the Meta Pixel receive page views, in-app feature events, search terms typed into the site search, page performance timings, and the browser or device identifiers those tools set for themselves. They never receive your clinical inputs, tongue photos, saved cases, patient profile records, or account email.

Your choice is stored locally on your own device and applied on every later visit. If you revoke consent, we clear the stored preference and stop loading both tags; any cookies already set by Google or Meta can be removed through your browser’s own site-data settings. The same rules apply in the Medi-Chi Android app, which runs the same website inside a Trusted Web Activity.