Privacy notice — development draft.
Configure operator identity and data-processing terms before launch.
What is stored
This installation persists account data, professional context, submitted text, scan findings, review decisions and audit records in its database.
Guest checks
Landing-page text, image, document, audio and video guest checks do not persist submitted posts, uploaded sources or raw AI responses in the guest database or cache. Local screening and extraction run without an external AI transfer unless you choose the configured Cloudflare AI review. With that opt-in, privacy-screened, redacted source text and applicable source clauses are sent to Cloudflare. A sanitized image preview is sent only with your source-permission and privacy confirmation, when no possible patient or private information is detected or declared. Detailed evidence and AI findings are transient response and PDF-download content. Uploads and local extraction outputs are temporarily processed and deleted after each check. Audio/video use your supplied transcript or script; speech is not automatically transcribed for guests. A signed browser cookie lasts up to one year. Keyed hashes of the browser identifier, network address and submitted text/file bytes support shared limits and retry detection; generic results and quota records expire after seven days and are removed by daily cleanup. After the configured guest allowance is exhausted, browser and network limits reset seven days later. People sharing a network may share the same guest allowance. Unlimited guest checks apply only when explicitly enabled for local development testing.
External providers
AI and payment providers require private configuration and the applicable processing approval. Optional guest Cloudflare AI review requires your opt-in; detected or declared patient/private information blocks that external transfer. This installation does not persist guest provider responses. Cloudflare's own processing and retention terms require separate operator review; this notice does not claim that the provider retains no data. Local development email is written to a private file directory.
Retention and deletion
Content deletion currently hides records and creates an audit request. Historical records require an operator-managed purge procedure and retention review; hiding is not erasure.