Privacy Policy

Personal Information:

• Account information (email, name, profile data)
• Contact information for support requests
• Usage analytics and application logs

Medical Information:

• Uploaded medical documents and records
• AI analysis results and condition identifications
• Generated personal statements and claim documentation

Purpose Limitation:

• Analysis Only: We process your medical documents solely to identify potential claims and evidence.
• No Sale of Data: We never sell, rent, or trade your personal information to third parties.
• Service Improvements: Aggregated, anonymized metadata (e.g., "how many pages processed") may be used to improve system performance, but never content.

Data Retention & Deletion:

• User Control: You can delete individual documents from your dashboard, clear claim contents from Settings, and delete your whole account from Settings.
• You Decide When: Delete Account Data in Settings runs immediately, while you wait. Your documents, extracted text, analysis, generated forms and chat history are removed from our active systems and the deletion is verified before it is reported complete. There is no waiting period. Your sign-in and purchase record are kept so you can return to an empty account.
• Removing Your Sign-In: If you also want your sign-in removed, use Remove my sign-in in Settings, under Delete your data, when it shows there. It deletes your data, then removes your sign-in, and your paid access ends for good. Or email us a verified deletion request and we complete it within 30 days.
• Recovery Copies and Backups: Our cloud storage provider keeps deleted files in an encrypted, non-accessible recovery state for up to 7 days before they are gone for good. Residual copies in encrypted backups are overwritten on our normal backup rotation.
• Legal Holds: We may retain limited records where required to comply with law, resolve disputes, or enforce our agreements.
• Encryption: Data is encrypted in transit (TLS) and at rest by our cloud provider using industry-standard AES-256 encryption.

We use a small set of trusted providers to operate the service. These providers process data only on our behalf and under contractual confidentiality and security obligations; they do not use your data for their own purposes.

• Google Cloud / Firebase: hosting, authentication, database, encrypted file storage, and AI model processing (Vertex AI). Sensitive processing occurs within a Business Associate Agreement (BAA) boundary.
• Anthropic (Claude) & Google (Gemini), via Vertex AI: the AI models that analyze your documents and power chat. Under our agreements, your inputs and outputs are not used to train these models.
• Stripe: payment processing. Your full card details are handled by Stripe and are never stored on our servers.
• Neo4j (Neo4j Aura): the graph database that links your conditions, evidence, documents and dates so AVA can build your claim overview.
• Twilio SendGrid: email delivery for support replies, account notices and the updates you have not turned off. Click and open tracking are turned off on every email we send.

We never sell, rent, or trade your personal information. We disclose data only to these providers, as needed to provide the service, or when required by law.

Depending on where you live (including under the California Consumer Privacy Act and the EU/UK GDPR), you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. We honor these rights regardless of your location.

• Access and export the data we hold about you
• Correct inaccurate information
• Delete your documents or your entire account
• Withdraw consent or object to processing

To exercise any of these rights, use your dashboard or Settings, or email us at the address below. We will not discriminate against you for exercising your privacy rights.

We use essential cookies and similar technologies to keep you signed in and to keep the service secure, plus limited, privacy-respecting analytics to understand aggregate usage (for example, how many pages were processed). We do not use your medical content for advertising.

AVA Agent is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from anyone under 18.