Privacy policy
medkit is a voice-based AI patient simulator for medical students and clinicians. The service runs entirely on synthetic, fictional cases — never real patient data. This policy explains what data we collect from you, how we use it, the third-party services we rely on, and the rights you have over your data.
What we collect
When you use medkit we collect:
- Account information: your name, email address, and the provider you sign in with.
- Training session records: the transcript of your spoken or written conversation with the simulated patient, the tests and treatments you order, and the attending grader's feedback report.
- Technical logs: browser type, language, IP address (kept briefly, for abuse detection) and error traces.
- Microphone audio: processed only while a session is active. We do not retain the audio stream — only the written transcript it produces.
medkit is not designed for uploading real patient files, national ID numbers, insurance data, or clinical records — please do not upload any such data.
How we use it
We process the data we collect only to:
- Run the simulation and generate the attending grader's feedback.
- Link your training record to your account so you can review it later.
- Detect errors and improve the service.
- Provide security and detect abuse or fraudulent accounts.
medkit does not sell, rent, or share your data for advertising, and we do not use your transcripts to train our models.
Third-party services
To run the service we rely on the following categories of providers, each governed by its own privacy policy:
- Cloud hosting & authentication — securely stores account data and runs the backend.
- Real-time voice transport — streams audio during a live session; no persistent recording.
- A large language model provider — powers the patient persona and the attending grader. Transcript fragments are processed in the model call.
- Email delivery — sends transactional email (sign-in, notifications, replies to messages you send us).
- Aggregate, anonymized analytics — measures site traffic in aggregate.
How we protect your data
All traffic is transmitted over HTTPS. Database access is restricted to the backend services that hold the secret key. Your training records are stored against your account and are visible only to you.
medkit is not a clinical device. As of the date you read this we hold no HIPAA, ISO 27001, or comparable certification. We do not expect — and are not suitable for — real patient data.
Your rights
You have the right to:
- Know whether we process your personal data, and request access to it.
- Have incomplete or inaccurate data corrected.
- Request deletion or erasure of your data, subject to applicable law.
- Restrict or object to certain processing, including decisions made solely by automated systems.
- Request a portable copy of the data you provided to us.
To exercise any of these rights, write to support@medkit.clinic. We will respond within 30 days.
Contact
For any privacy question, request, or complaint: support@medkit.clinic