Privacy Notice

My Doctor Companion, Inc. (doing business as “My Doctor Friend,” “MDF,” “we,” “us,” or “our”) is committed to demystifying healthcare while respecting your privacy. This Notice explains what data we collect, how we use it, the choices you have, and how we keep it safe.

By using the MDF iOS app, website, or any related service (collectively, the “Services”), you agree to this Privacy Notice and to our Terms of Use. If you do not agree, please do not use the Services.

HOW HIPAA APPLIES TO MY DOCTOR FRIEND

HIPAA governs how certain organizations handle health information. It applies directly to “covered entities,” such as healthcare providers and health plans, and to their “business associates,” the vendors that handle protected health information on their behalf.

When My Doctor Friend processes health information on behalf of a healthcare provider, we act as that provider’s business associate under a signed Business Associate Agreement and are HIPAA compliant for that information, meeting the HIPAA obligations that apply to business associates, including the Security Rule and applicable parts of the Privacy Rule.

When you use My Doctor Friend on your own, the information you share with us generally is not covered by HIPAA. Instead, it is protected by the Federal Trade Commission Act and by state privacy laws such as California’s Confidentiality of Medical Information Act and the California Consumer Privacy Act. In these cases we are not acting as a business associate, so HIPAA does not technically apply, but we hold ourselves to the same HIPAA-grade safeguards regardless of how your information reaches us. These safeguards include encryption in transit and at rest, role-based access controls, audit logging, and agreements that bind our service providers to equivalent protections.

Content you choose to share in a Community is information you have elected to disclose to other members. Our safeguards protect how that content is stored, but content you publish to other members is not private.

1. WHO AND WHERE THIS APPLIES

• The Services are intended for individuals 13 years or older in the United States and are rated 17 plus in the Apple App Store.
• We do not knowingly allow children under 13 to create an account. If you believe a child has provided Personal Information, email privacy@mydoctorfriend.ai and we will delete it.
• These terms are governed by U.S. law. If you access the Services from outside the U.S., you are responsible for local compliance.

2. WHAT WE COLLECT AND WHY

3. HOW WE USE YOUR DATA

• Operate and improve the Services
• Provide personalised health insights and AI-generated responses
• Perform privacy-preserving analytics
• Detect and fix bugs
• Enforce Terms of Use and comply with law
• Operate the Community: display your contributions and pseudonym to other members, rank content, send community notifications, and provide safety tools (reporting, blocking, and moderation)

We may convert Personal Information into Non-Personal Information (for example, by hashing or aggregating) and use or share that data for analytics, product development, or research.

4. WHEN WE SHARE DATA

• Service Providers – hosting (Vercel, MongoDB Atlas), analytics (Mixpanel), AI processing (OpenAI, Anthropic, and Google) under HIPAA Business Associate Agreements.
• Legal or Safety – to respond to lawful requests or protect users.
• Business Transfers – in connection with a merger, acquisition, or asset sale; the successor is bound by this Notice.
• At Your Direction – for example, when you export data to an electronic health record.
• Other Members – when you post, comment, or vote in a Community, your contributions are visible to other members under your pseudonym, along with your avatar, reputation, and any badge you choose to display. Community content is not private between you and MDF. You decide what to share in a Community. Communities are members-only today. If we ever open a Community to public or search-engine visibility, we will update this Notice first.

We never sell your Personal Information or share it for cross-app advertising.

5. DATA RETENTION

6. YOUR RIGHTS AND CHOICES

7. SECURITY MEASURES

• TLS 1.2 or higher encryption in transit
• AES-256 encryption at rest
• Role-based access controls and audit logging
• Column-level encryption for protected health information; media stored in HIPAA-capable buckets
• Annual key rotation and quarterly access reviews

No method is one-hundred-percent secure. If you believe your account or data have been compromised, contact us immediately.

8. LINKS TO THIRD-PARTY SITES

The Services may link to third-party websites or content we do not control. Their privacy practices apply once you leave our domain; please review their policies.

9. CHANGES TO THIS NOTICE

We may update this Notice to reflect changes in law or practice. We will post any revised Notice with a new Last Updated date. For material changes, we will provide a more prominent notice, such as an in-app notice or a prompt to review the updated Notice the next time you use the Services. Your continued use of the Services after an update takes effect means you accept the revised Notice.

10. CONTACT US