1. Scope
Doctale is a patient-side consumer app that helps people remember medical visits by turning recordings into summaries, medications, next steps, appointments, and shared care-circle context. This Privacy Policy applies to the doctale website, apps, and services that link to it.
Doctale is not currently a HIPAA covered entity or business associate. We do not sign business associate agreements with healthcare providers. We still treat health information as sensitive and design the service to minimize server-side retention of visit content.
2. Data we collect
The data we collect depends on how you use doctale.
- Account and contact information: name, email address, phone number, login details, communication preferences, and support messages.
- Visit and health content: visit audio, transcripts, summaries, medications, symptoms, conditions, care instructions, appointments, reminders, notes, and other health-related information you record, upload, type, or share.
- Care-circle information: names, contact details, invitations, comments, edits, sharing actions, permissions, and content shared among caregivers or family members.
- Device and app information: device type, operating system, app version, IP address, approximate location derived from network data, crash or diagnostic information, and security logs.
- Location information: location data if you grant permission or include location in visit, appointment, or reminder information.
- Subscription information: app-store subscription status, product tier, transaction metadata, renewal status, and cancellation status. Apple and Google process payment details directly.
- Anonymous analytics: basic PostHog usage metrics that help us improve product experience. These analytics are intended to be anonymous and not tied to an identified user profile.
3. How we use data
- Provide recording, transcription, summaries, medication lists, appointments, reminders, and next steps.
- Deliver content to your device and to care-circle members you invite.
- Allow care-circle members to view, edit, comment on, and further share content where you enable those permissions.
- Manage accounts, authentication, customer support, service messages, and app-store subscriptions.
- Protect the service, investigate misuse, debug issues, and maintain security.
- Improve doctale using anonymous product analytics and aggregated, de-identified operational information.
- Comply with applicable law, enforce our Terms, and respond to valid legal requests.
We do not sell personal data or consumer health data. We do not use health content for targeted advertising.
4. AI and transcription processing
doctale uses third-party processors to create transcripts, summaries, medication lists, and next steps. Soniox helps convert audio to text. OpenAI and Google Gemini help transform transcripts and related visit context into structured, easier-to-understand information.
Visit content is sent for temporary processing so doctale can provide the service. Temporary server-side processing copies are deleted after the results are delivered to your device and, where applicable, to devices of care-circle members you have invited.
We require AI and transcription providers to process health content only to provide services to doctale and not to train their general-purpose AI models on your health content.
AI output can be incomplete or wrong. doctale summaries are not medical advice. Always confirm important medical decisions, medication changes, and urgent symptoms with a qualified healthcare professional.
5. How we share data
We share data only as needed to run doctale, follow your directions, or comply with law.
- Care-circle members: people you invite may see, edit, comment on, and share content according to the permissions available in the app. Only invite people you trust.
- Service providers and subprocessors: Amazon Web Services, Soniox, OpenAI, Google Gemini, PostHog, Apple, and Google help provide infrastructure, transcription, AI, analytics, app distribution, and subscriptions.
- App stores: Apple and Google process payments and manage subscriptions according to their own terms and privacy policies.
- Legal, safety, and business needs: we may disclose information if required by law, to protect rights and safety, to investigate misuse, or in connection with a merger, acquisition, financing, or sale of assets.
- With your consent: we may share information in other ways if you ask us to or give permission.
6. Retention and deletion
doctale is designed around short-lived server processing for health content. Audio, transcripts, summaries, medications, appointments, and care-circle content are delivered to the app and then temporary server-side processing copies are deleted.
We may keep limited non-health or operational records for as long as needed to provide the service, maintain security, manage subscriptions, respond to support requests, comply with law, resolve disputes, and enforce agreements. Examples include account identifiers, subscription metadata, support messages, anonymous analytics, security logs, and records of deletion requests.
You can delete content in the app or contact support@doctale.ai for help with account or privacy requests. Backup and security systems may take additional time to age out limited operational records.
7. Your choices and rights
- Access and correction: review and update your information in the app where available, or contact us.
- Deletion: delete content in the app or ask us to help delete account information we control.
- Sharing controls: choose who joins your care circle and remove access when app controls allow it.
- Device permissions: control microphone, notifications, location, contacts, and other permissions through your device settings.
- Subscriptions: manage cancellations and refunds through Apple App Store or Google Play, depending on where you subscribed.
- Marketing: opt out of promotional messages by following unsubscribe instructions or contacting support@doctale.ai. Service messages may still be sent.
Depending on where you live, you may also have legal rights to request access, deletion, correction, portability, restriction, objection, withdrawal of consent, or appeal of a privacy decision.
8. Consumer health data notice
For users in places with consumer health privacy laws, including Washington and Nevada in the United States, consumer health data may include information that identifies or can reasonably be linked to your health status, care, symptoms, treatments, medications, diagnoses, appointments, provider visits, and related health needs.
Categories of consumer health data
- Audio and transcripts of healthcare visits.
- Summaries, medications, next steps, appointments, conditions, symptoms, and care instructions.
- Care-circle comments, edits, sharing activity, and caregiver context.
- Location or appointment information when tied to healthcare needs.
Sources and purposes
We collect consumer health data from you, from people in your care circle when they add information, and from the content you choose to record, upload, or share. We use it to provide doctale, create summaries and next steps, deliver shared content, secure the service, and comply with law.
Sharing
We share consumer health data with care-circle members you choose, processors needed to provide the service, and others only with your direction, consent, or as required by law. We do not sell consumer health data.
Rights
You may request access, deletion, withdrawal of consent, or other rights available under applicable consumer health privacy laws by contacting support@doctale.ai.
9. International users
Doctale is based in Hong Kong and is available worldwide. Your information may be processed in Hong Kong, the United States, the European Economic Area, Israel, or other countries where we or our processors operate.
Where GDPR, UK GDPR, Israeli privacy law, Hong Kong privacy law, or similar laws apply, our legal bases may include providing the service you request, your consent, legitimate interests such as security and product improvement, and compliance with legal obligations.
10. Security
We use technical and organizational safeguards designed to protect information, including encryption in transit, cloud access controls, and limited-access operational practices. No service can guarantee absolute security, so please use a strong device passcode and be careful when sharing health information.
11. Children
doctale is not intended for children under 13. If you believe a child under 13 has provided personal data to doctale, contact support@doctale.ai and we will take appropriate steps.
12. Changes
We may update this Privacy Policy as the service changes. If changes are material, we will provide notice through the app, website, or another reasonable method. The updated policy will show the latest update date.
13. Contact
Questions or privacy requests can be sent to support@doctale.ai.
Entity: Doctale. Jurisdiction: Hong Kong. Mailing address: to be added.