Privacy policy

Last updated: 25 September 2026

This policy covers MyMedi as a whole. Health data is covered separately, in the Consumer Health Data Privacy Policy, because Washington’s My Health My Data Act and Nevada SB 370 require that policy to be a distinct document with its own link. If you are here about your medical records, read that one.

Who we are

MyMedi. Contact: privacy@getmymedi.app

What we collect

Waitlist. If you join from this website, we store the email address you enter so we can tell you when MyMedi is available. That is not health data.

Account information. An email address, or the private relay address Apple provides if you use Sign in with Apple. Nothing else is required to use MyMedi.

Subscription status. If you subscribe, RevenueCat and Apple tell us that an entitlement is active and when it expires. We never see your payment details. Apple processes the payment; we only ever learn the outcome.

Your medical records and everything derived from them are covered by the Consumer Health Data Privacy Policy.

What we do not collect

• No precise location. The app requests no location permission.
• No advertising identifiers. MyMedi has no advertising SDK.
• No cross-app tracking. MyMedi does not use App Tracking Transparency.
• No third-party analytics receiving health data. Ever.
• No crash reports or diagnostic opt-in. There is no crash-reporting SDK and no Settings toggle for it.

Children

A parent or legal guardian may store a child’s health records under their own login. MyMedi does not create accounts for children under 13, and a child never signs in. One guardian holds the password; do not share it with the child or with anyone else.

MyMedi keeps a child’s records away from OpenAI only when the birthday shows they are under 13 and the record is filed under that child. A wrong birthday, or a paper filed under the account holder, is sent to OpenAI like any other record. Email forwarded to MyMedi is filed under the account holder. If someone under 13 creates an account of their own, contact us and we will remove it.

For a child under 13, an iPhone with the latest MyMedi reads their pages itself with Apple’s text recognition, and MyMedi stores the lines it finds so they can be searched. A page is shown as those lines, never rewritten. A recording can be written out on the phone with Whisper; the first time, the phone downloads the speech model from Hugging Face, and the recording is not uploaded. On an iPhone that can run Apple Intelligence, Apple’s on-device model can pick out the key lines of a typed note or a written-out recording. All of this runs on the phone and none of it sends the record to OpenAI. Android and the web do not do this. When the child turns 13, or the birthday is corrected to 13 or older, the next reading of a record sends its pages to OpenAI and replaces the lines the phone read.

Your choices

• Ask us to remove a waitlist email by writing to privacy@getmymedi.app.
• Withdraw consent to third-party AI processing in Settings.
• Delete individual records, or your whole account — including every person in the household — from within the app. That removes the live account and the files stored for it. Forwarded email, OpenAI’s abuse-check copy (about 30 days), and the subscription record can remain. The Terms list them. Deleting the account does not cancel an Apple subscription.
• Exercise access, copy, deletion, and appeal rights through Settings → Your rights.

Security

• Row-level security on every table.
• Private storage with short-lived signed links only.
• Session tokens encrypted with a key in the device Keychain.
• MyMedi does not save records into iCloud, and it does not use CloudKit. A file opened in the phone’s browser, an address copied to the clipboard, or a photo that was already in the photo library can still sync through iCloud.
• Server-side API keys never ship inside the app.

If we discover a breach affecting your data we will notify you and the relevant regulators as required, including under the FTC Health Breach Notification Rule. MyMedi is not a HIPAA covered entity.

MyMedi is not a medical provider

MyMedi stores the documents you add and shows a software reading of them. Summaries, lab numbers, medication and allergy lines, answers, and one-pagers can be wrong or leave things out, and a medication list read this way can also miss something a record does mention. MyMedi does not check one medication against another, does not work out what any of them is for, and does not remind you to take anything. It does not diagnose, does not assess, and does not advise. Nothing in the app is medical advice, and it is not a substitute for a conversation with a clinician.

Changes

If we change how health information is collected, used, shared, or kept, or we add a company that receives it, we ask you to agree again. Other material changes are shown in the app at least 14 days before they take effect.