Health Decoder — Privacy Policy

Last updated: August 7, 2026

HealthDecoder ("the app," "we," "our") is built around one rule: your medical records are yours, and they stay on your device. This page explains exactly what data the app touches, why, and what you control.

This app is provided by an independent developer, not a hospital, clinic, or certified medical device manufacturer. See the in-app Medical Disclaimer for details on that.

1. What stays on your device, always

Every medical record you scan or enter — reports, lab values, medicines, doctor notes, reminders, appointments — is stored in an encrypted local database (SQLCipher) on your phone. This data is never uploaded to, or stored on, any server we operate. If you uninstall the app without exporting first, this data is gone; we have no copy to recover it from, because we never had one.

2. What is sent to AI services, and why

To extract structured information (medicines, lab values, dates) from a scanned report or answer a question you ask, the relevant page images or text are sent to:

Google Gemini (vision and language AI)
Sarvam AI (Indic-language OCR, translation, text-to-speech)

This happens through our backend, which relays the request but does not store the report content — it only resolves which API key to use and enforces a daily usage limit. Neither Gemini nor Sarvam is instructed to retain your data for training or any purpose beyond processing that single request. The structured result they return is saved only in your device's local, encrypted database.

You must accept this in the in-app disclaimer before the app can be used, since scanning and AI chat don't work without it.

3. Optional account and device data

Anonymous device ID: by default, the app identifies your install with a random ID (not tied to your name or phone number) so it can enforce a fair daily AI usage limit. This ID and your daily usage count are the only things stored against it on our server.
Optional sign-in (phone number or Google account): off by default. If you choose to sign in, we store your email/phone and an authentication token so your usage limit follows your account instead of just the device.
Optional Gmail attachment sync: if you explicitly link a Gmail account (a separate consent step, off by default), the app searches recent emails for medical-report attachments and imports them. Email content is processed on your device; only the OAuth token needed to check your inbox is used, and it isn't sent to our servers.
Optional biometric login: if enabled, your fingerprint is verified by your device's own operating system (Android Keystore). We never receive fingerprint data — only a resulting session token stored securely on your device.

4. Backend database — what it does and doesn't hold

Our backend uses a Postgres database for exactly three things: accounts (if you sign in), anonymous usage/quota counters, and UI translation strings. It does not contain your medical reports, scanned images, lab values, or AI chat history — those never leave your device except transiently, in-transit, to the AI services described in Section 2.

5. Optional: anonymized research data sharing

In Account settings, there's an opt-in toggle asking whether you'd be willing to have only your age and sex — never your name, reports, exact location, or any other detail — used in aggregate for medical research, to help fund keeping this app free.

This program has not launched. Turning the toggle on today only records your preference on your device; no data is transmitted to us or anyone else because the collection pipeline doesn't exist yet. If this ever becomes active, this policy will be updated first, and only users who separately opted in at that time would be included.

6. Data you control completely

Export/Import: you can export your records as an encrypted, portable file and move it to your own Google Drive, OneDrive, or another device — entirely outside our infrastructure. We never see or store this file.
Deletion: uninstalling the app deletes your local database. If you signed in, you can request account deletion, which removes your account row and usage counters from our backend. See our Delete Your Account page for the exact in-app steps, what's deleted, and an email option if you can't access the app.

7. Permissions the app requests, and why

Permission	Why
Camera	To photograph reports/prescriptions and scan QR codes from lab reports
Notifications, exact alarms	To deliver medication and appointment reminders on time
Full-screen intent	So a medication reminder can show as a full-screen alert with large text
Biometric	Only if you enable fingerprint login
Internet / network state	To reach the AI proxy and, if signed in, sync your account

8. Third parties this data may pass through

Google Gemini, Sarvam AI, and (if you sign in with Google or link Gmail) Google's own account/OAuth systems. We do not sell data to advertisers or data brokers, and the app does not run any analytics or advertising SDK.

9. Changes to this policy

If what the app collects or how it's used changes materially, this page will be updated and the date at the top revised. Continued use of the app after an update means you accept the revised policy.

10. Contact

Questions about this policy or a request to delete your account data can be sent via GitHub or through the app's own feedback channel.