Privacy Policy
Effective date: 10 April 2026
Privacy Policy
HeyDoctor Effective date: 18 September 2026
1. Who We Are
HeyDoctor is operated by Marco Santonocito, with registered office at Piazzetta Ado Furlan 4, 33170 Pordenone (PN), Italy — VAT number IT 01992590933 (the "Data Controller").
For any privacy-related enquiry you can write to privacy@heydoctor.com.
2. Scope
This Privacy Policy explains what personal data we collect, how we collect it, every purpose we use it for, and who we share it with when you use the HeyDoctor mobile application, the heydoctor.io website, and any related services (collectively, the "Service").
HeyDoctor is an educational game. It is not a medical device and does not provide medical advice. All patients and cases are fictional. Please do not enter real patient data or information about your own health.
HeyDoctor is intended for users aged 18 and over. We do not knowingly collect data from anyone under 18. If we become aware that we have collected data from a minor, we will delete it promptly.
3. Data We Collect and How We Collect It
3.1 Data You Provide
| Data | How it is collected | Purpose |
|---|---|---|
| Email address and password | Sign-up form (the password is stored only as a hash by our authentication provider) | Account creation, sign-in, service emails, and product updates you can unsubscribe from |
| Display name (username) | Onboarding after sign-up, and profile | Shown on leaderboards and in your profile |
| Specialty and country | Onboarding after sign-up, and profile. For country you can choose "Prefer not to say" | Shown next to your display name on leaderboards, visible to other players |
| Onboarding answers (what brings you to HeyDoctor; on older app versions also difficulties and specialties of interest) | Onboarding in the app and on the website | Personalising the experience and our communications |
| Language, sign-up platform (iOS, Android or web), date you accepted the Terms and this policy | Recorded at sign-up | Localisation, legal record |
3.2 Data Generated Through Gameplay
| Data | Purpose |
|---|---|
| Messages you type to the AI patient and the AI's replies | Generating the patient's answers (see section 5) and your case history |
| Investigations ordered, diagnosis attempts, scores, streaks, leaderboard position | Scoring, leaderboards, and your personal history |
| Your AI processing choice (granted or declined, and when) | Record of your permission |
3.3 Data Collected Automatically
| Data | Purpose |
|---|---|
| IP address and request metadata | Security, rate limiting, abuse prevention |
| Website usage data (pages viewed, performance metrics; IP anonymised) | Website analytics — website only, not the mobile app |
| Subscription status (plan, renewal date, store transaction identifiers) | Unlocking paid features |
We do not collect your advertising identifier, precise location, contacts, photos, or health data. We do not track you across other companies' apps or websites. Daily reminders are scheduled locally on your device; we do not collect a push notification token.
Payments. Purchases are handled by Apple (App Store), Google (Google Play) or, on the website, RevenueCat Web Billing with Stripe as the payment processor. We never receive or store your card number.
4. How We Use Your Data
We process personal data on the following legal bases under the EU General Data Protection Regulation ("GDPR"):
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Provide and operate the Service (account, gameplay, scoring, leaderboards, activity history) | Performance of a contract (Art. 6(1)(b)) |
| Send the text of your chat messages, without any personal data, to third-party AI providers to generate the patient's replies | Your permission, requested in the app before any message is sent (Art. 6(1)(a)) — you can withdraw it at any time |
| Manage subscriptions and entitlements | Performance of a contract (Art. 6(1)(b)) |
| Send service emails (confirmation, password resets, critical service notices) | Performance of a contract (Art. 6(1)(b)) |
| Product updates and educational emails | Legitimate interest (Art. 6(1)(f)), or consent where required — every email has an unsubscribe link |
| Security, fraud and abuse prevention, rate limiting | Legitimate interest (Art. 6(1)(f)) |
| Website analytics | Consent where required (Art. 6(1)(a)) |
| Tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
We do not sell your data, we do not use it for third-party advertising, and we do not make decisions about you that produce legal or similarly significant effects by automated means (Art. 22 GDPR). Your score is game feedback only.
5. AI Providers: No Personal Data Is Shared
HeyDoctor's patients are simulated by artificial intelligence. To generate the patient's replies, the text of the conversation is processed by third-party AI providers.
We do not share your personal data with AI providers. They never receive your email address, display name, account ID, IP address, device information, payment data, onboarding answers, scores, or history. The conversation reaches them with nothing attached that says who you are, so they cannot link it to you.
5.1 What is sent
- The text of the messages you type in the patient chat during a case, together with the conversation so far in that case.
- The fictional case script. We write it, and it contains no data about you.
That is all. The only way personal information could reach an AI provider is if you type it into the chat yourself, which is why we ask you not to write your name, contact details, or anything about real people or your own health in a conversation.
5.2 Who it is sent to
| Provider | Role | Location |
|---|---|---|
| Anthropic, PBC (Claude models) | Primary provider of the patient's replies | USA |
| OpenAI, LLC (GPT models) | Backup provider, used only when the primary one is unavailable | USA |
5.3 Your permission
Before your first conversation, the app shows a screen that explains the above and asks for your permission. Nothing is sent to an AI provider until you agree. If you decline, the patient chat is not available, because it cannot work without AI. You can withdraw your permission at any time in Profile → Privacy; from that moment nothing further is sent.
5.4 How these providers protect the data
Both providers act as our processors under data processing agreements that include the EU Standard Contractual Clauses, and they provide protection equal to that described in this policy. Under their API terms they do not use the messages to train their models. They may keep inputs and outputs for a limited period (typically up to 30 days) for security and abuse monitoring, and then delete them. We do not use your conversations to train or fine-tune any AI model either.
We store your conversations on our own servers (Supabase, EU) so you can review your case history.
6. AI Transparency (Regulation (EU) 2024/1689 — AI Act)
- You are interacting with an AI. Every patient in HeyDoctor is an AI system, not a real person. No human reads or answers your messages in real time.
- AI-generated content. Clinical cases, patient replies, patient portraits, ECGs and other investigation images, and daily clinical pearls are generated or assisted by AI. They are synthetic and do not depict real people or real patients. We review cases before publishing them.
- Limits. AI output can be inaccurate or incomplete. HeyDoctor is for education and entertainment. It must not be used to diagnose or treat real patients or to make clinical decisions.
- No prohibited or high-risk uses. We do not use AI for emotion recognition, biometric identification, or profiling, nor to evaluate you for education, employment, or access to services.
- Human oversight. You can report an incorrect or inappropriate AI response to privacy@heydoctor.com. We review reports and correct the cases.
7. Other Service Providers
We use the following third-party processors:
| Service | Role | Data processed | Location |
|---|---|---|---|
| Supabase | Database, authentication, authentication emails | Account data, game sessions, conversations | EU |
| Vercel | Hosting, website analytics and performance | IP address, request metadata, anonymised website usage | EU/US |
| RevenueCat | Subscription management (app and website) | Internal user ID, purchase and subscription status | US |
| Apple / Google | In-app purchases | Purchase data, under their own privacy policies | — |
| Stripe | Card processing for website purchases; legacy website subscriptions | Payment details (we never see card numbers) | EU/US |
| Brevo | Email and contact management | Email, display name, language, platform, specialty, country, onboarding answers | EU |
| Upstash | Rate limiting | IP address or user ID, short-lived | EU/US |
| Cloudflare Turnstile | Bot protection on website sign-up | IP address, browser signals | Global |
| Google Analytics | Website analytics (website only) | Anonymised usage events, anonymised IP | EU/US |
| Anthropic, OpenAI | AI providers — see section 5 | Chat text only, no personal data | US |
Where data is transferred outside the European Economic Area, we rely on the EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), or an adequacy decision by the European Commission, as applicable.
8. Data Retention
| Data | Retention period |
|---|---|
| Account data, specialty, country and onboarding answers | Until you delete your account |
| Game sessions and conversation history | Until you delete your account |
| Unconfirmed sign-ups | Deleted automatically after a short period |
| Chat text held by AI providers | Typically up to 30 days, then deleted by the provider |
| Payment and tax records | As required by Italian tax law (10 years) |
| Website analytics | Up to 26 months, aggregated |
You can delete your account at any time from Profile → Delete account, in the app or on the website. This erases your account, conversations and history, removes you from our mailing tool, and cancels website subscriptions. Any residual personal data is erased or anonymised within 30 days, except where retention is required by law.
9. Your Rights
Under the GDPR you have the right to:
- Access your personal data and obtain a copy
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten")
- Restrict processing in certain circumstances
- Data portability — receive your data in a structured, machine-readable format
- Object to processing based on legitimate interest
- Withdraw consent at any time, including your permission for AI processing (Profile → Privacy), without affecting the lawfulness of prior processing
To exercise any of these rights, email privacy@heydoctor.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) — www.garanteprivacy.it.
10. Cookies and Tracking
The HeyDoctor mobile app does not use cookies. Our website uses:
- Strictly necessary cookies — required for sign-in and security (no consent needed)
- Functional cookies — remember a discount code you arrived with, so the right price is shown at checkout (stored for 30 days, no personal data)
- Analytics cookies — Google Analytics, with your consent where required
Vercel Analytics, which we also use on the website, is cookieless.
11. Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption in transit (TLS) and at rest
- Row-level access controls on the database and role-based access to internal systems
- Regular review of third-party processor security practices
- Rate limiting and abuse prevention on all API endpoints
No system is completely secure. If we become aware of a data breach that poses a high risk to your rights, we will notify you and the competent supervisory authority as required by Art. 33–34 GDPR.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or an in-app notice at least 14 days before the changes take effect. If we add a new AI provider or change what is sent to AI providers, we will ask for your permission again. The "effective date" at the top of this page will always reflect the latest version.
13. Contact
For any questions, requests, or complaints regarding this Privacy Policy or our data practices:
Marco Santonocito Piazzetta Ado Furlan 4, 33170 Pordenone (PN), Italy privacy@heydoctor.com
Last updated: 18 September 2026