How we protect
your information

local_hospital Patiently AI data handling

This applies to the Patiently AI iOS app (version 2.0 and later) and the web app at getpatiently.ai. Patiently AI uses a third-party AI provider, OpenAI, to rewrite medical notes in plain language. Here is exactly what is sent, to whom, and what happens to it.

• What is sent: the text of the note you submit, with personal identifiers (names, dates of birth, NHS numbers, phone numbers, email addresses, postal addresses and similar) replaced by placeholders on your device before anything leaves it, together with the options you chose (audience, tone, length and language). The real identifiers stay on your device and are put back into the result only on your screen.
• Who receives it: our server (Google Cloud / Firebase) passes the de-identified text to OpenAI's API, which generates the plain-language version and, if you ask for them, suggested questions for your appointment. OpenAI processes the text to produce the response and does not use it to train its models; under its API data policy it may retain the text for up to 30 days for abuse monitoring, after which it is deleted.
• What our server keeps: the de-identified reply for up to 24 hours, so that a retry after a lost connection doesn't cost you a free note, after which it is deleted; a count of simplifications per account (to apply the free allowance); and, if you unlock the app, the App Store transaction identifier used to verify the purchase.
• Consent: the iOS app explains this and asks for your agreement before the first note is sent. You can withdraw agreement at any time by not using the simplification feature; the trackers work without it.
• Cloud history (optional, iOS): if you sign in with Apple or Google, your simplified notes are also stored in your account so they appear on your other devices. They are stored in de-identified form; the map that restores the real identifiers is encrypted with a key held in your iCloud Keychain, which we cannot read. You can delete individual notes, all notes, or your whole account from within the app.
• Trackers: symptoms, blood pressure readings, mood entries, medications, templates and appointment reminders are stored on your device only and are never sent to us or to any AI provider.
• Dictation: in the iOS app, speech is transcribed on your device using Apple's on-device speech recognition; no audio leaves the device. In the web app, audio submitted for transcription is processed and deleted after processing.
• Feedback: if you rate a result (thumbs up or down), we record the rating and the options used, never the note itself.
• Analytics: the iOS app contains no analytics or advertising SDKs. The web app may collect aggregated, anonymised usage insights.

fact_check RefCheckr data handling

Information we collect

• Email address for authentication via magic link sign-in
• Document text you select and submit for verification or search
• Verification history and search queries
• Subscription and billing information via LemonSqueezy
• Usage counts for rate limiting

How we use it

• Authenticate your session and manage your account
• Process selected text through AI services (Perplexity) to verify claims against published evidence
• Search PubMed, ClinicalTrials.gov, and drug labelling databases on your behalf
• Track usage against plan limits

AI processing

• Text you submit is sent to Perplexity AI for analysis and is subject to their privacy policy
• RefCheckr does not store the content of your documents beyond the duration of the request
• AI-generated outputs may contain inaccuracies and should be verified independently

Word add-in

• The RefCheckr Word add-in reads only the text you explicitly select in your document
• No document content is accessed, stored, or transmitted without your action
• Authentication tokens are stored locally in your browser's localStorage

Data retention

• Verification history is stored in your account for your reference
• Document text submitted for verification is not retained after processing
• Account data is deleted upon request

map HushMap data handling

Information we collect

• Location data for venue mapping and reports
• Sensory ratings, comments, and timestamps
• Authentication data
• Device performance information

How we use it

• Provide personalised sensory insights
• Share anonymised sensory reports globally with users
• Improve features through aggregated analysis

Storage and sharing

• Reports are stored on Google Firebase and visible to app users worldwide
• Personal identity details are not displayed with reports
• Authentication data remains private

Your controls

• Location permissions can be revoked anytime
• Data deletion requests can be submitted
• Uninstalling removes local device data

Data retention

• Local data removed upon uninstall
• Community sensory reports retained to support the shared database
• Account data deleted upon request

shield Redacta data handling

Redacta runs entirely on your device. It collects no data — nothing you enter or process is transmitted off the device, stored on our servers, or accessible to us.

What we collect

• Nothing. Redacta has no accounts, no analytics, no tracking, and no network connection

On-device processing

• Clinical text you paste or type is redacted locally and is never transmitted or stored
• Photos used for text recognition (Scan) are processed on-device with Apple's Vision framework and are not uploaded or retained
• Clipboard contents used by the app, Shortcut, or widget are processed in the moment and not stored
• Token maps for re-identification are held in memory only for the session and are never written to disk

Settings

• Only non-identifying preferences (the selected redaction mode and light/dark appearance) are saved locally on your device

Your control

• Because nothing leaves your device, there is no account or stored data for us to access or delete; uninstalling removes the app's local preferences
• Questions: support@pharmatools.ai

shield OpenGATE data handling

OpenGATE is an open-source evaluation framework. Its command-line tool and the @pharmatools/opengate-mcp server run entirely on your own machine and collect no data — nothing you pass to them is transmitted to us, stored on our servers, or accessible to us.

What we collect

• Nothing. OpenGATE has no accounts, no analytics, and no tracking

On-device processing

• The MCP server's check_grounding tool performs a deterministic, local text comparison — the answer and context you provide are processed in memory to produce a grounded/not-grounded result, and are never transmitted or stored
• The tool makes no external network calls and uses no third-party model or service
• When you evaluate your own AI system with OpenGATE, it calls your system's endpoint directly, using credentials you configure locally; those credentials and your data never reach us

Your control

• Because nothing leaves your machine, there is no account or stored data for us to access or delete
• Questions: support@pharmatools.ai