Privacy Policy

1. Introduction

SteadyCare ("we", "our", "us") is committed to protecting your privacy. This policy explains how we collect, use, store, and protect your personal and health information when you use our personal health record service.

Given the sensitive nature of health data, we have designed SteadyCare with privacy as a core principle. We collect only what is necessary to provide the service and give you full control over your data.

2. Information We Collect

2.1 Account Information

• Email address (for authentication and communication)
• Password (stored securely using industry-standard hashing)
• Name (optional, for personalisation)

2.2 Health Information You Provide

You may choose to store the following types of health information:

• Doctor visits and appointment details
• Clinical requests (lab orders, imaging requests)
• Medical reports and documents (PDFs, images)
• Lab results and values
• Symptoms and personal health notes
• Audio recordings of appointments
• Medication and treatment plans

2.3 Automatically Collected Information

• Device and browser information (for security and compatibility)
• IP address (for security and fraud prevention)
• Usage patterns (pages visited, features used)

3. How We Use Your Information

We use your information solely to:

• Provide the Service: Store, organise, and display your health records
• AI Processing: Extract data from documents and generate summaries when you request these features
• Generate Insights: Calculate trends and visualise your health data over time
• Communicate: Send service-related emails (account verification, important updates)
• Improve the Service: Analyse aggregated, anonymised usage patterns
• Security: Detect and prevent fraud or abuse

4. Data Sharing

4.1 We Do NOT:

• Sell your personal or health data to anyone
• Share your data with advertisers or marketing companies
• Use your health data for purposes other than providing the Service
• Share your data with other users

4.2 Third-Party AI Services

When you use AI-powered features (document extraction, summaries), your data is sent to our AI provider (currently OpenAI) for processing. This is necessary to deliver these features.

• Data is transmitted securely via encrypted connections
• We use OpenAI's API with data processing agreements in place
• OpenAI does not use your data to train their models (per their API data usage policy)
• You can choose not to use AI features if you prefer

4.3 Other Limited Sharing

We may share data only when:

• Required by law (court order, legal process)
• Necessary to protect safety or prevent fraud
• You explicitly request an export to share with others

5. Data Security

We implement multiple layers of security to protect your health data:

• Encryption at Rest: Sensitive medical narratives (visit notes, transcripts, AI summaries) are encrypted in our database
• Encryption in Transit: All data transmitted between your device and our servers uses TLS encryption
• Secure Authentication: Passwords are hashed using bcrypt; we support secure session management
• Access Controls: Your data is accessible only to you; our staff cannot view your health records without your explicit permission
• Regular Backups: Your data is backed up regularly to prevent loss

6. Data Retention

• Active Accounts: We retain your data for as long as your account is active
• Cancelled Subscriptions: Your data remains accessible; you can reactivate or request deletion
• Deletion Requests: Upon request, we permanently delete all your data within 30 days
• Backups: Deleted data may persist in encrypted backups for up to 90 days before being purged

7. Your Rights

You have the right to:

7.1 Access Your Data

All your data is visible within the app. You can view everything we store about you at any time.

7.2 Export Your Data

You can export all your health records in standard formats (PDF, JSON) at any time from the app.

7.3 Correct Your Data

You can edit or update any information you have entered.

7.4 Delete Your Data

You can request complete deletion of your account and all associated data by contacting us at [email protected]. We will process deletion requests within 30 days.

7.5 Withdraw Consent

You can stop using AI features at any time. You can close your account at any time.

8. Cookies and Tracking

We use minimal cookies required for the service to function:

• Session Cookies: Keep you logged in (essential)
• Security Cookies: Prevent cross-site request forgery (essential)

We do not use advertising cookies or third-party tracking pixels.

9. Children's Privacy

SteadyCare is not intended for use by anyone under 18 years of age. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us immediately.

10. International Data Transfers

Our servers are located in Australia. If you access SteadyCare from outside Australia, your data will be transferred to and processed in Australia. Our AI provider (OpenAI) may process data in the United States.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes via email or through a prominent notice in the app. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact Us

For privacy-related questions, concerns, or to exercise your rights:

• Email: [email protected]

For general support: [email protected]

13. Regulatory Information

SteadyCare is a personal health record tool, not a medical device. We are not a HIPAA-covered entity (US) or subject to the My Health Records Act (Australia) as we are a personal tool, not a healthcare provider. However, we voluntarily adopt strong privacy practices consistent with the Australian Privacy Principles (APPs) under the Privacy Act 1988.