Privacy Policy

The Short Version

• We keep what you enter, to show it back to you and the people you choose. That's all it's for.
• We don't sell your information, show you ads, or use it to train AI.
• Who sees what is set by you and enforced by the database: you, the helpers you invite, and anyone you send a link to.
• A few companies help us run the service (hosting, storage, email, and reading photos and PDFs you choose to have read). They may use your information only to do that work for us.
• You can change or delete what you've entered at any time, and delete your account.
• VeteranRecord keeps records. It doesn't give medical advice, diagnose, or tell you what's due.

Who We Are

VeteranRecord is run by [company legal name] ("we", "us"). Contact us at [privacy email address] or [mailing address].

We are not a doctor, clinic, hospital or health plan. That means the federal health privacy law (HIPAA) generally doesn't apply to what you put in VeteranRecord. We protect it as this policy describes and as state laws such as Washington's My Health My Data Act require.

What We Collect

What You Enter

• Your account: name, email address and password. The password is stored only in scrambled (hashed) form by our login provider; we never see it. If you turn on two-step login, the setup for your authenticator app.
• Your profile: phone number, address and preferred way to be contacted.
• Your helpers and contacts: the helpers you invite (name, email, phone, relationship, access level, and any set time they may use the app), and your emergency contacts. Emergency contacts are other people's names and phone numbers: please only add people who are happy to be listed.
• Your health record: name, date of birth, blood type, doctor; allergies; health conditions; vaccines; illnesses and injuries with check-ins (temperature, pain, symptoms, notes); medicines, the times you give them and every dose recorded; height, weight and other measurements; lab, imaging, dental and other records; notes.
• Photos and files you add: vaccine cards, doctor's notes, test results, insurance card photos and other paperwork. Photos are shrunk on your device before upload, which also removes hidden location details.
• Insurance: provider, policy and group numbers, policyholder, who's covered, card photos.
• Appointments and reminders: appointments you add (when, the doctor or clinic, address, phone and notes), and reminders you set.
• Feedback: your votes on features we're considering, and messages you send us through Send feedback, with your name and email address so we can reply.

What We Record as You Use It

• When you sign in, and whether you used two-step login (your sign-in history, which you can see in Settings).
• The devices you're logged in on: the kind of device and browser (from what your browser tells websites), when you logged in and when you last used it. Only you see them, in Settings → Signed-In Devices, where you can log out of the others.
• Who added, changed or removed something in your records, and when, with the name of the item (such as “Amoxicillin”) but never what was written in it. You and your helpers see this in Settings → History; anything about an entry you marked private shows only as “Private entry” to helpers.
• For links you make to share a summary: when it was made, when it stops working, and how often it was opened.
• Our hosting providers keep short-lived technical logs (such as IP address, browser type and the time of a request) to keep the service running and secure.

What We Don't Collect

• No advertising or tracking cookies, and no analytics that follow you around the web.
• No precise location. We don't ask for it, and photo location details are removed before upload.
• Nothing from your phone's contacts, other apps or health apps.

What Stays on Your Device

• A cookie that keeps you logged in. VeteranRecord doesn't work without it, and it isn't used for anything else.
• If you tick "shared or public computer" when logging in: two more cookies, which end the login when the browser closes or after 15 minutes without use. They're deleted when you log out.
• If you install VeteranRecord on your home screen, copies of pages you've opened, so you can see them without a signal. They're deleted when you log out. Shared links and login pages are never saved.
• A note that you closed the "Install the app" card, so it doesn't come back.
• If you turn on app lock: a scrambled version of your PIN (never the PIN itself) and, if you use Face ID or a fingerprint, a key your device keeps for it. They stay on that device and are removed when you log out. Your face or fingerprint never reaches us.
• If you turn on alerts for a device: the browser's alert address for it, which we keep so we can send you medicine times, doses given, reminders and refill dates. Logging out or turning alerts off stops them.
• If you turn on email reminders: which kinds you chose (reminders, refill dates), whether to hide details, and your time zone, so a 9:00 AM email arrives at your 9:00 AM. We also keep a short record of what was emailed, for up to 3 days, so nothing is sent twice. Turning both kinds off removes your settings.

How We Use It

• To run VeteranRecord: store your records and show them to you and the people you've chosen.
• To do what you ask: send invitations, make share links and forms, fill in forms from photos you scan, import records from a file your doctor gave you.
• To keep accounts secure: sign-in checks, two-step login, and spotting misuse.
• To send you emails about your account: confirming your email, resetting your password. No marketing emails without asking.
• To read your feedback, answer you when you contact us, and fix problems.
• To count new accounts: when you first log in, our team gets a short email saying a new user has joined and the new total number of accounts. It doesn't include your name, your email address or anything in your record.
• To see which parts of the app are used, so we know what to improve: our team looks at totals only, such as how many accounts there are, how many people used the app this week, and how many allergies or doses were added this month. We don't add any tracking for this, and it never shows who did what, names, email addresses or anything written in a record.
• To meet legal obligations.

We don't sell your information, use it for advertising, build profiles to market to you, or use it to train AI models. We don't look at your records unless you ask us to help with something, or the law requires it.

Who Can See Your Information

You decide, and the database enforces it on every request:

• Your record is yours. Nobody else sees it unless you invite them as a helper or send them a link.
• Helpers you invite (up to three) see your record. With full access they can add and change things in it; with view only they can just look. No helper can delete anything, and none of them see entries you mark private to you. If you set a time for a helper, they see nothing outside it. Everything a helper adds or changes shows in your History with their name. Insurance and emergency contacts stay yours to change; helpers can see them.
• Anyone you send a link to (a visit summary, or an evidence packet) can see what's on it, without an account, until the link expires or you stop it. Links last at most 30 days. Only a scrambled fingerprint of each link is stored, so we can't recreate one. An evidence packet link opens a copy of the packet as one PDF, made when you made the link; we keep that copy until the link expires or you stop it, and delete it after.
• Anyone with your emergency card link or QR code, if you make one: your name and age, the allergies and health conditions you put on the emergency card, your doctor, and who to call. Nothing else. It works until you stop it, and you can see how often it's been opened.
• Your calendar app, if you choose "Add to my calendar" for an appointment, a reminder or medicine times: the file goes to your device, and your calendar provider's own policy applies from there.

Companies That Help Us Run VeteranRecord

These service providers process information only on our instructions, to provide their service to us, under contracts that require them to protect it:

• Supabase: our database, login and file storage. Your information is stored in the United States [confirm the Supabase region].
• Vercel: hosts the VeteranRecord website and app.
• Your phone or browser maker's alert service (Apple, Google or Mozilla), only if you turn on alerts: it delivers them to your device. Each alert is encrypted for your device, so the service can't read it. You can also hide names and medicines from the lock screen.
• Resend: delivers our emails: confirming your address, resetting your password, passing the feedback and votes you send to our team, and telling our team the new number of accounts when someone joins (with no name or email address), and the reminder and refill emails you turn on. It receives the email address and the content of each email. A reminder email includes the reminder's title and notes, the person's first name, and for a refill the medicine, pharmacy and Rx number; unless you choose "Hide details".
• Anthropic: only if you choose to scan a vaccine card, medicine label or insurance card, or to have photos and PDFs read when you import or upload papers. The photo or PDF is sent to Anthropic's Claude to be read; for a vaccine card, the person's birth date is sent too, to read the dates correctly. Nothing else about you is sent. Under Anthropic's commercial terms, it doesn't use what we send to train its models, and keeps it [confirm Anthropic's current API retention period, or zero-data-retention if arranged]. We ask for your consent before your first scan, and you can always type the details in yourself instead. When you import a PDF from your doctor, it's sent the same way, only when you tick the box to send it. A doctor's record file (CCD) is read on our own servers and isn't sent to anyone. We count how many photos and PDFs each person has read each day (only the number, never what was in them), to keep to a daily limit.

When the Law or Safety Requires It

We may disclose information if the law requires it (for example, a valid court order), to protect someone from serious harm, or to protect VeteranRecord from fraud or abuse. Where the law allows, we'll tell you first. If VeteranRecord is ever sold or merged, your information would only move with it under this policy's protections, and we'd tell you beforehand.

How Long We Keep It

• We keep your information while your account is open, so your history is there when you need it.
• When you delete an entry, photo or file, it's deleted. The History keeps one line saying it was removed, with its name, until the record is deleted. Stopping a share link deletes the files sent with it.
• If you stop being a helper or delete your account, the History of the record you helped with still shows your first name next to what you did, so it stays complete.
• When you delete your account, we delete your login, profile, sign-in history and your health record, and your helpers lose access to it. A helper deleting their account doesn't delete the record they helped with.
• Deleted information can remain in our hosting provider's backups for up to [number of days, from the Supabase plan], then it's gone.

How We Protect It

• Everything travels encrypted (HTTPS), and photos and files are kept in private storage.
• Rules in the database itself decide who can see or change each piece of information, not just the app.
• Two-step login is available for every account, and you can see where you're logged in and log out of other devices.
• Share links are long and random, expire, and can be stopped at any time.

No system is perfectly secure. If we learn of a breach affecting your information, we'll tell you and the authorities as the law requires. Please use a strong password and turn on two-step login.

Your Choices and Rights

• See, change or delete what you've entered at any time in the app.
• Stop any share link, change a helper's access, or remove a helper.
• Download a copy of everything you can see (Settings → Download Everything), as a printable page, data and files.
• Delete your account in Settings.
• Ask us for a copy of your information, to correct or delete it, or for a list of everyone we've shared it with, by emailing [privacy email address]. Washington residents (and residents of other states with similar laws) have these rights by law; we offer them to everyone. See the Consumer Health Data Privacy Policy for how we handle requests and appeals.
• We won't treat you differently for using your rights.

Changes to This Policy

If we change this policy, we'll update the date at the top. If a change affects how we use or share your information, we'll tell you in the app or by email before it takes effect, and ask for your consent again where the law requires it.

Contact Us

[company legal name]
[mailing address]
[privacy email address]