Privacy policy

The short version

• Signed out, what you enter stays in this browser. A question is sent to our server only to write the answer, and it is not saved there.
• Signed in, your entries are stored in your account, and database rules make sure only you can read them.
• To write an answer, the text and photos you send go to NVIDIA's AI service. Your email address does not.
• The app has no analytics, ads or tracking pixels. Google Analytics and ads run only on our public pages and articles, and only if you agree.
• We never sell your data. You can delete your account, and everything in it, at any time.

Who we are

MySymptom (mysymptom.ai) is run by its founder, Arhaan Delawalla. In this policy, "we" means MySymptom. For any privacy question or request, email mysymptomai@gmail.com.

What we collect

If you create an account

• Your email address, and a password that our sign-in provider stores only in hashed form, or your Google sign-in.
• Your display name, language and region, and when you accepted the terms, the health disclaimer and confirmed you are 18 or older.

Health information you choose to enter

• Questions you ask, your answers to the warning-sign questions, the answers you get back, and follow-up messages.
• People and pets you add: names, age, sex, pregnancy status, conditions, allergies, medicines and a Medical ID with emergency contacts.
• Check-ins, medicines and doses, vitals, episodes, lab values you confirm, journal entries, screening questionnaires and Visit Briefs.
• Share links you create (a snapshot you choose, with an end date).

Photos you add to a question are used to write the answer. They are not stored on our servers.

Technical information

• Like any website, our hosting provider sees your IP address and browser details when you load a page. Our server uses the IP address briefly to limit how many questions can be asked per hour, and does not store it with your health information.
• Our server logs record technical details only, such as which feature was used, how long it took and whether it worked. They never contain your questions, answers or photos.

Feedback

If you send feedback, we store your message, the page it was about (never a web address with your details) and an email address if you give one.

What stays on your device

If you use MySymptom without an account, everything you enter is kept in your browser's storage on this device. It is not sent to our database. If you later create an account, you can choose to move it into your account.

When you sign out, the data saved on this device for that account is removed from the device. Your theme, your cookie choice and an unsent draft are also stored on your device.

How AI processing works

Before any AI runs, our own code checks your words for warning signs. To write the explanation, we send NVIDIA's AI service the text of your question, your answers to the warning-sign questions, earlier messages in the same thread, any photos, and details about who it is for, such as age, sex, pregnancy, species and the name you gave them. We do not send your email address.

Photos are shrunk and re-saved on your device before they are sent, which removes location and camera details. We do not use your data to train AI models. NVIDIA's handling of requests to its service is covered by NVIDIA's privacy policy.

Who processes your data

We use a small number of service providers. Each one processes data only to run its part of MySymptom.

• Supabase: our database and sign-in provider. Account data and everything you save while signed in is stored there, in the United States.
• Vercel: hosts the website and runs our server code, including the code that sends questions to the AI.
• NVIDIA: runs the AI models that write explanations, through its AI service (NVIDIA NIM).
• Google: Google Analytics and Google AdSense, only on our public pages and articles and only after you agree (see below). If you choose Google sign-in, Google also confirms who you are. If you email us, your message is handled by Gmail.

Cookies, analytics and ads

The app (Today, Ask, History, Profile, sign-in and shared briefs) never loads analytics, ads or tracking pixels. On our public pages, we ask before using any of these:

• Google Analytics, on public pages, to learn which pages help people. Pages are reported as general paths, such as /blog/:slug, never with anything you typed. Google signals and ad personalization are switched off.
• Google AdSense, only on blog articles and symptom guides. Ads are not personalized.

Both are off until you agree, and you can change your choice at any time. Change cookie settings

Without your agreement, we only store what the site needs to work: your sign-in, your theme and your cookie choice.

What we never do

• Sell or rent your data, or share it with data brokers.
• Send health information to analytics or advertisers.
• Put what you typed into a web address.
• Show ads or run analytics inside the app.
• Use your data to train AI models.

How we protect it

• All traffic is encrypted in transit (HTTPS), and the database is encrypted at rest by our provider.
• Database rules make sure each account can read and change only its own rows. Our server acts as you, never with special access to other people's data.
• Shared briefs can be opened only with a long, random link, and only until the date you choose.

No system is perfectly secure. If we learn of a breach that affects your data, we will tell you without undue delay.

How long we keep it

• Your account data is kept until you delete it or delete your account.
• Share links stop working after 7 days by default, or up to 30 days if you choose, or as soon as you revoke them.
• Deleting your account deletes your sign-in and every row you saved, right away. Copies in our database provider's routine backups are overwritten as those backups expire.

Your choices and rights

• See and export your data from Profile, Your data.
• Correct anything you entered, in the app.
• Delete single entries in the app, or your whole account from Profile, Your data.
• Withdraw consent for analytics and ads at any time with the cookie settings.

Depending on where you live, for example under the GDPR in Europe or the CCPA in California, you may have more rights, such as to object to processing or to complain to a regulator. We do not sell personal information, and we do not share it for cross-context behavioral advertising. Email mysymptomai@gmail.com for any request, and we will answer within 30 days.

Children

Accounts are for adults 18 and over. Parents and caregivers can ask about their children and store details about them in their own account. If a young child appears to be describing their own symptoms, MySymptom shows a short safety message and saves nothing. If you believe a child under 13 has given us personal information, email us and we will delete it.

Changes and contact

If we change this policy, we will update the date at the top, and for important changes we will post a notice on this site before the change applies. Questions or requests: mysymptomai@gmail.com.