🔒 Privacy and data protection

This page explains, in plain language, what we use, why we use it, and what remains under your control.

What data do we collect?

Basic account data only when you choose to register: name, email, and a securely hashed password.
Health information you enter in a service or explicitly choose to save; it is not requested during sign-up.
Essential reliability and security logs such as request status and an error reference ID are used to operate and protect the service and do not include symptom or chat text. Usage analytics such as pages or services used are stored only when optional Analytics is enabled.

What is saved?

Core services remain available to guests. When signed in, your profile, results, and conversations may be saved according to the privacy settings you choose.

How do we use authorized data?

There are three separate consents. (1) Service usage (required to run a symptom analysis): we process the health information you provide only to deliver the analysis and its results. (2) Usage analytics & product improvement (optional): usage statistics, ratings, short search phrases scrubbed of numbers and obvious identifiers and not linked to an account or session, and an anonymised copy of the analysis data (age, gender, symptoms, duration, urgency) that feeds aggregate statistics and the admin symptom-trials file, without name, email or chat text. Ratings sent from an account are stored with a hashed pseudonymous identifier that does not contain your name or email. (3) Scientific research (optional): records enter the research file only with your independent consent and only when you are 18 or older, with direct identifiers removed and small groups suppressed. Neither optional consent depends on the other, declining them does not prevent use of the service, and neither is pre-selected. You can change or withdraw them at any time; withdrawal stops the related processing going forward and excludes your retained records from future statistics and exports, but it cannot recall files downloaded before withdrawal.

SymptoSense currently does not use your health records to train or improve the underlying AI model itself, so a separate AI-improvement consent is not shown. If that use changes in the future, the notice and consent flow must be updated first.

Is data sent to an AI service?

When you use the assistant or analysis, the text needed to generate a response may be sent to the AI provider configured for this deployment. The model is not permitted to invent sources or provide a definitive diagnosis, and the knowledge base and safety rules are used where available. Avoid entering names, phone numbers, or other identifiers in a health description.

Deletion and control

You can disable use of saved information, remove individual health fields, clear history, or delete your account and its data from privacy settings and data management.

Privacy Center Manage my data

Administrator access

Admin analytics are aggregated wherever possible. User management shows only an ID, status, dates, and role; it does not expose symptoms, chats, or personal health results by default.

Retention and deletion

Account-linked health records are user-controlled by default and are not silently time-purged. Optional usage analytics are normally retained for up to 180 days, security logs for up to 90 days, and medication-email delivery logs for up to 90 days, while expired tokens are pruned after a short grace period. The anonymised analysis copy (when analytics is on) is kept until it is deleted or consent is withdrawn, after which it is excluded from future statistics and exports. Account deletion removes active app data; operational backups may persist temporarily under the hosting provider's rotation cycle.

Service providers and processing location

Operation may rely on Railway for hosting/database services, Groq for some AI requests when enabled, an email provider for messages, and Sentry for error monitoring when configured. Only when you choose the Nearest Hospital feature, coordinates shared by your device are sent to the OpenStreetMap Overpass service to search for nearby facilities; SymptoSense does not save those coordinates in your health record. These providers may process data in other countries under their infrastructure and policies. Only data needed for the feature is sent, and users should avoid including personal identifiers in health descriptions.

Use by minors

SymptoSense is an educational tool, not a substitute for medical care. Minors should use it with appropriate parent/guardian oversight under local requirements and should not rely on it alone in urgent situations.

Privacy contact

Use the official contact method shown on the site for privacy or deletion requests. Do not send sensitive symptoms or medical results through general contact channels.

Medical knowledge base

It contains general medical information, sources, and safety rules only—never patient records or personal conversations.

Legal basis and data transfers (Saudi PDPL)

Health information is treated as sensitive personal data under the Saudi Personal Data Protection Law (PDPL). We keep your health data only with your consent, and you may ask what we hold, access it, correct it, request its deletion, and withdraw consent at any time from the Privacy Center. Some data may be processed by service providers outside the Kingdom (e.g. hosting and AI processing); we limit this to what the feature you use needs, and only after offering you the choice.