Privacy Policy

Medipher is operated by the Medipher team (contact: hello@getmedipher.com). For the purposes of UK GDPR, we are the data controller for information collected through this website.

• When you paste text into the Explain tool, that text is sent to an AI provider so it can produce a plain-English summary. We do not save your pasted text or the AI's reply in our own database.
• If you sign up to a waitlist, submit feedback or contact us, we store the information you gave us (typically your email address and message) so we can reply or notify you.
• We do not sell your data. We do not use it for marketing profiling. We do not knowingly collect information from children under 13.

Depending on how you use Medipher, we may process:

• Text you paste into the Explain tool. This may include sensitive information from medical letters, test results, discharge summaries or prescriptions. Only paste what you are comfortable sharing.
• Email address — if you join a waitlist or contact us.
• Feedback content — if you rate or comment on an explanation or a guide.
• Basic technical data — the request information that any website receives (IP address, browser type, referrer, timestamps) used for security, abuse prevention and aggregated traffic measurement.

After an explanation is generated, you can choose to answer a few short multiple-choice questions. We store only your selected answers: whether the explanation helped you understand your information (yes, somewhat or no), which experience options you ticked (for example "still too technical" or "I had a privacy concern"), whether you would consider using Medipher again, and whether it was clear that Medipher does not diagnose or recommend treatment. We also store the date and time it was sent.

This feedback has no free-text box. Please do not send personal medical information through feedback or support messages. The feedback record does not include the text you pasted, the explanation, your name, email address, account, analytics or session identifiers, and we do not deliberately store your IP address with it. It is not linked to an identifiable account. Our hosting providers may still keep standard technical request logs, as described under "Data retention".

We use this feedback only to improve the clarity, trust, usability and quality of Medipher. It is not sent to Google Analytics. Feedback answers are kept for up to 24 months, then deleted or anonymised. Questions about privacy? Email hello@getmedipher.com.

We sometimes invite people to take part in a short anonymous research survey, "Understanding Medical Information". Taking part is voluntary and for adults aged 18 or over. We store only your multiple-choice answers, your optional age band and digital-confidence answer, the date you submitted it and, if you arrived through a Medipher campaign link, a broad source label such as "LinkedIn". The survey does not ask for your name, email or any medical information, has no free-text boxes and is not linked to an account. We do not deliberately store your IP address with your answers. Survey answers are not sent to Google Analytics.

If you separately choose to volunteer for an interview or usability session, we store your first name, email address, preferred research type, optional broad availability, the time you gave consent and the status of our contact with you. These details are held separately and are not connected to your survey answers. We use them only to arrange Medipher research.

We use anonymous survey responses only for Medipher product and user research. Survey responses are kept for up to 24 months, after which they are deleted or retained only in aggregated form.

If you separately volunteer for an interview or usability session, we use the contact details you provide only to arrange and manage Medipher research, based on your consent. Volunteer details are kept for up to 24 months unless you ask us to delete them sooner.

Our hosting providers may still keep standard technical request logs. Contact hello@getmedipher.com with any privacy question or request relating to your volunteer details.

Adults aged 18 or over may choose to complete a voluntary self-guided study using one fixed fictional medical letter. We ask for task answers, ratings, written feedback, optional age band, digital confidence and device category, consent confirmation and the submission time. We generate a random internal response ID. We do not ask for names, emails, real medical information or files, and do not link these answers to volunteer records, surveys, Explain feedback, accounts or analytics identifiers.

Responses are collected without asking for identifying information; this is not a guarantee of absolute anonymity. Hosting providers may retain IP addresses and other technical/security request logs. The historical diagnostic-capture investigation remains open; forwarding, retention and historical cleanup have not been fully established.

No Google Analytics tracking runs on the study page or on the task tabs opened from it. The task links set a non-identifying, tab-only tracking-off preference; ordinary site visits in other tabs continue to follow your cookie choice. The fictional letter is processed by the usual Explain service and its AI providers, not stored as part of the research response.

Only completed studies are saved, separately, for product research and manual founder review. You may stop before submitting and your unsent answers will not be saved. Responses are kept for up to 24 months, then deleted; deletion is a manual founder process, not an automated retention job. Founder access and exports require server-verified authentication. Exported copies must also be removed under this retention process.

To ask about deletion or raise a privacy concern, contact hello@getmedipher.com. As answers have no name or email attached, we may be unable to identify your particular response after submission; please do not send medical information to identify it.

When you use /explain, the text you paste is sent from your browser to our server and then forwarded to an AI provider (see "AI providers" below) to generate a plain-English explanation. The AI's response is returned to your browser.

We do not persist your pasted text or the AI's response in the Medipher database. Once your browser session ends, the copy on our side is gone. However, the AI provider will process the text on their systems in order to generate the response. Please read the "AI providers" section below to understand what that means.

Medipher's plain-English explanations are generated by large language models accessed through the Lovable AI Gateway, which routes requests to third-party AI providers (currently including Google Gemini and OpenAI models). The specific model used may change as we improve quality and safety; see our AI Transparency page for the current setup.

We ask AI providers not to use your inputs to train their models. We cannot independently guarantee provider-side settings such as "Zero Data Retention" from within our current stack. Where we cannot guarantee something, we say so — please see the AI Transparency page for what is and is not currently true.

By using the Explain tool you consent to your pasted text being processed by these providers for the sole purpose of returning your explanation.

• Consent — for the Explain tool, waitlist sign-ups and feedback forms. You choose to submit the information.
• Legitimate interests — for basic security logging, abuse prevention and aggregate service metrics.
• Legal obligation — where we must retain limited records to comply with UK law.

Medical information can be "special category" data under UK GDPR Art. 9. Where such data is included in what you paste, we process it on the basis of your explicit consent given by your action of pasting and submitting it.

• Pasted text and AI responses: not stored by Medipher.
• Waitlist emails: kept until you unsubscribe or ask us to delete them.
• Feedback: kept for up to 24 months, then deleted or anonymised.
• Transactional email logs: kept for up to 12 months for deliverability and abuse handling.
• Technical/security logs: kept for up to 30 days unless needed for an active investigation.

Medipher uses essential cookies and local storage needed to run the site and remember your preferences. With your permission we also use Google Analytics to understand how the site is used; it is denied until you accept it, and you can change your choice at any time with the "Cookie settings" link in the footer. We do not intentionally send analytics the medical text you paste into Explain, the explanations we generate, or your written feedback. We do not run marketing or advertising trackers. See our Cookie Policy for details.

• Lovable — application hosting, database and email queue.
• Lovable AI Gateway — routes AI requests to model providers.
• Google, OpenAI — underlying AI model providers (subject to change).
• Cloudflare — network and edge delivery.

Each of these providers processes information on our behalf under their own terms and security controls.

Some of our providers process data outside the UK, including in the European Economic Area and the United States. Where data leaves the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or a country's adequacy decision.

You have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to erase your data (subject to legal exceptions).
• Restrict or object to certain processing.
• Withdraw consent at any time, including unsubscribing from emails.
• Ask for a portable copy of data you have provided.
• Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any right, email hello@getmedipher.com. We aim to respond within 30 days.

Medipher is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

We use technical and organisational measures appropriate to the risk, including HTTPS in transit, access controls on stored data, and row-level security on our database. No service on the internet is 100% secure — please avoid pasting information you do not want to share.

We may update this policy as Medipher evolves. Material changes will be reflected in the "last updated" date at the top of the page.

Questions about this policy or your data? Email hello@getmedipher.com.