Privacy Policy

A short clinical dictation describing the clinical picture in general terms, and the form type you want generated. We ask you not to include patient names, dates of birth, medical record numbers, addresses, phone numbers, insurance IDs, or any other direct patient identifiers. See "'No PHI' is a policy, not a technical guarantee" in our legal page for the important caveat about quasi-identifiers.

To sign in we store an email address and a display name of your choice. We do not collect NPI, state license number, DEA, or any other professional credential. The email is used only for authentication and, if you opt in, occasional product updates.

Your dictation is sent through our server to a third-party language model provider to produce the requested draft. The response is returned to your browser. We do not persist dictations or generated drafts in our own database and do not build a per-user history of past generations.

Your content is not used to train, fine-tune, or evaluate any model — ours or a third party's.

To keep the service reliable and to prevent abuse, we keep short-lived operational logs: timestamps, request status, error codes, and coarse rate-limit counters keyed to your account. These logs are not designed to contain dictation content. They are rotated and deleted on a rolling basis.

• Google — language model (Gemini family) used to generate the draft, routed through the Lovable AI Gateway.
• Cloudflare — edge hosting and serverless request handling.
• Lovable Cloud (Supabase) — authentication and account storage.

Model or infrastructure providers may change as the product evolves. We will update this list when they do.

Any Medical Form is not currently offered under a BAA. Because the product is designed so that PHI is never required and is not knowingly collected, stored, or transmitted, we do not function as a business associate. If your compliance office requires a signed BAA before any clinical content may be sent to a third-party model, do not use this tool in that workflow.

We use a small number of first-party cookies and local-storage keys strictly required to keep you signed in and to remember your theme. We do not run third-party advertising trackers. We may use privacy-respecting product analytics (page views, feature usage counters) that are not tied to dictation content.

You may delete your account at any time by contacting us; this removes your email and display name from our systems. Because we do not persist dictations or drafts, there is nothing further to export or delete on that side.

Privacy or security questions: reach us via the contact channel listed in the app footer. For security-report handling, see the Security Contact section on the Legal & disclaimer page.