Privacy Policy

The controller of your data is [legal entity name], [registered address]. Questions and requests: [contact email].

• Identity. An email address or mobile number, used only to sign you in and to match invitations. Authentication is handled by Google Firebase; MyGabrielAI never sees or stores a password.
• Documents you upload. The original files, and the text extracted from them.
• Derived data. AI-generated summaries, categories, findings, extracted lab values, and numeric embeddings used for search.
• Anything you write yourself, such as the free-text profile of your symptoms and history.

There is no advertising, no analytics profiling, and no third-party tracking. Your records are not used to train any AI model.

Every document goes through the same sequence: it is converted to text, identifiers are removed from that text, and only then is anything sent to an AI provider.

The de-identification step removes names you have registered, national identity numbers (validated by check digit, so lab values and accession numbers are left intact), and similar direct identifiers. If a validated identifier survives the process, the document is held back and never reaches the AI provider at all.

The original, un-redacted text is stored so that you and the doctors you choose can read your records as they were written. It is never sent to an AI provider. Only the de-identified version leaves the system.

Text recognition for scanned documents runs on our own infrastructure rather than through an external vision model, because an image cannot be de-identified before it has been read.

• Google Firebase — authentication only. Receives your email address or phone number. It does not receive any medical data.
• netcup — hosting. The application and its database run on a server we operate, rented from netcup. The database holds all derived data, including the original text of your documents.
• Cloudflare R2 — file storage. Holds your original documents. The storage bucket is private; files are reachable only through short-lived links issued after an access check.
• OpenAI, Anthropic, Google and xAI — summarisation, categorisation, second opinions, specialist consults, visit preparation and search. Each receives de-identified text only, never original files and never un-redacted text. A family member's age in years and sex may accompany it; a birth date never does.
• Resend — email delivery. Sends sign-in codes and, unless you turn it off on your Account page, a daily email saying how many updates are waiting. These emails contain no medical information. If you turn on forwarding for a chart, Resend also receives the emails you forward to its address; we take the attachments, hold them for your review, and never store or read the message body.

These providers may process data outside your country, including in the United States.[Confirm the transfer mechanism you rely on — e.g. Standard Contractual Clauses.]

Nobody, unless you invite them. Sharing is always started by you: you enter a doctor's email address or mobile number, and access begins the first time that person signs in with that verified identity.

• A doctor you invite can read everything in your chart and change nothing.
• A doctor cannot request access, and cannot see who else you have shared with.
• You can revoke access at any time, and it stops immediately.
• Every time a doctor or another parent opens your chart, a document or a file, it is recorded; you can review it under Sharing → Recent access.

Emergency card. If you make one, anyone holding its link or QR code can read the sections you chose — for example allergies, current medications and an emergency contact — without signing in. Nothing else in your chart is shown: no documents, no AI output, only what you confirmed. You can add a PIN, it expires (after at most a year), you can revoke it at any time, and every time it is opened you are told and it is recorded under Recent access.

Data is encrypted in transit. Files live in a private store and are served only through links that expire within minutes and are issued after checking that the requester is entitled to that specific record. Every request to the application is authorised against the signed-in account before any record is returned.

No system is perfectly secure, and we do not claim otherwise. [State your breach-notification commitment and timeframe.]

Your records are kept until you delete them or close your account. Deleting a record removes the stored file and everything derived from it. [State your backup retention window, after which deleted data is fully purged.]

You can download a complete copy of any chart you manage at any time — the original documents and everything derived from them — from the Account or Family page. You can also ask for correction of anything inaccurate, deletion, or restriction of processing, and you can object to processing. Write to [contact email]. [Name the supervisory authority users may complain to.]

The service is not intended for people under [age]. If a chart is managed on behalf of a child, the account holder is responsible for having the authority to do so.

Material changes will be announced in the application before they take effect. The date at the top of this page always reflects the current version.