Privacy Policy

MedConcil is operated by GAITO LLC. This policy covers medconcil.com, app.medconcil.com and MedConcil services that link to it. Availability of features depends on the application and account; planned features described below are not a promise of current availability.

Account and contact information includes names, email addresses, authentication and account details. Health information you submit may include medical cases, symptoms, diagnoses, medications, allergies, treatment and family history, medical reports, discharge summaries, laboratory results, images and other uploaded documents. Genetic information may be included if you provide it yourself.

Clinical Council generates analyses and summaries. Case records can contain submitted text, patient context, follow-up questions, AI responses, filenames and associated account information. Service records may also include IP/device information, authentication events, technical errors and usage records. Do not include full card numbers in medical records or support messages.

Information comes from you, documents or recordings you submit, an account user authorized to provide another person's information, and analyses generated from those inputs. This notice does not announce an active laboratory partnership, automatic medical-record import or a DNA test available for purchase.

Information is used to maintain accounts and available patient records, store submitted documents, perform requested Clinical Council analyses, retain results for review, respond to support requests and operate and secure the service. Applicable legal obligations may require limited additional processing.

Accepting this policy or storing a document does not grant blanket permission to use medical information for unrelated AI training or product development. Additional uses must have an appropriate legal basis and any required notice and consent.

The application has patient-record and document-storage functions as well as Council case history. Existing records are associated with an account's organization; they should not be assumed to be private from other authorized users of that organization. Separate consumer and family Medical History controls are still being developed.

Saving a document in a patient record and submitting an analysis are separate actions. The patient-document upload path stores the file without calling an AI model. When you request a Council analysis, submitted text and attachments are processed; a linked patient profile can supply additional context automatically. Do not assume that a section-selection control excludes every other profile field.

HIPAA applicability depends on the parties, activity and legal relationship. This notice does not certify HIPAA compliance or establish a Business Associate Agreement. Direct consumer data and any covered healthcare workflows must be assessed under the laws that actually apply.

Storage and infrastructure providers process submitted records, documents and account data to operate the service. Authentication providers handle account/authentication information. AI and transcription providers receive the information described above for requested processing. Communications providers, including Resend for website contact messages, receive the contact details and message content you submit. Do not send medical records through ordinary support forms.

Information may also need to be disclosed as legally required, to protect users and the service, or in a business transaction subject to applicable protections. Authorized organization users may access records within their organization's permissions.

User-created, revocable doctor-sharing links with separate access codes and access logs are planned; this policy does not offer them as available. If you independently send or download a report for someone, that recipient's copy is not controlled by a future link-revocation feature.

Medical and genetic data are not authorized for sale or advertising targeting under this policy. Nor does this policy authorize sending diagnoses, symptoms, laboratory results or medical documents to payment-provider metadata or receipts. These restrictions are not a claim that all technical controls have already been verified.

Patient records, documents and Council results are stored for continued use and review. They are not necessarily removed when an analysis finishes. There is currently no guaranteed automatic deletion period for one-off cases, logs or backup copies described by this policy.

A longer-term Medical History lifecycle is planned. Fixed expiry and backup-removal periods are not offered here as implemented controls. Retention must be limited to applicable service, legal and security needs; contact us to request deletion or details about a particular record.

Deleting a patient profile does not currently automatically remove every associated document, Council result or copied context. A document-removal action may also require follow-up if storage deletion fails. For removal of an individual document, case, medical profile or account and related records, submit a privacy request specifying its scope.

Backups, logs and copies held by providers require separate handling; no immediate or fixed-time purge is promised here. Information may be retained only where permitted or required by applicable law, for example specific legal obligations or necessary payment-security and fraud-prevention records. These exceptions do not override applicable deletion rights. Ask us which records and grounds apply to your request.

MedConcil cannot erase a copy you or another recipient already downloaded to a system outside its control. This does not remove any applicable duty to notify processors or other recipients of a deletion request.

Depending on applicable law, you may request confirmation of processing, access, correction, a copy, deletion, information about recipients, or withdrawal of consent. Requesting a copy is distinct from an automatic export feature. Some Council results have individual report exports; comprehensive Medical History export in particular formats is not promised.

Send requests to legal@medconcil.com. Identify your account and whether the request concerns a document, case, patient profile or the whole account. For another person's records, explain your authority. We may need proportionate information to verify identity and authority. Do not send medical documents, passwords or full payment-card details by ordinary email; ask for a secure method if more information is needed.

Withdrawal concerns future consent-based processing and may affect the services available to you. It does not itself erase previous analyses or downloaded copies; specify any deletion request separately. Applicable statutory rights and response requirements remain in effect.

Saving information, requesting an AI analysis and authorizing disclosure to another person are different purposes. Not all current workflows provide separate, versioned consent controls or an in-app withdrawal option. This policy does not claim that those controls already exist or replace any consent required by law. Contact legal@medconcil.com about permission, withdrawal or stopping further processing.

Account holders must be at least 18. Only provide another person's medical information when you have the required permission or legal authority, including parental or guardianship authority where applicable. Being a relative does not by itself establish authority to upload, analyze or share their records.

Dedicated self, child, parent and other represented-person profiles are planned. The current patient form does not establish a verified guardianship or authority-checking service. Do not interpret the ability to enter a person's details as confirmation of your legal authority.

The application can load PostHog analytics when enabled in its configuration. Usage interactions, URLs and error reports may be processed, and session-recording capabilities depend on configuration. Content displayed in the application may include health information; do not assume that every analytics or error-reporting path excludes it. This policy does not claim that an analytics consent switch is currently available.

Patient searches can put identifying search terms in request URLs, and technical logs can include filenames or error details. We do not promise that such records contain no personal information. Contact us for information about the recipients and processing relevant to your account.

The application uses authentication and organization-based access checks. Certain patient fields and medical profiles have application-level encryption. This does not establish that every document, AI result, log or backup has the same protection. No method of storage or transmission provides absolute security.

Information may be processed in the United States and other jurisdictions where the relevant service providers operate. The language selected on the website does not determine storage location or the laws applicable to your account.

We may update this policy and will provide notice of material changes where required by applicable law. A planned feature must have an accurate notice and any required permissions before it processes your information.