Trust & Security

Medi-Chi is a clinical decision support tool for acupuncturists and TCM practitioners. The AI diagnosis and translation features are designed to work on de-identified clinical inputs only — symptoms, tongue and pulse findings, patterns, and points.

We do not ask for and do not want patient names, dates of birth, contact details, Medicare or insurance numbers, addresses, or any other direct identifiers in the diagnosis, reverse diagnosis, or study-tool inputs. Practitioners are asked to de-identify before pasting or typing anything into an AI prompt.

Optional patient profile records inside the practitioner dashboard (first name, notes, VAS scores) are stored in your own account and are never sent through the public AI prompts. They stay behind row-level security tied to your user ID.

• HTTPS everywhere — traffic is served over TLS via Cloudflare in front of the app and API.
• Authentication is handled by our backend provider with hashed passwords, JWT sessions, and social sign-in (Google) as an option.
• Row-Level Security (RLS) is enabled on every user-facing database table. Practitioners can only read and write their own rows.
• Admin-only tables and functions are gated by a separate user_roles table checked by a security-definer function — roles are never stored on the profile record.
• Abuse protection on public endpoints uses Cloudflare Turnstile plus per-IP and per-account rate limits.
• Payments are processed by Stripe. Medi-Chi never sees or stores full card numbers.

• Account data — email, display name, jurisdiction, and (for practitioners) AHPRA-style registration details you choose to enter.
• Clinical inputs you submit — de-identified symptoms, tongue and pulse findings, and the AI outputs generated from them. Used to render the diagnosis, save it to your case history, and cache repeat queries.
• Optional patient profiles — first name, notes, and VAS ratings you enter into your own dashboard.
• Usage analytics — page views and feature events via Google Analytics 4, only if you accept the consent banner. IPs are truncated by GA and we do not sell this data.
• Payment records — subscription status, plan, and Stripe customer ID. Card data lives with Stripe, not with us.

We keep account data and saved cases indefinitely while your account is active, so your history is there when you come back.

When you delete your account (or email support@medichi.online asking us to), we remove your account and associated user-owned rows within 30 days. Some records (Stripe payment history, minimal transaction logs required for tax and refund obligations) are retained by the relevant subprocessor per their own policies.

Full step-by-step instructions, what is deleted versus kept, and the retention timeline live on our account and data deletion page.

Cached AI responses tied to de-identified inputs expire on a rolling 7-day TTL.

Medi-Chi relies on a small set of vendors to run the service:

• Lovable Cloud — hosting, database, authentication, storage, and edge functions. All primary application data lives here.
• Lovable AI Gateway (Google Gemini) — AI inference for diagnosis, reverse diagnosis, and content translation. Prompts are the de-identified clinical inputs described above.
• Stripe — subscription billing and payment processing.
• Cloudflare — CDN, DNS, and Turnstile bot protection.
• Google Analytics 4 — only when you accept the analytics consent banner.

If you think you have found a security or privacy issue, please email support@medichi.online. Include steps to reproduce and, if possible, a proof of concept. We aim to acknowledge reports within two business days.

Please do not include real patient data in your report. If a reproduction needs sensitive input, use synthetic or clearly-fake data.

For our full response process and breach notification timelines, see the Security Incident & Breach Notification Policy.

Medi-Chi is built and operated in Australia. It is designed to align with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and with AHPRA advertising and record-keeping guidance for registered practitioners.

Medi-Chi is not HIPAA covered and is not intended for storing or transmitting identifiable US Protected Health Information (PHI). We do not currently sign Business Associate Agreements (BAAs), and several of our subprocessors are not engaged under BAAs on our current plan. Please do not paste identifiable US patient data into the app.

Medi-Chi is also not a certified medical device and has not been evaluated under the EU MDR, UK MHRA, FDA, or TGA medical-device frameworks. It is a clinical decision-support and education tool.

Before pasting or typing patient information into any Medi-Chi input (diagnosis, reverse diagnosis, tongue upload, study tools, saved cases), run through this checklist. It mirrors the HIPAA Safe Harbor method — remove all 18 identifiers so the input is no longer PHI.

Safe to submit

• Age band (e.g. "40s", "early 60s") and sex at birth
• Presenting symptoms in clinical language
• Tongue shape, colour, coating, moisture (no full-face photos)
• Pulse qualities per position
• Duration and severity (e.g. VAS 0–10)
• Relevant history described generically ("perimenopausal, long-standing insomnia")
• Current TCM working diagnosis or Western condition name

Quick rewrite examples

A quick shortcut: if a colleague reading the input could plausibly guess which patient it is, it is not yet de-identified. When in doubt, generalise further. This checklist supports — but does not replace — your own HIPAA compliance program and patient authorisation process.

The Medi-Chi Android app is the same web application wrapped as a Trusted Web Activity, so it collects exactly what the website collects. The table below mirrors, word for word, the Data safety form we submitted in Google Play Console.

Not collected

• Location — approximate or precise. We do not request Android location permissions and do not derive location from your IP address for any app feature.
• Contacts, calendar events, SMS or MMS, call logs, and installed apps.
• Videos, voice or sound recordings, music, and other audio files.
• Files and documents from your device storage.
• Race and ethnicity, political or religious beliefs, sexual orientation.
• Web browsing history outside the app.

Sharing, in plain terms

The only data that leaves Medi-Chi's own systems is analytics: Google Analytics 4 and the Meta Pixel receive app interaction events, search terms entered in the site search, performance timings, and the browser or device identifiers those tools set. Because the Meta Pixel is used for marketing measurement, we declare Advertising or marketing as a purpose for device identifiers. Both tags are blocked until you accept the analytics choice in the consent banner, and neither receives your clinical inputs, tongue photos, saved cases, or patient profile records.

Security practices declared

• Data is encrypted in transit (TLS on every request).
• You can request that your data be deleted — in-app from your account settings, or by emailing support@medichi.online.
• Both the Delete account URL and the Delete data URL declared in Play Console point to the same public page: https://medichi.online/delete-account.
• The app follows the Google Play Families policy only where applicable; Medi-Chi is intended for adult practitioners and students.

Content rating note: Medi-Chi does not allow users to exchange content with each other, and does not promote or sell age-restricted products. Herb monographs are reference material, not products for sale.

Under applicable privacy law you can request a copy of your data, ask us to correct it, or ask us to delete it. Email support@medichi.online and we will respond within 30 days.

Medi-Chi provides the platform and its security controls. As the treating practitioner, you remain the data controller for your patients — including obtaining consent, keeping identifiable clinical records inside your own practice management system, and following AHPRA (or your equivalent regulator's) requirements. Medi-Chi is a decision-support tool and does not replace clinical judgement.