Privacy policy

Last updated 13 September 2026. A summary of how pocketVitals handles your health information.

What pocketVitals is, and why we process your data

pocketVitals is a personal health record app. Its purpose is to help you keep your own medical information in one place: you upload your medical documents and record your dialysis and vitals, and the app turns them into structured, trended data and lets you ask questions about your own record. To do that, we have to collect and process health information, that is the whole point of the service, and it is why we ask for your agreement below. This page explains what data we hold, what we do with it, who else touches it, and your choices. By creating an account and ticking the consent box, you agree to the processing described here.

What we collect

Account details: your name, email, date of birth, and sex. If you choose to sign in with your mobile number, or add one to your account, we also store that number and whether it has been confirmed.

Health information (sensitive personal data): the documents you upload (lab reports, discharge summaries, imaging reports), the values extracted from them, your dialysis sessions and vitals, your medical profile (blood group, allergies, medications, and health conditions), lifestyle information (such as smoking and alcohol use), the emergency contact details you choose to add (another person’s name and number, which you should only add with their agreement), and the questions you ask the assistant. We treat this as sensitive and handle it accordingly. If you switch on WhatsApp uploads, a report you forward to our WhatsApp number becomes one of these records, and we store the message identifier and your number so the same report is not filed twice. We do not store the text you type alongside it.

How your documents and questions are processed (please read)

To turn a document into structured data, and to answer your questions, we send the relevant content to Anthropic’s Claude, an outside AI service, which processes it and returns the result. This means:

• Your document contents and record data are transferred to and processed by Anthropic, including on servers outside India (in the United States).
• Extracted values are shown to you as a draft you must reviewagainst the original before they become part of your record. Automated extraction can make mistakes, and you are the one who confirms or corrects each value.
• The assistant answers only from your own record and can explain what a test is in general terms, but it does not interpret your specific results, diagnose, or give medical advice.

Not medical advice

pocketVitals presents facts from your records and general information only. It is not a medical device, not a diagnosis, and not a substitute for professional medical advice. Always rely on your doctor to interpret your results and decide on any care. Do not use this app for medical emergencies.

Who processes your data

We use these service providers to run the app, and only for that purpose:

• Anthropic, PBC (the “Claude” AI service), processes document contents and record data to extract values and answer your questions, on servers in the United States.
• Amazon Web Services, hosts the app, stores your records and files, and sends account emails (such as email verification, password reset, and security notifications) via Amazon SES, in the Mumbai (India) region.
• Meta Platforms (WhatsApp), delivers your sign-in code if you sign in with your mobile number, and carries any report you choose to forward to our WhatsApp number. Meta handles those messages on servers outside India.

Where your data is stored, and cross-border transfer

Your records and uploaded files are stored in encrypted cloud storage in the Mumbai (India) region. Your data leaves India in two situations. The first is the AI processing described above: to extract from a document or answer a question, the relevant content is sent to Anthropic in the United States, processed, and the result returned. The second is WhatsApp, and only if you use it. The message carrying your sign-in code passes through Meta’s servers outside India; that message contains a code and nothing about your health. If you switch on WhatsApp uploads in Settings, a report you forward to our number also passes through Meta before it reaches us. WhatsApp uploads are off unless you turn them on, and we record when you did. We do all of this only to provide the service, and only with your consent.

How long we keep it

We keep your records for as long as your account is active, so your history and trends stay available to you. You can delete individual sessions, documents, and values at any time; when you ask us to close your account, we delete your data (backups may take a short time to cycle out). Note that a correction keeps the prior version for accuracy and audit, while deleted items leave your active record and trends.

How we protect it

Your files are encrypted at rest, access to your record requires you to be signed in, and each person’s data is scoped to their own account. This is a small app under active development, not a hospital system, we describe our security honestly rather than overstate it.

Who we share it with

We do not sell your data or use it for advertising. We share it only with the infrastructure and AI providers needed to run the service (our cloud host and Anthropic, as described above), and only to provide the app to you.

Sharing you choose: you can generate a temporary link to show your emergency card to a doctor. Anyone with that link can view your emergency card until it expires (30 minutes) or you revoke it. That sharing happens only when you choose to create a link, and you can revoke it at any time.

Family sharing: you can create a family in the app or accept an invitation to join one. Within a family, a record is shared only when its owner chooses to share it, and only with the family members they choose, as view only or with permission to add and correct entries. A family admin can keep records on behalf of people who do not use the app themselves, such as a child or an elderly parent, and can share those records with other family members; the admin is responsible for that person’s data. Every time someone views or changes a record that is not their own, we log who did it and when, and the record’s owner can see who has access and withdraw it at any time. Joining a family, sharing a record and accepting access each ask for your explicit agreement, which we record. Family invitations are sent by email and carry only the inviter’s first name and the family name. The AI questions feature works only on your own record.

Your choices and rights

It’s your data. You can:

• See and correct it, view every value and its source, and edit or correct anything, in the app.
• Download it, export a copy of all your data as a file from Settings.
• Delete it, remove individual sessions, documents, and values, or delete your account and all your data from Settings.
• Withdraw consent, you can stop using the AI features by not uploading documents or asking the assistant, and you can ask us to close your account. Withdrawing consent doesn’t undo processing that already happened.

To exercise any of these, contact us at the address below.

Cookies

pocketVitals uses only essential cookies, the ones needed to keep you securely signed in and to protect the service. We do not use advertising cookies, tracking pixels, or third-party analytics that follow you around the web, so there is no consent banner to click through. If we ever add anything non-essential, we will ask for your agreement first.

Contact

Questions about this policy or your data: [email protected].

We may update this policy; the version and date at the top will change when we do.