Privacy Policy
Last updated: October 6, 2026
1. Who we are
SmartPrescribe is the controller of the personal data described in this policy. It is an educational and reference platform for healthcare professionals and students. It is not a medical device and is not intended for decisions about individual patients.
For any privacy question or to exercise your rights, contact info@smartprescribe.app.
2. Information we collect
- Account information: name, email, country, specialty, institution and profile photo. If you sign in with Google, we receive your name, email and photo from Google.
- Professional verification: documents you upload to prove you are a healthcare professional or student (for example a licence or diploma).
- Ask AI: the questions you ask and any files you attach. See Section 4 for how we handle them.
- Activity: game results, exam practice progress, groups, community posts and messages, event registrations, newsletter preferences.
- Payments: subscription status. Card details are handled by Stripe; we do not see or store them.
- Usage data: pages visited, device type, approximate country and a random session identifier. Our own analytics do not store your IP address.
- Push notifications: a device token, only if you enable notifications.
3. Why we use it and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide your account, Ask AI, games, courses and community | Contract (Art. 6(1)(b)) |
| Verify that you are a healthcare professional or student | Contract; legitimate interest in limiting professional content to professionals |
| Keep the service secure, prevent abuse, fix errors | Legitimate interest (Art. 6(1)(f)) |
| Our own aggregated usage statistics (no IP stored) | Legitimate interest |
| Google Analytics | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Newsletter and push notifications | Consent |
| Payments and invoices | Contract; legal obligation (tax law) |
We do not sell your data and do not use your identifiable questions to train AI models.
4. Patient information and Ask AI
Do not enter information that identifies a patient (name, health number, tax number, date of birth, address, phone). Ask AI does not need it to answer.
- Before your question leaves our servers, we automatically remove common identifiers such as names after words like “patient”, health and tax numbers, phone numbers, emails, birth dates and addresses. You will see a notice when this happens. This is a safeguard, not a guarantee: it cannot catch every name, and it does not apply to attached files.
- The cleaned question is sent to our AI and search providers (Anthropic, Perplexity) and to the public PubMed database to find evidence.
- We do not keep the text of your Ask questions or answers on our servers. We keep only usage information such as the date, language and response time.
- Attached files (PDFs, photos) are sent to Anthropic as they are. Remove patient details before attaching a document.
5. Service providers
These companies process personal data on our behalf, under contracts that require them to protect it and use it only for the services they provide to us:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | Account, profile, uploaded documents, activity | See note below |
| Vercel | Hosting and servers | All requests in transit, IP address, technical logs | Global edge network; servers may be in the USA |
| Anthropic | AI answers | Your question (patient identifiers removed), recent conversation, attachments you add | USA |
| Perplexity | Web evidence search | Your question (patient identifiers removed) | USA |
| Stripe | Payments | Name, email, billing and payment details | USA / Ireland |
| Resend | Emails and newsletter | Name, email address, email content | USA |
| Google Analytics | Website statistics (only with your consent) | Pseudonymous identifiers, pages visited, device | USA |
| Google Firebase / Apple | Push notifications (only if you enable them) | Device token, notification content | USA |
| Sentry | Error monitoring | Technical error details (email and IP removed) | USA or EU |
Supabase stores our database in the region chosen for our project; contact us for the current location. We also look up drug information in public sources (EMA, INFARMED, FDA, PubMed and others); these receive drug names or search terms, not your account details.
6. Transfers outside the EU
Some providers are based in the USA. When personal data is transferred outside the European Economic Area, we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
7. How long we keep data
- Account, profile and activity: while your account is active. When you delete your account, we delete your profile, uploaded documents, photo and account data.
- Ask AI: question text is not stored on our servers (see Section 4).
- Payment records: as long as tax law requires.
- Backups and logs: deleted data may remain in backups and technical logs for a limited period until they are overwritten.
8. Cookies and analytics
We use storage on your device that is necessary for sign-in and your preferences (such as language and country). Google Analytics runs only after you accept it in the consent banner, and you can change your choice at any time.
9. Pharmaceutical sponsors
SmartPrescribe does not sell your personal data or identifiable questions to third parties, including pharmaceutical or medical device companies. If a module is supported by a funding partner, we may report aggregated, non-identifiable metrics (e.g. completion counts, anonymised topic themes). Sponsors do not receive individual queries, chat transcripts or personal data. See our Medical Affairs policy.
We may also disclose data when required by law or valid legal process.
10. Security
Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Verification documents are stored privately and shown only through short-lived links. Access to personal data is limited to staff who need it.
SmartPrescribe is not a covered entity under US HIPAA unless explicitly agreed in a separate business associate agreement for a specific enterprise deployment.
11. Your rights
You have the right to access, correct, delete, restrict or object to the processing of your personal data, to receive a copy of it in a portable format, and to withdraw consent at any time. You can edit or delete your account in profile settings, or email info@smartprescribe.app. We reply within one month.
You can also complain to a data protection authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt); elsewhere in the EU, your local authority.
SmartPrescribe is intended for adults. We do not knowingly collect data from children.
12. Changes
We will update this page when our practices change and show the new date at the top. For significant changes we will also notify you by email or in the app.