Consumer health data privacy policy
Last updated: 25 September 2026
This is a separate policy, deliberately. Washington’s My Health My Data Act (RCW 19.373.020) and Nevada SB 370 both require a consumer health data privacy policy that is distinct from a general privacy policy and linked separately from the homepage.
MyMedi’s general privacy policy covers everything that is not health data.
1. What consumer health data MyMedi collects
Everything below is provided by you. MyMedi does not buy health data, does not infer it from your browsing, and does not receive it from data brokers.
| Category | Examples | Where it comes from |
|---|---|---|
| Documents you add | Scans and photographs of lab reports, imaging reports, discharge notes, letters | You scan, upload, paste, or type them |
| Text you write | Titles, notes, and free-text records | You type them |
| Content you share in | Links, articles, and posts you send to MyMedi from other apps | The iOS share sheet, at your initiative |
| Measurements extracted from your documents | Test names, values, units, and the reference ranges printed on your reports | Derived automatically from documents you added |
| Medications and allergies extracted from your documents | The name a record prints, the dose or reaction beside it, whether the record says it is current, and the exact words the record used | Derived automatically from documents you added |
| Medications and allergies you type | The same fields, entered by you for something your records do not mention | You type them |
| Lines read on an iPhone from a child’s pages or recordings | The printed lines Apple’s text recognition found, or the words Whisper wrote out from a recording, for a record filed under a child under 13 | Derived on the phone from documents you added. Never sent to OpenAI |
| Machine representations of your text | Numeric embeddings used to find relevant passages when you ask a question | Derived automatically from documents you added |
| Account data | Email address, or the private relay address Apple gives us if you use Sign in with Apple | You, at sign-up |
| Consent records | Which disclosures you agreed to, the exact wording shown, the version, and when | Recorded when you agree |
MyMedi does not collect precise geolocation. There is no location permission in the app. This matters because MHMD treats location near a health facility as health data in its own right.
2. How it is used
- To store your records and show them back to you.
- To extract the measurements printed on your reports so you can see one test over time.
- To extract the medications and allergies your records name, so you can open them in one list with the words each record used.
- To find the passages relevant to a question you ask, and to answer it from those passages.
- To produce a plain-language summary that restates what a document says.
- For a child under 13, to show and search the lines an iPhone read from their pages, and to have Apple’s on-device model pick out the key lines of a typed note. Both run on the phone.
MyMedi does not check one medication against another, does not work out what any of them is for, and does not remind you to take anything.
That is the complete list. Your health data is not used to train any model, is not used for advertising, and is not used to build a profile of you.
3. Who it is shared with
MyMedi does not sell consumer health data. Under MHMD a “sale” requires separate written authorization, and MyMedi does not ask for one because it does not sell.
Health data reaches exactly two processors, both under contract, both barred from using it for their own purposes:
Supabase — hosts the database and file storage. Your records live in Postgres rows scoped to your account by row-level security, and scans live in a private storage bucket reachable only through short-lived signed links.
OpenAI — reads document text and images to perform text recognition, extraction, and summarisation, and to answer your questions.
-
Requests are sent with
store: false, so OpenAI does not keep the response as a stored object in their product. MyMedi does not use OpenAI’s Files or Vector Stores products. Your documents and their embeddings stay in MyMedi’s own database. - OpenAI does not train on data submitted through its API.
- OpenAI may still retain request content in abuse-monitoring logs for up to about 30 days. Zero Data Retention is not enabled on this account.
No analytics or advertising SDK ever receives health data. None is present in the app.
MyMedi will disclose health data to law enforcement only under a valid, specific legal order, and will tell you unless legally forbidden from doing so.
A parent or legal guardian may store a child’s records under their login. Children do not have their own accounts, and anyone under 13 cannot sign in. MyMedi keeps a child’s records away from OpenAI only when the birthday shows they are under 13 and the record is filed under that child. A wrong birthday, or a paper filed under the account holder, is sent to OpenAI like any other record. Email forwarded to MyMedi is filed under the account holder. One guardian login; do not share the password. Anyone whose records are on an account can email privacy@getmymedi.app to see or delete their own records, even if they do not hold the password.
For a child under 13, an iPhone with the latest MyMedi reads the pages with Apple’s text recognition and Apple’s on-device model, and writes out recordings with Whisper, all on the phone. The first time, the phone downloads the Whisper model from Hugging Face; the recording is not uploaded. The lines and words it finds are stored in MyMedi’s database. Android and the web do not do this. When the child turns 13, or the birthday is corrected to 13 or older, the next reading of a record sends its pages to OpenAI and replaces the lines the phone read.
4. How long it is kept
Your records stay in the live app until you delete them. Deleting a record removes it from the live app. Deleting your account removes the live account, every person in the household, and the files stored for that account.
These copies can remain:
- Forwarded email at Resend. MyMedi does not send Resend a deletion request.
- What was sent to OpenAI, for about 30 days of abuse monitoring. MyMedi does not send OpenAI a deletion request, and does not use OpenAI’s Files or Vector Stores.
- The full subscription message from RevenueCat, kept for tax and accounting.
- A file you exported, shared, or viewed in a browser.
The database is on Supabase Free, which does not keep automatic backups or point-in-time recovery. A record you delete is gone from the live database. If that plan changes, this policy will say so and ask you to agree again.
5. Your rights
You can, at any time:
- See what MyMedi holds about you, including the categories collected and the list of processors it has been shared with.
- Get a copy of your records, summaries, extracted measurements, and your medication and allergy list in a machine-readable format.
- Delete any record, or your entire account. Deleting your account removes the live records for every person in the household and the files stored for the account. Section 4 lists the copies that can remain. A rights request can name one person in the household. Someone who does not hold the password can still email the address in section 8.
- Withdraw a consent, including consent to send documents to OpenAI. Withdrawing that one means new documents will not be summarised, made searchable, or read for the medications and allergies they name; what has already been stored stays until you delete it. You can still type a medication or allergy in yourself.
MyMedi answers within 45 days, and will tell you if it needs the single extension the law allows. If a request is refused you will be told why in writing, and you can appeal — the appeal is reviewed by a different person than the one who refused it.
To exercise any of these, open Settings → Your rights in the app, or email the address in section 8.
Washington residents may also complain to the Washington State Attorney General, and MHMD gives you a private right of action under the Consumer Protection Act.
6. Where data is processed
Data is processed in the United States.
7. Security
- Every table is protected by row-level security, so the database itself refuses to return another person’s rows.
- Scans are in a private bucket; access is only ever through signed links that expire in minutes.
- Your session token is encrypted with a key held in the device Keychain.
- MyMedi does not save records into iCloud, and it does not use CloudKit. A file opened in the phone’s browser, an address copied to the clipboard, or a photo that was already in the photo library can still sync through iCloud.
- The OpenAI key exists only on the server. It is not in the app, so it cannot be extracted from it.
8. Contact and changes
Questions, requests, and appeals: privacy@getmymedi.app
If this policy changes in a way that affects how health data is collected, used, shared, or kept, or we add a company that receives it, MyMedi will ask for your consent again rather than relying on the consent you already gave. That is why every consent record stores its version and the exact text you saw.