{"on_device_only":["Health Journal check-ins (stored only in your phone's local storage)","My Records entries (stored only in your phone's local storage)","The visit sheet (travels only inside the link you share; never uploaded)","Medical account logins (encrypted on your device with your passphrase — never uploaded, never sent to the AI, never in a shared passport)"],"sent_to_ai_only_when_you_tap":{"text_features":{"vendor":"Anthropic (Claude)","features":["Explain my records","See my patterns","Build my visit sheet","Companion chat"],"note":"Only the specific text for that feature is sent, to generate the answer."},"voice_features":{"vendors":[],"features":["Voice input (speech-to-text)","Read-aloud (text-to-speech)"],"note":"Audio is transcribed/spoken and not retained by MedCompanion."}},"server_stores_health_content":false,"server_storage_note":"OFF by default: the AI features are stateless — they answer and forget, and nothing you enter is written to our database. Server-side history only turns on if a deployment explicitly enables it (MC_STORE_HISTORY=1) with disclosure and consent.","we_never_log_your_health_content":true,"ai_will_never":["Diagnose you or decide your treatment","Replace your doctor's judgment","Train AI models on your data","Sell or advertise with your data"],"you_control":["The app's core works with AI turned off","Nothing is sent until you tap an AI feature","You can delete everything on your device at any time"],"not_yet":["This is the product's data architecture. Formal hospital assurances (signed BAAs with each AI vendor, HIPAA program, SOC 2) are a separate, in-progress track."]}