Medical Wizard
Consumer Health Data Privacy Policy
Effective August 17, 2026 · Version 2026-08-17
This policy supplements the Medical Wizard Privacy Policy and describes our consumer health data practices, including disclosures under Washington’s My Health My Data Act and similar laws.
Categories and sources
We may process health conditions, diagnoses already present in source records, medications, allergies, immunizations, procedures, labs, vitals, clinical notes, and other information that identifies or can reasonably be used to infer health status. Sources are you; records you authorize Apple Health to provide; files, images, scans, and archives you select; and AI outputs derived from those inputs. We also receive device-authentication and subscription status needed to secure the service.
Purposes and consent
We use consumer health data only to provide features you request: import and organize a local case file, extract structured information, answer grounded questions, generate source-linked explanations, maintain security, and comply with law. We do not sell consumer health data or use it for advertising, marketing, or unrelated profiling.
Local importing and organization require the Apple Health or file access you choose. Off-device AI processing requires a separate affirmative choice in the app. We seek additional consent before a new category or materially different purpose where law requires it.
Data shared and why
- Cloudflare runs our stateless relay.
- Anthropic and OpenAI process inputs and outputs for requested AI analysis.
- Apple supplies records you authorize and provides device-attestation and commerce services.
- Regulators, courts, law enforcement, advisers, or transaction counterparties receive data only when legally required or reasonably necessary to protect rights, safety, and the service, subject to law.
Cloudflare, Anthropic, and OpenAI are the named third parties that may receive consumer health data. Their subprocessors may assist under published processor terms. We do not share this data with data brokers.
Retention
The case file remains on your iPhone until you delete it or the app. Our relay does not persist request or response content. Anthropic standard API inputs and outputs are deleted within 30 days, subject to longer legal or usage-policy exceptions. OpenAI API abuse-monitoring content is retained for up to 30 days by default, subject to legal exceptions; provider application state may also exist for a feature’s stated period. Support and rights-request records are kept only as reasonably needed to respond, document compliance, resolve disputes, or meet legal requirements.
Your rights
Subject to applicable exceptions, you may ask us to confirm processing; access, copy, correct, or delete consumer health data; withdraw consent; or receive a list of third parties or affiliates with which it was shared where law requires.
The fastest local deletion path is Settings > Delete everything. To exercise a right involving us or a processor, email justin@humanr.ai with “Consumer Health Privacy Request” in the subject. We may reasonably authenticate the request. Authorized agents may submit requests where allowed after proving authority.
If we deny a request, reply “Appeal” and explain why. We will respond within the legally required period. If a Washington appeal is denied, you may contact the Washington Attorney General. We will not unlawfully discriminate against you for exercising a privacy right.
Changes and contact
We post changes here with a new effective date; material changes may require new in-app acceptance or consent. Contact Human Renaissance Corporation, Los Angeles, California, United States, at justin@humanr.ai.