Privacy Policy

Last updated: June 3, 2026

Information we collect

Information you provide

• Account information. When you subscribe or are added to an institutional account, we collect your email address and, optionally, your name. Your password is set and stored by our authentication provider in hashed form; we never see it.
• Institutional information. For organization accounts, we collect the institution’s name, the email addresses and roles of members an administrator adds, and the seat count.
• Payments. When you purchase a subscription, your payment is processed by Stripe. We do not receive or store your full card number. Stripe provides us with limited information such as a customer identifier, your subscription status, billing email, and the brand and last four digits of your card.
• Communications and feedback. If you contact us or submit feedback through the site (for example, the “Suggest an edit” tool), we receive the content of your message and any contact details you include.

Information collected automatically

• Usage data. We record how the Service is used — for example, which features and entries are accessed, active-session signals, and the number of AI Mode cases run. For institutional accounts, aggregated usage is shown to the institution’s administrators in their dashboard.
• Log and device data. Our hosting and infrastructure providers automatically log technical information such as IP address, browser type, device information, and timestamps, which helps us operate and secure the Service.
• Cookies. We use strictly necessary cookies to keep you signed in and to operate the Service. See “Cookies and similar technologies” and “Advertising” below.

AI Mode inputs

When you use AI Mode, the case description you enter is sent to our AI provider (Anthropic) to generate a differential and bedside-test recommendations. You are instructed not to enter patient names, identifiers, or other protected health information. We do not store your case text as part of your account; we retain only counts of AI cases for usage limits and billing. Anthropic processes the input to return a result under its own terms; see “Service providers” below.

How we use information

We use information to provide, operate, and maintain the Service; create and manage your account and subscription; process payments and prevent fraud; provide institutional usage reporting to administrators; respond to your messages and feedback; improve and develop features and content; send you service and transactional emails (such as set-password links, receipts, and important notices); and comply with legal obligations and enforce our Terms.

We do not sell your personal information.

Service providers (sub-processors)

We rely on a small set of trusted providers to run the Service. They process information only as needed to provide their services to us:

• Supabase — database hosting and user authentication
• Stripe — payment processing and subscription billing
• Anthropic — the AI model that powers AI Mode
• Resend — delivery of transactional email
• Vercel — application hosting and delivery

These providers may store and process data in the United States. We may add or change providers as the Service evolves and will keep this list current.

Advertising

The free tier of the Service may display advertisements; subscribers do not see ads. If we use a third-party advertising network, that network may set its own cookies or collect information through your browser to serve and measure ads, subject to its own privacy policy.

Cookies and similar technologies

We use cookies and similar technologies that are strictly necessary to provide the Service — primarily to maintain your signed-in session. You can control cookies through your browser settings, but disabling necessary cookies may prevent you from signing in or using parts of the Service.

How we share information

We share information only:

• with the service providers listed above;
• with the administrators of your institution, if you use an institutional account (your email, name, role, and usage are visible to your organization’s admins);
• as required by law or legal process, or to protect the rights, safety, and integrity of the Service and its users; and
• in connection with a merger, acquisition, or sale of assets, in which case we will notify you of any change in how your information is handled.

Data retention

We keep account and subscription information for as long as your account is active and as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. We keep usage records as needed for product analytics, institutional reporting, and billing. You may request deletion as described below.

Your choices and rights

You can review and update your account email and password, and you can cancel your subscription at any time. Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing.

• If you are in the European Economic Area or the United Kingdom, you have rights under the GDPR / UK GDPR.
• If you are a California resident, you have rights under the CCPA / CPRA, including the right to know, delete, and correct, and the right not to be discriminated against for exercising your rights. We do not sell or “share” personal information for cross-context behavioral advertising.

To exercise any of these rights, contact us through our Contact page or at support@bedsidedx.com. We will respond as required by applicable law and may need to verify your identity.

Security

We use reasonable technical and organizational measures to protect your information, including encryption in transit and storage of passwords in hashed form by our authentication provider. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Children’s privacy

The Service is intended for licensed clinicians, trainees, and other adult healthcare professionals. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, please contact us and we will delete it.

International users

We are based in the United States and process information there. If you access the Service from outside the United States, you understand your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy.

Contact us

Questions about this policy or your information? Contact us through our Contact page or at support@bedsidedx.com.

This Privacy Policy works together with our Terms of Service and Medical Disclaimer.