How we protect
your information

local_hospital Patiently AI data handling

This applies to the Patiently AI iOS app (version 2.0 and later) and the web app at getpatiently.ai, including the Android app, which is a packaged version of the web app. Patiently AI uses a third-party AI provider, OpenAI, to rewrite medical notes in plain language. Here is exactly what is sent, to whom, and what happens to it.

• What is sent: when you type or paste a note, the text of the note you submit, with personal identifiers (names, dates of birth, NHS numbers, phone numbers, email addresses, postal addresses and similar) replaced by placeholders on your device before anything leaves it, together with the options you chose (audience, tone, length and language). The real identifiers stay on your device and are put back into the result only on your screen.
• Who receives it: our server (Google Cloud / Firebase) passes the de-identified text to OpenAI's API, which generates the plain-language version, a table of your results if the note is a blood test report, and, if you ask for them, suggested questions for your appointment. OpenAI processes the text to produce the response and does not use it to train its models; under its API data policy it may retain the text for up to 30 days for abuse monitoring, after which it is deleted.
• What our server keeps: the de-identified reply for up to 24 hours, so that a retry after a lost connection doesn't cost you a free note, after which it is deleted; a count of simplifications per account (to apply the free allowance); and, if you unlock the app, the App Store transaction identifier used to verify the purchase.
• Consent: the iOS app explains this and asks for your agreement before the first note is sent. You can withdraw agreement at any time by not using the simplification feature; the trackers work without it.
• Cloud history (optional, iOS): if you sign in with Apple or Google, your simplified notes are also stored in your account so they appear on your other devices. They are stored in de-identified form; the map that restores the real identifiers is encrypted with a key held in your iCloud Keychain, which we cannot read. You can delete individual notes, all notes, or your whole account from within the app.
• Trackers: symptoms, blood pressure readings, mood entries, medications, templates and appointment reminders are stored on your device only and are never sent to us or to any AI provider.
• Dictation: in the iOS app, speech is transcribed on your device using Apple's on-device speech recognition; no audio leaves the device. In the web app, audio submitted for transcription is processed and deleted after processing.
• Photos, PDFs and Word files (web app): if you upload a photo of a letter or result, the image is sent through our server to OpenAI to read the text before identifiers can be removed, so please crop out names and other personal details if you can. OpenAI handles the image under the same API terms as text: it is not used for training and may be retained for up to 30 days for abuse monitoring. iPhone HEIC photos are converted to JPEG on your device first. PDF and Word files are sent to our server, which extracts the text and does not keep the file. In both cases the extracted text then goes through the same on-device de-identification as typed text before it is sent for simplification.
• Read aloud (web app): if you tap the read-aloud button, the plain-language explanation shown on screen is sent through our server to ElevenLabs, which turns it into audio. This is the same de-identified explanation that came back from OpenAI. Our server does not keep the text or the audio. ElevenLabs processes it under its standard terms, which include keeping a history of the text and audio it generates. If you would rather the explanation was not sent, don't use read aloud.
• Feedback: if you rate a result (thumbs up or down), we record the rating and the options used, never the note itself.
• Analytics: the iOS app contains no analytics or advertising SDKs. The web app may collect aggregated, anonymised usage insights.

fact_check RefCheckr data handling

Information we collect

• Email address for authentication via magic link sign-in
• Document text you select and submit for verification or search
• Verification history and search queries
• Subscription and billing information via LemonSqueezy
• Usage counts for rate limiting

How we use it

• Authenticate your session and manage your account
• Process selected text through AI services (Perplexity) to verify claims against published evidence
• Search PubMed, ClinicalTrials.gov, and drug labelling databases on your behalf
• Track usage against plan limits

AI processing

• Text you submit is sent to Perplexity AI for analysis and is subject to their privacy policy
• RefCheckr does not store the content of your documents beyond the duration of the request
• AI-generated outputs may contain inaccuracies and should be verified independently

Word add-in

• The RefCheckr Word add-in reads only the text you explicitly select in your document
• No document content is accessed, stored, or transmitted without your action
• Authentication tokens are stored locally in your browser's localStorage

Data retention

• Verification history is stored in your account for your reference
• Document text submitted for verification is not retained after processing
• Account data is deleted upon request

map HushMap data handling

Information we collect

• Location data for venue mapping and reports
• Sensory ratings, comments, and timestamps
• Authentication data
• Device performance information

How we use it

• Provide personalised sensory insights
• Share anonymised sensory reports globally with users
• Improve features through aggregated analysis

Storage and sharing

• Reports are stored on Google Firebase and visible to app users worldwide
• Personal identity details are not displayed with reports
• Authentication data remains private

Your controls

• Location permissions can be revoked anytime
• Data deletion requests can be submitted
• Uninstalling removes local device data

Data retention

• Local data removed upon uninstall
• Community sensory reports retained to support the shared database
• Account data deleted upon request

shield Redacta data handling

Redacta runs entirely on your device. It collects no data — nothing you enter or process is transmitted off the device, stored on our servers, or accessible to us.

What we collect

• Nothing. Redacta has no accounts, no analytics, no tracking, and no network connection

On-device processing

• Clinical text you paste or type is redacted locally and is never transmitted or stored
• Photos used for text recognition (Scan) are processed on-device with Apple's Vision framework and are not uploaded or retained
• Clipboard contents used by the app, Shortcut, or widget are processed in the moment and not stored
• Token maps for re-identification are held in memory only for the session and are never written to disk

Settings

• Only non-identifying preferences (the selected redaction mode and light/dark appearance) are saved locally on your device

Your control

• Because nothing leaves your device, there is no account or stored data for us to access or delete; uninstalling removes the app's local preferences
• Questions: support@pharmatools.ai

shield OpenGATE data handling

OpenGATE is an open-source evaluation framework. Its command-line tool and the @pharmatools/opengate-mcp server run entirely on your own machine and collect no data — nothing you pass to them is transmitted to us, stored on our servers, or accessible to us.

What we collect

• Nothing. OpenGATE has no accounts, no analytics, and no tracking

On-device processing

• The MCP server's check_grounding tool performs a deterministic, local text comparison — the answer and context you provide are processed in memory to produce a grounded/not-grounded result, and are never transmitted or stored
• The tool makes no external network calls and uses no third-party model or service
• When you evaluate your own AI system with OpenGATE, it calls your system's endpoint directly, using credentials you configure locally; those credentials and your data never reach us

Your control

• Because nothing leaves your machine, there is no account or stored data for us to access or delete
• Questions: support@pharmatools.ai

assignment TrialGen data handling

This applies to the TrialGen iOS app (version 2.0 and later) and the web app at pharmatools.ai/trialgen. TrialGen uses a third-party AI provider, OpenAI, to propose clinical trial names from a study description, and the public ClinicalTrials.gov registry to check each proposed acronym. Here is exactly what is sent, to whom, and what happens to it.

• What is sent: the study description you type or build with the guided questions (field, condition, intervention, population, outcome, design and keywords) and, when you ask for more names, the acronyms already shown so they are not repeated. Study descriptions are not personal data; please do not include patient or personal information in them.
• Who receives it: our server (Google Cloud / Firebase) passes the description to OpenAI's API, which writes candidate names. OpenAI processes the text to produce the response and does not use it to train its models; under its API data policy it may retain it for up to 30 days for abuse monitoring, after which it is deleted.
• Availability check: each candidate acronym is looked up on ClinicalTrials.gov, a public registry run by the US National Library of Medicine, and only acronyms not already registered there are shown. These lookups contain the acronym only. The iOS app's "Check a name" and "Check again" features make the same lookup directly from your device and do not pass through our server.
• What our server keeps (iOS app): the reply for up to 24 hours, so that a retry after a lost connection doesn't cost you a free generation, after which it is deleted; a count of generations per anonymous account (to apply the free allowance of three, from version 2.0); and, if you unlock the app (from version 2.0), the App Store transaction identifier used to verify the purchase.
• What our server keeps (web app): nothing beyond short-lived rate-limiting records keyed to a coarse version of your IP address, held for up to 24 hours.
• Accounts: the iOS app has no sign-in. It creates an anonymous Firebase identifier on first launch, used only to apply the free allowance and store an unlock (both from version 2.0); it is not linked to your name, email or Apple ID.
• What stays on your device: your history of generated names and your favourites are stored on your device only and are never sent to us or to any AI provider. "Delete my data" in the app removes them, deletes the anonymous account and its usage record on our server, and starts a fresh anonymous session.
• Consent: the iOS app explains this and asks for your agreement before the first description is sent.
• Crash reports: the iOS app uses Firebase Crashlytics to collect crash reports (device model, OS version, the app's state at the time of the crash). These are not linked to you and contain no study descriptions. The app contains no analytics or advertising SDKs.
• Web app analytics: the web page at pharmatools.ai/trialgen uses privacy-friendly, cookieless analytics (Plausible) that records page views and button clicks in aggregate. If you accept analytics cookies, Google Analytics also runs on this page, as on the rest of the site.

water_drop AI Footprint data handling

AI Footprint is an open-source MCP server and JSON API, hosted at footprint.pharmatools.ai, that estimates the water and energy used by AI. Its tools are arithmetic over a published methodology: they call no AI model and no third-party service. This section covers the hosted server; if you run the open-source code yourself, nothing reaches us.

What we collect

• Tool inputs (such as prompts per day or token counts) are used only to calculate the response and are not logged or stored
• Server logs record the name of the tool or endpoint called and nothing else: no inputs, no IP addresses, no account or client identifiers
• IP addresses are held in memory only to enforce rate limits (120 requests per minute per client). They are never logged or written to disk, and are discarded when the server restarts
• There are no accounts, cookies, analytics or tracking on the server

Sharing and hosting

• The server runs on Railway, which hosts it on our behalf and processes requests to deliver them. We do not share, sell or otherwise disclose any data from the server
• Responses link to the methodology on pharmatools.ai; following a link is an ordinary website visit, covered by the rest of this policy

Prompt tightener

• The “Make your first prompt the only one” tool on the AI Water & Energy Calculator page uses the same server. The draft you submit is sent to Anthropic’s API (Claude) to be rewritten, and the rewrite is returned to your browser. We do not log or store the draft or the rewrite. Anthropic processes it under its commercial API terms, which do not permit training on API data; see Anthropic’s privacy policy for its retention periods. Please don’t include personal or patient information in a draft

Retention and your control

• Because nothing you send is kept, there is no stored data for us to access, correct or delete
• Questions: info@pharmatools.ai