Privacy Policy

Doctor's Journal — Last updated: March 2026

Doctor's Journal is committed to protecting your privacy and personal health information. This policy explains what information we collect, how we use it, and your rights regarding your data. We comply with the New Zealand Privacy Act 2020 and follow best practices for health data handling.

What Information We Collect

We collect information that you provide directly when using Doctor's Journal, including:

• Account information: your email address and authentication credentials
• Health records: recordings of medical appointments, transcriptions, and AI-generated summaries
• Medications: names, dosages, schedules, and prescription details
• Documents: uploaded medical documents, test results, and associated metadata
• Healthcare providers: names, addresses, and contact details of your doctors, specialists, and pharmacies
• Emergency information: emergency contacts and medical details you choose to store

All health data is stored locally on your device using encrypted storage. We do not maintain a central database of your health information.

How We Use Your Information

Your information is used solely to provide and improve the Doctor's Journal experience:

• To transcribe and summarise your medical appointment recordings
• To extract text from scanned documents and prescriptions
• To manage your medication schedules and send reminders
• To organise your medical history into a searchable timeline
• To create encrypted backups of your data to your chosen cloud provider

Third-Party Data Processing

To provide AI-powered features, certain data is processed by third-party services. We take every precaution to minimise data exposure and ensure secure handling:

• OpenAI (Whisper, GPT-4o): Audio recordings are sent for transcription and summarisation via our secure server. OpenAI does not retain your data for training when accessed via the API.
• Google (Cloud Vision, Places): Used for document OCR and healthcare provider search. Google processes data per their Cloud Terms of Service and does not use it for advertising.
• Cloud backup providers (Google Drive / iCloud): Your backup data is encrypted with AES-256 before leaving your device. The cloud provider stores only encrypted data and cannot read your health information.

All data transmitted to third parties is sent over TLS 1.3 encrypted connections. We never sell or share your data for advertising or marketing purposes.

AI Processing Consent

Before any AI processing occurs, the app will ask for your explicit consent. You may choose not to use AI features, in which case your audio recordings will be stored locally without transcription or summarisation. You can withdraw consent at any time in the app settings.

Your Rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Export your data: You can export your complete medical history at any time in JSON format.
• Edit your information: All records in Doctor's Journal can be edited by you at any time.
• Delete your account: You can permanently delete your account and all associated data from within the app. This action is irreversible.
• Access your data: You can view all data that Doctor's Journal holds about you directly in the app.
• Correct your data: If any information is inaccurate, you can correct it yourself or contact us for assistance.

Data Retention

Doctor's Journal is designed as a permanent medical journal. Your data is retained on your device for as long as you choose to keep it. We do not automatically delete any of your health records.

If you delete your account, all data on your device will be permanently removed. Encrypted backups stored in your cloud account (Google Drive or iCloud) will need to be deleted separately by you, as we do not have access to your cloud storage.

App usage logs are retained on your device for up to 90 days for troubleshooting purposes. These logs never contain personally identifiable information or health data.

Data Security

We take the security of your health information very seriously and implement multiple layers of protection:

• Local encryption: Your data is stored in an encrypted database on your device.
• Backup encryption: All backups are encrypted with AES-256 encryption before leaving your device. Encryption keys are stored securely in your device's keychain (iOS) or keystore (Android).
• Transport encryption: All network communication uses TLS 1.3.
• Authentication: Your account is protected by Firebase Authentication with support for biometric login (Face ID / fingerprint).
• App lock: When enabled, the app requires biometric authentication each time you return to it.
• Session management: Automatic session timeout after 30 minutes of inactivity.
• Login protection: Account lockout after 5 failed login attempts for 15 minutes.

Children's Privacy

Doctor's Journal is not intended for use by children under the age of 16. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can take appropriate action.

Changes to This Policy

We may update this privacy policy from time to time. When we make changes, we will update the "Last updated" date at the top of this policy and notify you within the app. We encourage you to review this policy periodically.

If we make material changes to how we handle your health data, we will provide prominent notice within the app and may require your renewed consent before continuing to process your data under the updated terms.

Contact

If you have any questions or concerns about this privacy policy or how your data is handled, please contact us at:

privacy@doctorsjournal.nz