Privacy policy

1. Who is responsible for what

• Doctors and admins. We are the data fiduciary for the account data of the doctors and admins who use MindcrestAI.
• Patients. Patients never sign in. Each doctor decides what patient data to record and why, and is the data fiduciary for it. We process patient data only on the doctor's instructions, to provide the service.

2. What we collect

• Doctor and admin accounts: name, email, phone, organisation, designation, specialty, registration number, city and country, plus the name, email and photo from your Google account.
• Patient records, entered by the doctor: name, contact details, date of birth, gender, emergency contact, clinical history, notes, uploaded documents, session events, audio recordings, transcripts, AI analyses and risk scores, and AI chat conversations about the patient.
• Activity: an audit log of actions taken in the app, with the time, IP address and browser.
• Cookies: one sign-in session cookie, and your theme choice kept in your browser. We don't use advertising or analytics cookies.

3. Google account data

You sign in with Google. With your permission, MindcrestAI also uses the Google Calendar scope calendar.events to:

• add, update and remove the events you schedule in MindcrestAI, including their titles and reminders, on your primary calendar;
• read your other calendar events so the MindcrestAI calendar can show when you are busy. These are shown to you and are not stored.

Google tokens are encrypted at rest. MindcrestAI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide these features; we don't sell it, use it for advertising, or use it to train AI models, and people can read it only with your consent, for security, or where the law requires. You can revoke access at any time from your Google account permissions.

4. How we use data

• To run the service: sign-in, records, scheduling, calendar sync and email invitations.
• To transcribe session recordings, draft analyses and notes, and answer questions about a patient's record. AI output is decision support; the doctor reviews it and decides.
• To keep the service secure, investigate misuse and keep an audit trail.

We don't sell personal data, show advertising, or use patient data to train AI models.

5. Service providers

We share data only with the providers that run the service, under contracts that limit their use of it:

• Vercel: application hosting.
• MongoDB Atlas: database.
• Amazon Web Services (S3, Sydney region): storage for recordings, transcripts and documents.
• OpenAI: transcription, analysis, chat and search over the patient's record. Under OpenAI's API terms, this data isn't used to train their models.
• Resend: sign-in invitation emails.
• Google: sign-in and Calendar.

These providers may store or process data outside India, including in Australia and the United States, as the DPDP Act permits. We may also disclose data where the law requires it.

6. Security

Data is encrypted in transit and at rest. Files are reached only through short-lived signed links. Each doctor sees only their own patients, admins don't see patient clinical records, and every change is written to an audit log.

7. How long we keep data

We keep data while the doctor's account is active, or as long as the doctor needs it to provide care and meet their own record-keeping duties. Deleting a session deletes its recording, transcript and analysis; deleting a chat deletes its uploads. When an account closes, we delete or return its data on request, except where the law requires us to keep it.

8. Your rights

Under the DPDP Act you can ask to access, correct or erase your personal data, nominate someone to act for you, and raise a grievance. Doctors and admins can write to us directly. Patients should contact their doctor first, since the doctor controls their record; we will help the doctor respond.

9. Children

Patients under 18 are recorded only by their doctor, who is responsible for obtaining verifiable consent from a parent or lawful guardian.

10. Changes and contact

We will post changes on this page and update the date above. For questions, requests or grievances, write to our grievance officer at privacy@mindcrestai.com. If you are not satisfied with our response, you can complain to the Data Protection Board of India.