Privacy notice
This notice explains how (“we”), operating at , handles your personal data under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. We are the Data Fiduciary for the data described here.
The short version
- The scripts you check are not stored. For a full AI review, the text is sent to our AI provider, processed, and the result is returned to your browser.
- The quick check runs entirely in your browser. Nothing you type is sent to us.
- We keep only what we need to run your account: your email, your review balance, a count of reviews used, and payment records.
- Do not paste patient names, photos, contact details or anything that could identify a patient. You confirm this before your first AI review.
What we collect and why
| Data | Purpose | Kept for |
|---|---|---|
| Email address; name and profile photo if you sign in with Google | Signing you in, contacting you about your account and payments | Until you delete your account |
| Review balance, consent date, and a log of reviews used (time, model, size — never the text) | Applying free and paid limits, preventing abuse, billing accuracy | Until you delete your account; usage logs are anonymised on deletion |
| Payment records (order and payment IDs, plan, amount, date) | Accounting, tax compliance, refunds | As long as Indian tax and accounting law requires |
| Script text you submit for AI review | Producing your compliance report | Not stored by us. Processed by our AI provider only to produce the report |
| Disclosure details you type (name, qualifications, registration number) | Pre-filling your disclosure line | Saved only in your own browser |
We do not sell your data, use it for advertising, or use your scripts to train any model.
Who processes data for us
- Supabase: sign-in and account database.
- Vercel: website hosting and the review service.
- Anthropic (Claude API): AI review of the script text you submit.
- Razorpay: payments. We never see your card or UPI details.
Some of these providers process data outside India. We transfer data only to countries not restricted by the Government of India under Section 16 of the DPDP Act, and under contracts that require the data to be protected.
Patient data
This tool is built for content meant to be published. It is not meant for patient records. Clause 7.2(d) of NMC's guidelines and the DPDP Act both require care when patient information is used as input to an AI system. If our quick check sees what looks like a patient's name, we warn you before an AI review.
Your rights
- Access and correction: see your email and balance in the account menu, or ask us for a copy of your data.
- Erasure and withdrawing consent: use “Delete my account” in the account menu. Your account, balance and personal links are deleted immediately. Payment records stay, without your email, as tax law requires.
- Grievance redressal: contact our Grievance Officer below. We respond within 30 days. If you're not satisfied, you may complain to the Data Protection Board of India.
- Nomination: you may nominate someone to exercise these rights on your behalf by writing to us.
Children
The service is for registered medical practitioners and their teams. It is not for anyone under 18.
Security
Data is encrypted in transit. Account data is protected by row-level access rules, so each user can read only their own records. We notify you and the Data Protection Board if a personal data breach affects you.
Grievance Officer and contact
We'll post changes to this notice on this page and update the date at the top.