Privacy Policy

MedVault is operated by A3 Partners Pte Ltd, a company based in Singapore, and is part of the Atriverse ecosystem. In this policy, “MedVault”, “we”, “us”, and “our” refer to A3 Partners Pte Ltd in connection with the MedVault service.

Privacy and security questions can be sent to support@atriverse.com.

We collect and process information that you provide or that is created when you use MedVault, including:

• Account information, such as your email address, name, and Google sign-in profile when you choose Google sign-in.
• Household and member profiles, including names, relationships, dates of birth, sex, blood group, and health details you add.
• Medical documents you upload, including photographs and PDFs.
• Information extracted from documents, including lab results, medications, conditions, allergies, and immunizations.
• Messages and questions you send to the health assistant, along with its responses and source citations.
• Symptom check-ins, reminders, emergency ID information, and preferences.
• Device and session information used for signed-in device management, such as device identifiers, browser or platform details, network information, and last-seen times.
• Push-notification subscription details when you enable notifications.
• Security and audit logs recording actions such as viewing, exporting, sharing, signing in, and changing settings.
• Consent events, including consent you give or withdraw for optional sharing with another Atriverse service.

We use this information to:

• Store, read, organise, search, and display your family’s medical records.
• Extract information from records and explain it in more understandable language.
• Show trends, comparisons, reminders, insights, emergency information, and source links.
• Provide household access and optional Atriverse sign-in or cross-app sharing.
• Authenticate users, manage sessions and devices, prevent abuse, investigate incidents, and maintain an audit trail.
• Operate, troubleshoot, and improve the reliability of the service.

We do not sell personal data. We do not use medical records for advertising, and we do not use your medical records to train AI models.

MedVault uses Anthropic’s Claude service to read documents, extract structured medical information, answer your questions, and create explanations. The relevant document text, document images, and questions are sent to Anthropic and processed to return a result to you. AI output can be incomplete or wrong, so you should check important information against the original document and a qualified healthcare professional.

We rely on a limited number of service providers that process information for us:

• Lovable Cloud (Supabase infrastructure) provides the database, authentication, and private file storage.
• Anthropic processes documents and questions through Claude to return extractions and explanations.
• Cloudflare delivers the app and server functions through its network.
• Google provides sign-in when you choose to continue with Google.
• Atriverse Core supports optional single sign-on and cross-app sharing. Medical or preference data is shared with another Atriverse app only after your explicit consent, which is logged.

These providers may process information in countries outside the country where you live. Where required, we use contractual and technical safeguards intended to protect personal data during international transfers.

MedVault lets a household owner invite other people. An accepted household member can see the records and health information available within that household, including records for other household profiles. Only invite people you trust and only upload another person’s records when you have the right or authority to do so. A household owner can revoke an invitation or remove access.

We generally keep account information, documents, extracted information, chats, and other vault content while the account and household exist. You can delete individual documents in the app. You can delete your account directly in Settings. Sole owners delete their household and its records; non-owner members leave the household while its records remain with the owner. See our account deletion page. If you cannot sign in, contact us from your account email address as described there.

When an account is deleted, stored files and associated records are removed from the live service. Backup copies age out according to the hosting provider’s normal backup cycle. De-identified security or audit entries may remain where needed to preserve the integrity of the security record.

Depending on where you live, you may have rights to:

• Access personal data we hold about you.
• Export your records using the in-app export tools.
• Correct inaccurate profile or extracted information.
• Delete documents, household information, or your account.
• Withdraw consent for optional processing or cross-app sharing.
• Object to or restrict certain processing, where local law provides that right.
• Complain to the relevant privacy or data-protection regulator.

Contact support@atriverse.com to make a request. We may need to verify your identity before acting on it.

Singapore. We handle personal data in accordance with the Personal Data Protection Act 2012 (PDPA), including obligations concerning consent, purpose, access, correction, protection, retention, and transfers.

Hong Kong. We handle personal data in accordance with the Personal Data (Privacy) Ordinance (PDPO) and its data-protection principles.

India. Rights and requests under the Digital Personal Data Protection Act, 2023 may be directed to the Grievance Officer: Gaurav Atri, Atri Gurukul Private Limited, at support@atriverse.com, using the subject “Grievance Officer – India”.

European Union and United Kingdom. Where the GDPR or UK GDPR applies, you may have rights of access, correction, erasure, restriction, objection, portability, and complaint to a supervisory authority. Medical information is special-category data and is processed on the basis of your explicit consent where that basis is required.

MedVault is not intended for anyone under 18 to create or control an account. A parent or legal guardian may keep records for a child by adding the child as a household member and remains responsible for that use.

We use access controls, private storage, encryption in transit and at rest, short-lived file links, optional multi-factor authentication, device controls, and audit logs. No system can be guaranteed completely secure, and MedVault is not end-to-end encrypted because our servers must process records to provide extraction and explanation features. Read more on our Security page.

We may update this policy as the service, our providers, or applicable law changes. We will update the date above and, when a change is material, provide an appropriate notice in the app or by email. Continued use after a change takes effect means the updated policy applies to later use, subject to any consent the law requires.

Contact A3 Partners Pte Ltd at support@atriverse.com.