Privacy Policy

Last updated: September 15, 2026

MedicalHistory.app ("MedicalHistory.app", "we", "us") helps you upload medical documents, extract lab results, and track biomarkers over time. This Privacy Policy explains what personal data we collect through the service at medicalhistory.app, why we collect it, who we share it with, and the rights you have over it.

1. Who we are

The data controller for MedicalHistory.app is MB "Burikas", which operates other products in addition to MedicalHistory.app. This Privacy Policy covers only the data processing carried out through medicalhistory.app — it does not describe or apply to any other product operated by MB "Burikas".

2. What data we collect

Account data: email address and authentication data needed to create and secure your account.
Uploaded documents: the medical records and lab reports (typically PDFs) you upload, which may contain sensitive health information such as biomarker values, diagnoses, or clinician notes.
Extracted health data: structured biomarker values, dates, and reference ranges we extract from your uploaded documents. Mapped values may appear on your timeline automatically; you can review and edit them anytime.
Billing data: if you subscribe to a paid plan, our payment processor (Stripe) collects and processes your payment details on our behalf. We do not receive or store your full card number.
Usage data: basic analytics about how the app is used (for example, pages visited), collected via Google Analytics, to help us understand and improve the product.

3. Legal basis for processing

Because uploaded documents and extracted biomarker values are health data — a "special category" of personal data under Article 9 of the GDPR — we only process this data on the basis of your explicit, informed consent, which you give when you upload a document and confirm the extracted values. You can withdraw this consent at any time by deleting the relevant documents or your account (see Section 8).

Account and billing data are processed on the basis of the contract we have with you (to provide the service you signed up for) and our legitimate interest in operating, securing, and improving the service. Analytics data is processed with your consent where required by applicable law.

4. How we use data

We use the data described above to:

extract lab values from documents you upload and let you review them before saving
display your health data as an organized, searchable timeline
operate your account, including authentication and billing
communicate with you about your account or the service
maintain the security and reliability of the service
understand aggregate usage patterns to improve the product

We do not sell your personal data, and we do not use your uploaded documents or health data to train AI models or for advertising.

We share data with a small number of service providers ("sub-processors") who help us run MedicalHistory.app, strictly for that purpose and under contractual confidentiality and data-protection obligations:

Google Gemini API (Google): the content of documents you upload is sent to Google's Gemini API solely to extract lab values from the document. This is the only sub-processor that receives the raw content of your uploaded documents.
Supabase: database, authentication, and file storage for your account data, uploaded documents, and extracted values.
Hetzner: server hosting for our application backend.
Cloudflare: content delivery and network security (DNS/CDN) for our website.
Stripe: payment processing for paid subscriptions.
Google Analytics: aggregate, non-health usage analytics for the website.

We do not share your uploaded documents or extracted health data with any other third party, and we never share it for marketing or advertising purposes. You can request the current, complete list of sub-processors by emailing us at [email protected].

6. International data transfers

Some of our sub-processors (including Google, for both Gemini and Analytics, and Stripe) may process data outside the European Economic Area, including in the United States. Where this occurs, we rely on the provider's Standard Contractual Clauses and/or their certification under the EU-U.S. Data Privacy Framework as the legal basis for the transfer.

7. Data retention

We keep your account data, uploaded documents, and extracted health data for as long as your account is active. If you delete an individual document, it is removed from your account immediately. If you delete your account (see Section 8), we permanently delete your account data, uploaded documents, and extracted health data within 30 days, except where we are required to retain limited billing records for longer to comply with tax or accounting law.

8. Your rights

Subject to applicable law (including the GDPR, if you are in the EU/EEA, and applicable U.S. state privacy laws), you have the right to:

Access the personal data we hold about you
Rectify inaccurate or incomplete data
Erase your data ("right to be forgotten")
Export / port your data in a portable format
Object to or restrict certain processing
Withdraw consent at any time, without affecting past processing

You can delete individual documents directly from your dashboard at any time. To exercise any other right — including a full account deletion or an export of your uploaded documents and extracted data — email [email protected] from the email address on your account. We will confirm and complete your request within 30 days. If you are in the EU/EEA and believe we have not addressed your request properly, you also have the right to lodge a complaint with your local data protection authority.

9. Security

We use industry-standard technical and organizational measures to protect your data, including encryption of data in transit (HTTPS/TLS), access controls restricting who can view your data, and row-level database security so that user accounts can only access their own records. No online service can guarantee absolute security, and we encourage you to use a strong, unique password for your account.

MedicalHistory.app is not a HIPAA-covered entity and does not claim HIPAA compliance. You upload your own records to the service rather than a healthcare provider transmitting them to us under a business associate agreement.

10. Cookies & tracking

We use strictly necessary cookies to keep you signed in and to operate the website securely; these are essential and do not require your consent. We also use Google Analytics for aggregate, non-essential usage analytics. Analytics cookies are only set after you accept them in the cookie banner shown on your first visit — Google Analytics runs with analytics cookies disabled until you do. If you decline, analytics stays off (cookieless) and the banner is not shown again. You can change your decision at any time by clearing this site's data in your browser settings, and you can opt out of Google Analytics specifically using Google's browser opt-out add-on. We do not use cookies for advertising or cross-site tracking.

11. Children's data

MedicalHistory.app is intended for use by adults. You must be at least 18 years old to create an account. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us at [email protected] and we will delete the account.

12. Breach notification

If we become aware of a security breach that compromises your personal data, we will notify affected users and, where required, the competent supervisory authority, without undue delay and, for GDPR purposes, within 72 hours of becoming aware of the breach where feasible. This commitment also covers our obligations under the U.S. FTC Health Breach Notification Rule and applicable U.S. state health-data breach laws.

13. U.S. state privacy notices

If you are a resident of a U.S. state with a consumer health data or privacy law (such as Washington's My Health My Data Act or the California Consumer Privacy Act), the rights described in Section 8 apply to you in the same way. We do not sell or share your health data for cross-context behavioral advertising, and we do not collect precise geolocation data.

14. Changes to this policy

We may update this Privacy Policy as the service evolves. If we make material changes, we will notify you by email or through a notice in the app before the changes take effect. The "Last updated" date at the top of this page always reflects the latest version.

15. Contact

For any privacy question, or to exercise any of the rights described above, email us at [email protected].