Privacy policy — Hamdosh

Hamdosh is built on a single conviction: your medical records are yours. This policy explains exactly what we collect, what we do with it, and — just as importantly — what we never do with it. It covers the website and web app at hamdosh.com and the Hamdosh apps for iPhone and Android.

What we collect

We collect only what you give us, and what we need to make the service work:

Account data: your email address and a hashed password (Argon2id; we never see the plaintext).
Family member profiles: names, dates of birth, relationships, and any allergies, conditions, or medications you choose to add.
Uploaded documents: prescriptions, lab reports, pharmacy receipts, after-visit summaries, and other health-related files you upload — including photos you add from the mobile apps’ photo scanner, or that it adds automatically if you turn that on.
Extracted data: the structured fields (medicines, doses, dates, diagnoses, outcomes) extracted from your uploads.
Operational logs: application errors and authentication events. These contain no PHI, and our server logs never record search text. Unexpected errors in the website and web app are forwarded to our error-monitoring provider (Sentry) with personal data and URL query strings stripped before sending. The mobile apps contain no crash-reporting SDK.
Analytics (with your consent): on our marketing site, if you accept the cookie banner, Google Analytics records page views and the campaign/source that brought you, so we can measure our marketing. In the web app, we record privacy-scrubbed page paths (query strings removed, record ids replaced with :id) to understand which features help. Neither ever receives your health data. The mobile apps contain no analytics or advertising SDKs.
Mobile app data: a push-notification token for each device where you turn notifications on, and, if you subscribe in the app, the App Store or Google Play purchase details described under Payments. See Mobile apps.
Your choices: a record of when you agreed to our Terms and Privacy Policy and, if you agree, to AI processing, with the version of the wording you saw.
Newsletter (optional, off by default): our newsletter is hosted on Substack. The signup form is not loaded until you explicitly click “Load subscribe form” — until then your browser never contacts Substack and no third-party cookies are set. If you choose to subscribe, your email address is processed by Substack under its own privacy policy; we never send Substack any health data.
Access audit: a per-request log of which of your own records you (or someone you’ve granted access to) viewed, edited, or exported.

We do not collect:

Browsing history outside our site or app.
Device-level location.
Contacts, photos, or files from your device beyond the documents you upload. If you use the photo scanner, the app looks through your photos on your phone; photos it checks are never sent to us unless you add them, or you have turned on automatic adding.
Your fingerprint or face data. Face ID, Touch ID and fingerprint unlock are handled by your phone’s operating system; we only learn whether unlocking succeeded.
Advertising identifiers. We do no cross-app tracking.
Analytics without your consent. The marketing site loads no analytics until you accept the cookie banner — decline and nothing third-party loads. Our newsletter signup is likewise click-to-load: nothing is sent to Substack until you choose to open the form. We run no advertising networks and never sell your data.

How we use it

We use your information for one purpose: to provide the Hamdosh service to you.

Specifically, that means:

Running OCR and vision extraction over documents you upload. Reading the text and structure out of a document image is done by a third-party GPU compute provider (Modal) that we operate on our behalf; the document image is decrypted only for that processing and is never used for that provider’s own purposes. See AI processing and Third parties for who processes your data and why.
Grouping related documents into encounters.
Surfacing your own treatment history when you search it.
Maintaining the shared reference data that keeps extraction and matching accurate for everyone — our medicine catalog, common doses, and directories of providers and pharmacies — and the aggregate usage statistics built from it. This is derived from the structured fields in uploaded documents, never sold or shared.
Sending you account-essential emails (password resets, security alerts, your own outcome-capture reminders if you’ve enabled them).
Sending push notifications you’ve turned on, such as medicine reminders. Notifications never contain health information.

We do not:

Sell your data. Not to brokers, not to advertisers, not to insurers, not to anyone.
Train external AI models on your records without explicit, per-purpose consent.
Share your data with employers, insurers, or marketers.
Use your data to “personalize ads” — there are no ads.

Storage and encryption

All PHI columns and all uploaded files are encrypted at rest with AES-256-GCM.
Per-file keys are wrapped by a master key held in environment-protected storage.
All transit between your browser or the app and our API uses TLS 1.2 or higher.
Files live in S3-compatible object storage behind signed URLs with short TTLs.

See Security for the full technical posture.

AI processing

Reading your documents and answering your questions uses AI models. We run these models ourselves on Modal, a cloud GPU computing provider that processes data on our behalf.

When you scan or upload a document, the decrypted image or PDF and the text read from it are sent to these models.
When you use Ask or smart search, your question and the relevant parts of your records are sent too.
The photo scanner’s check of your photo library is not part of this. It runs on your phone; a photo is sent only once it is added to your records.

This is used only to provide these features to you. It is not sold, not used for advertising, and not used to train external AI models. Modal processes it only on our behalf, in memory, to provide the feature, and does not use it for its own purposes.

In the mobile apps, we ask for your permission before any of this happens, the first time you scan, upload, or use Ask or smart search. If you choose Not now, those features stay off and everything else (your timeline, emergency passport, medicines, vitals, reminders, and settings) keeps working. You can withdraw your permission at any time in Me → AI & privacy; new documents then won’t be read, and your existing records stay as they are. We record when you agreed, on which platform, and which version of the explanation you saw.

AI can make mistakes. Always check what was read against the original document. You can report an Ask answer from inside the app; any note you add is stored encrypted, and reports are used only to review and improve answers.

Mobile apps

The Hamdosh apps for iPhone and Android follow the same rules as the website, plus these:

Permissions. The camera is used only when you scan a document. When you choose photos or files to upload, you pick them in your phone’s own picker. Photo-library access is needed only for the optional photo scanner; if you allow it, the app can look at the photos you give it access to, on your phone, as described below. On Android, document scanning uses Google’s ML Kit document scanner, which runs on your device; Google receives device and app diagnostics from it, never your document images. Face ID, Touch ID or fingerprint (for App Lock) is checked by your phone and never sent to us. Notifications are off until you turn them on.
What stays on your device. Your sign-in token is kept in the iOS Keychain or the Android Keystore. An emergency passport you choose to save for offline use is encrypted by the operating system and excluded from device, iCloud and Google backups. The app keeps no health data in backups and keeps no copy of your records outside that protected storage.
Push notifications. To deliver notifications we store a push token for each device, and send it to Apple (iPhone) or Google Firebase Cloud Messaging (Android). Notification text never contains health information — for example, a reminder says only that something needs your attention. Turning notifications off, or signing out, removes the device’s token.
App updates. The app checks our server for updates. The check sends the app version, platform, update channel, and a random number used for gradual rollouts — no account or health information.
No tracking. The apps contain no advertising, analytics, or crash-reporting SDKs and do no cross-app tracking.

Photo scanning (mobile apps)

The Hamdosh apps for iPhone and Android can look through your photo library for medical documents — prescriptions, lab reports, receipts, discharge summaries, insurance cards and vaccination cards — so you don’t have to hunt for them yourself. This is optional, and it works like this:

It runs on your phone. To decide whether a photo looks like a medical document, the app reads the text in it on your device: with Apple’s Vision framework on iPhone, and with Google’s ML Kit text recognition on Android, using a model built into the app that works offline. Your photos are not sent to Hamdosh, to Google, or to anyone else to be checked, and neither is the text read from them. On Android, ML Kit may send Google the same device and app diagnostics described under Mobile apps — never your photos or their text. On iPhone, photos that are stored only in iCloud are not downloaded while scanning.
Only when you use it. A scan runs when you start one, and, while access is allowed, the app does a quick check for newly added photos when you open it. The app never scans in the background.
You choose what is added. Photos that look like medical documents go to a review list in the app, and you pick which ones to add. Nothing on that list leaves your phone until you add it.
Automatic adding is off unless you turn it on. If you turn it on (the app asks you once, explicitly), photos the app is very confident are medical documents are uploaded without the review step. You can turn it off at any time; documents already added stay in your records until you delete them.
Added photos are treated like any other upload. They are encrypted and stored as described under Storage and encryption, and read by AI only under your AI processing permission.
What the app keeps on your phone. Only a list of the photos it has checked (the phone’s own photo identifiers) and how likely each one was to be a medical document, plus small previews for the review list in the app’s temporary storage. It never stores the text it read. Signing out deletes all of this, and Forget scan history in Settings clears it at any time.
Your control over access. On iPhone you can give Hamdosh access to only selected photos (Limited access), and the scanner works with just those. On Android the scanner asks for access to your photos; on Android 14 and later you can choose to allow only selected photos. You can change or remove access at any time in your phone’s settings. If you don’t allow access, the scanner is simply unavailable and every other part of the app works as usual, including choosing photos yourself in your phone’s picker.

Payments

In-app purchases (App Store and Google Play) are processed by Apple or Google. We receive the transaction identifier, product, dates, and status, plus a random account token that links the purchase to your Hamdosh account. We never receive your card details, and we never send health data to Apple or Google.
Website purchases are processed by our payment processor. We receive billing identity and payment status, never your full card number. No health data crosses this boundary.

Your rights

You can, at any time:

Access every record we hold about you, in-app.
Export your records as a single machine-readable file (gzipped JSON) covering your account, family members, encounters, and the structured data extracted from your documents. Uploaded file contents are not bundled into the export — download those individually from the app. No friction, no support ticket required.
Correct any field — most are inline-editable.
Delete your data at any granularity: a single uploaded image, one encounter, several at once, or all of your records — from the record itself or from Settings. See Deleting your data for exactly what each removes.
Delete your account entirely — in the app, on the website, or by email. See Deleting your account.
Withdraw your permission for AI processing at any time.
Turn off photo scanning, or automatic adding, and clear the app’s scan history at any time.
Audit who has accessed what. The access log is one click away.
Revoke any consent grant you’ve issued to another household member. Effective immediately.

If you’re in a jurisdiction with a specific privacy law (GDPR, CCPA, LGPD, etc.), you have additional rights under that law — and we will honor them. Contact us at the address below.

Deleting your data

We let you delete your data in pieces or all at once, and we’re precise about what each kind of deletion does — because “delete” should mean what you expect.

Deleting an image. The uploaded file is permanently erased from storage. Because we keep no hidden duplicate, you can upload the same image again later as if it were new.
Deleting an encounter, or all of your records. The encounter and everything that ties it to you — the uploaded images and the personal details extracted from them (your name, free-text notes, anything identifying) — are permanently erased. What remains is a de-identified summary of the medical facts (clinic, hospital, doctor, medications, symptoms, diagnoses, dates, prices) that contains no name, no account, and no identifier of any kind — nothing in it can be traced back to you. We keep that anonymous summary to keep the service accurate and improving for everyone (for example, our medicine catalog and provider directories); it is never sold, shared with third parties, used to train external AI models, or used to advertise to you.
Deleting your account. See below.

We will not surface a deleted record back to you, and deleting records never affects your ability to re-upload the same documents later.

Deleting your account

You can ask us to delete your account in three ways, all described on Delete your Hamdosh account:

In the app: Me → Account & data → Delete account.
On the website: Settings → Account & data → Delete account.
By email, if you can’t sign in: write to privacy@hamdosh.com from the address on your account. We verify that you own the account and complete the deletion within 30 days.

When you ask, your account is disabled and every session and device is signed out immediately. After a 30-day grace window (sign back in during it to cancel) — or at our next scheduled deletion run if you choose Delete now in the app (always within 30 days of your request) — we hard-delete your account and everything still linked to it: family-member profiles, records, uploaded files (purged from object storage), the data extracted from them, Ask history, device and notification registrations, and your privacy choices. We email you when the deletion is complete. Any de-identified summaries created earlier, from encounters you’d already deleted, carry no link to you and remain as anonymous data.

Deleting your account does not cancel an App Store or Google Play subscription; cancel it in the store.

How long we keep data

Data	How long
Your account and records	Until you delete them, or until your account is deleted (within 30 days of your request; sooner with Delete now)
Uploaded documents	Until you delete the document, its encounter, or your account
Photo-scan history (photo identifiers and scores, kept only on your phone; never the text)	Until you sign out or choose Forget scan history
Ask questions and answers	Stored encrypted. Our policy is to delete them 90 days after they are answered (automatic clean-up is being built); they are always deleted with your account
Database backups	Up to 14 days; deleted data drops out as backups rotate. Health information inside backups stays encrypted
Purchase records	As long as tax and accounting law requires; no health information, and not linked to your account once it is deleted
Security audit logs	At least 7 years; no readable health information
De-identified summaries	Kept; they have no link to you (see above)

Third parties

Reading and structuring your documents is done on our infrastructure and on a third-party GPU compute provider we use as a sub-processor, not on your device. (The photo scanner’s quick check of whether a photo looks like a medical document is the one exception: it runs only on your phone, and its result never leaves it.) In the mobile apps this happens only after you agree (see AI processing). To extract the text and fields from a document image, Hamdosh sends the decrypted image to a third-party GPU vision service (Modal — see the sub-processor table below) on every upload. There is no local-OCR fallback: if that service is unavailable the read is retried, never handed off to a lesser engine. Your uploads are encrypted (AES-256-GCM) at rest before they are written to storage, and we never sell your data or use it to train external AI models without your explicit consent.

Sub-processors

We run the hosted service on the infrastructure sub-processors below. Each stores or processes your data solely to operate Hamdosh on our behalf, only on our instructions — none receive it for their own purposes, sell it, or use it to train models.

Sub-processor	Purpose	What it holds	BAA status	Added
Cloudflare R2	Object storage for uploaded documents	Encrypted file blobs only (AES-256-GCM; Cloudflare holds no decryption key and cannot read them)	Not yet executed	2026-06-01
Hetzner	Server hosting: runs the Hamdosh API, web app and PostgreSQL database, and stores database backups	Your structured records (PHI fields are encrypted at the application layer before they reach the database); the API decrypts PHI transiently in memory to perform extraction and search — never persisted to disk in plaintext	Not yet executed	2026-09-22
Modal	Third-party GPU compute for vision OCR / extraction (and the in-app AI assistant)	Receives the decrypted document image and the extracted text on every upload, transiently in memory, to read and structure it; we self-host the models on this compute. It is not “no-view” — Modal’s compute sees plaintext during processing.	Not yet executed	2026-06-16
OpenAI	Fallback vision/text model	Not active for your data. The live path uses the self-hosted Modal models above; the OpenAI path is configured as a fallback only and is not used to process your health data in production.	Not yet executed	2026-06-16
Apple	Push-notification delivery (APNs) to iPhones; App Store in-app purchases	A device push token and notification text that never contains health information; purchase transaction details. No health data	Not applicable (no health data)	2026-09-26
Google	Push-notification delivery (Firebase Cloud Messaging) to Android phones; Google Play in-app purchases; on-device ML Kit document scanner and on-device ML Kit text recognition for the photo scanner (Android)	A device push token and notification text that never contains health information; purchase transaction details; ML Kit device and app diagnostics. No photos, document images or recognised text, and no health data	Not applicable (no health data)	2026-09-26 (ML Kit text recognition: 2026-10-02)

This sub-processor list was last updated on 2026-10-02. We will update it — with a new date — before we add, remove, or change any sub-processor.

Hamdosh is HIPAA-aligned but not yet certified, and we have not yet executed Business Associate Agreements (BAAs) with these providers. In the meantime we protect your data with application-layer encryption — AES-256-GCM at rest and TLS in transit — and putting BAAs in place is part of our path to certification.

Children’s data

Hamdosh is designed to be used by adults managing their family’s health, including their children’s. If you are adding a child’s record, you must be the child’s parent or legal guardian. Records of children under 13 are not visible to anyone other than the account holder and any consent-granted co-guardians.

We do not knowingly collect data directly from children under 13. We do not market the product to children.

Changes to this policy

We will update this policy if our practices change. Material changes will be announced in-app and by email at least 30 days before they take effect, with the prior version archived at a permanent URL.

Contact

Privacy questions, requests for access/export/deletion, or anything else covered above:

privacy@hamdosh.com

For security disclosures, see Security and email security@hamdosh.com.

Your records are yours.