Privacy policy
GraphCura helps you organize and understand your medical records. This policy explains what we collect, why, who processes it on our behalf, and the choices you have. If anything is unclear, email rchakrabarti@graphcura.com.
Who we are
GraphCura is responsible for the information described here. For any privacy question, request or complaint, contact us at rchakrabarti@graphcura.com. We reply within 30 days.
What we collect
- Account details: your email, name, role (patient or doctor) and, if you add them, address and profile details. Passwords are stored scrambled, so no one can read them, not even us.
- Documents you upload: the files themselves and the text, dates, medications, diagnoses, lab results and vital signs read from them.
- Conversations: the questions you ask, the answers you receive and the sources cited.
- Connected services: if you connect Google Calendar, permission to add events to it and that Google account's email.
- Consent records: when you created your account and agreed to our terms and to us processing your health information, with the internet address and browser used.
- Usage data: anonymous page-speed measurements and reports when something breaks.
Your consent to health information
Medical records are sensitive. We only process your health information because you explicitly agreed to it when you created your account. You can withdraw that consent at any time by deleting your documents or your account; we then stop processing them.
We never sell your data, and we never use it for advertising.
How we use it
- To build your health timeline, charts and summaries, and to answer your questions.
- To create calendar events or email reminders when you ask for them.
- To let a doctor view your history, read-only, while there is an active consent link between your accounts.
- To keep the service secure, investigate problems and improve reliability.
We do not show your records to other users, and patients can only ever access their own records.
Who processes your data
We use the following services to run GraphCura. They process data only to provide their service to us.
| Service | Purpose |
|---|---|
| Vercel | Running the website and app; anonymous page-speed measurements; anonymous visit counts on the public pages |
| Supabase | Your account, details about your documents, the health information read from them, and your chats |
| Amazon Web Services (S3) | Storing the files you upload |
| LlamaIndex (LlamaParse, LlamaExtract) | Reading the text in your documents, scans and photos, and picking out the health details |
| Cloudflare Workers AI | AI that sorts your documents, groups your conditions and writes answers |
| Jina AI | Preparing your document text so it can be searched |
| Pinecone | Searching your documents to answer your questions |
| Cohere | Picking the parts of your documents that best answer a question |
| Neo4j | Linking your conditions, medicines and results to each other |
| Upstash | Short-term storage that keeps the app fast, and scheduling work in the background |
| Google Gemini | Turning recordings into text for doctors' voice features |
| Tavily / DuckDuckGo | Web search, only when you turn it on (your question text only) |
| Signing you in if you choose Google; calendar events if you connect Google Calendar; sending email | |
| Sentry | Telling us when something breaks |
How we protect it
- Your records are kept inside your own account. Other users can never see them.
- Files go directly from your device into secure storage. Upload links stop working after 15 minutes, and links for viewing a file after an hour.
- Your sign-in is protected so that other websites can't take it over.
Read more on our security page.
How long we keep it
We keep your data while your account is active. When you delete a document we delete the file and everything read from it, and remove it from search and from your history. Copies may stay in our providers' backups for a short time until those backups expire.
Deleting your account
Email rchakrabarti@graphcura.com from the address you signed up with and ask us to delete your account. We'll confirm it's you, then delete your account, documents, chats and everything read from them within 30 days.
Your rights and choices
- Delete individual documents, or all of them, from the Documents page.
- Disconnect Google Calendar at any time from your account menu.
- Ask us for a copy of your data, to correct it, or to delete your account.
- Withdraw your consent at any time, as described above.
- If you're unhappy with how we handle your data, you can complain to your local data protection authority.
Children
GraphCura is only for people 18 or older. We don't knowingly collect information from children. If you believe a child has created an account, email us and we'll delete it.
Cookies
We only use essential cookies and on-device storage, for signing in and remembering your settings. No advertising or tracking cookies. See the cookie policy for the full list.
Not medical advice
GraphCura organizes and explains your records. It does not diagnose or treat, and it is not a substitute for advice from a qualified clinician.
Changes
If we change this policy we will update the date above and, for significant changes, let you know.
Contact
Questions or requests: rchakrabarti@graphcura.com.