Privacy Policy

Optional signup measurement

You can choose to share one completed education-account signup event with Meta. The choice is off by default and is not required to create an account or use the service. If you agree, Meta receives the signup event, our website origin, your browser and IP address, and any Meta cookies your browser permits. Meta may use this information to measure, target and deliver ads. We do not include your email, account ID, question, answer, health details, full page URL or form fields.

This uses a single image request, not an advertising script on the signup or question screen. The choice is valid in this browser for 24 hours while signup completes. We remove it when we send the event or next read an expired choice. You can uncheck it before signup or clear this site's browser storage to cancel a pending choice. Global Privacy Control prevents this optional measurement. Blocking cookies or using another device may prevent ad attribution. This does not affect our own aggregate signup records. Once the event has been sent, unchecking cannot recall it; you can manage Meta's use of your activity in your Meta privacy settings.

1. Important: Patient Data and Scribe

Patient Education Mode collects your email, country, adult confirmation, and versioned consent. It does not require professional credentials. Ask general questions without identifying details. We store questions, answers, and service diagnostics under the query-log retention limit in Section 7. We send questions to the AI and search providers described in Sections 4 and 5. We do not send the text of patient education questions or answers to advertising platforms. Third-party advertising scripts remain disabled on patient landing, signup and question routes. The optional account-creation measurement above is a limited exception.

In Patient Education Mode, you may save your own optional health history in your account. This is sensitive information linked to your account, even without your name in the text. You choose separately for each question whether to send a copy to the AI and search providers below. The choice starts off. You can review, edit, or delete the saved history. Do not include identifiers or another person's records. History supports general education only. Not medical advice, diagnosis or treatment.

Do not submit personal health information or identifiable patient data to the public MCP endpoint or standard clinical question and answer features. The optional personal history feature in Patient Education Mode is separate. Only separately approved Canadian Business API accounts may submit PHI through the authorized Business API patient-data flow. Primary AI supplies software and does not provide patient care. The clinician or clinic remains responsible for care. Those features are designed for de-identified clinical questions. Scribe is designed to process encounter information when an authorized clinician uses it for care. The Business API can process Canadian PHI only under separate written approval and theBusiness API Health Data Terms. You are responsible for obtaining patient consent when required and for meeting applicable federal and provincial privacy requirements.

2. Information We Collect

a. Information you provide

• Account information (if you create an account): name, email, professional credentials such as NPI number, specialty, and verification documents.
• Billing information (if you subscribe): Stripe processes your payment method and sends us customer, subscription, invoice, and payment-status information. We do not receive or store your full card number.
• Queries and conversations: the clinical questions, follow-ups, and feedback you submit.
• Scribe encounters: encounter transcripts, chart context, generated notes, and edits you save through Scribe.
• Scribe user activity records: the patient or resident name and record ID, the clinician name and user ID, a description of the information opened, and the date and time.
• Support communications: messages you send to us.

b. Information collected automatically

• Usage data: pages visited, features used, timestamps, response ratings.
• Device & technical data: IP address, browser type, operating system, approximate location derived from IP, and similar diagnostic data.
• Cookies and similar technologies: used to maintain sessions, remember preferences, and measure aggregate usage.

c. Information from third parties

• Credential verification: when you submit professional credentials, we may verify them against public registries (e.g., NPI Registry).
• Authentication providers: if you sign in with a third-party provider, we receive basic profile information from that provider.
• Payment processor: Stripe sends us subscription and payment-status events needed to provide paid features and customer billing controls.

d. Primary AI through ChatGPT and other MCP clients

To connect Primary AI through ChatGPT or another compatible Model Context Protocol (MCP) client, you sign in with your Primary AI account. The client then transmits the de-identified clinical question sent to our tool, and it may also provide a country and locale. We use regional context to format evidence responses when available. We store the question, the answer, and diagnostic data in Primary AI query logs and link them to your account, as we do for questions asked on our website. For rate limiting we store a one-way hash of your account identifier. The Claude connector can also be used without signing in. Those questions and answers are stored in query logs without a link to an account. Business API customers that use our business MCP endpoint are covered by their Business API terms. Service providers and transport infrastructure may keep separate operational or security records under their applicable terms. The AI client may separately retain the conversation and submitted question under its own privacy policies.

Public MCP access is for de-identified questions only. It does not support identifiable patient data, even for organizations with separate Business API approval. Review the third-party client's privacy practices before use.

3. How We Use Information

• To operate, maintain, and secure the Service.
• To generate responses to your clinical questions.
• To transcribe encounters, generate clinical notes, and provide your private Scribe history.
• To create Scribe user activity reports required by health privacy law.
• To verify your professional status and prevent abuse.
• To process subscriptions, provide paid features, and manage billing support.
• To monitor quality and improve the accuracy and safety of responses.
• To analyze aggregate usage patterns and inform product decisions.
• To personalize the Service and the advertisements you see, including by inferring clinical topic and specialty interest from your use of the Service.
• To measure advertising, verify that an ad was shown to a licensed clinician, and report performance to sponsors.
• To produce de-identified, aggregated reports of clinical-topic trends that we may share with partners, sponsors, or the public.
• To communicate important updates, security notices, and (where you opt in) product news.
• To comply with legal obligations and enforce our Terms.

4. AI Model Processing

When you choose to include saved health history, it becomes part of that question. It follows the same provider processing and query-log retention below. History that you do not select stays in your account and is not sent with the question. Earlier answers can still contain information from prior questions in the same conversation.

Your queries are sent to named third-party AI inference providers via secure API calls: OpenAI for response generation, Google (Gemini) for interpreting and classifying your question, and Voyage AI for text embeddings used to retrieve relevant medical literature. If you use question dictation, your audio is streamed to ElevenLabs. If you use Scribe, encounter audio is streamed to AssemblyAI for speech-to-text transcription, and the transcript is sent to OpenAI to generate the note. AssemblyAI may process Scribe audio outside Canada. An explicitly approved synthetic-test account may instead stream synthetic Scribe audio to Omi Health during a limited evaluation. The Omi evaluation is not enabled for patient-data mode. We do not store encounter audio. If you use Scribe clinical assistance, encounter information is used to prepare a clinical question for the answer service. That service also uses AI and search providers, including Exa, for retrieval. Provider retention and model-training rules depend on the service, agreement, and account settings. We retain general query and response content in our own systems to monitor quality, debug, and improve the Service, subject to the retention practices in Section 7. We do not write the question or answer from a correctly marked, approved Business API PHI request to our application query logs or citation-audit tables. Where feasible, we limit access to retained content to authorized personnel and automated systems.

5. Sharing of Information

We do not share the text of your questions or conversations with advertisers. We do not share an individual clinician's full search history with advertisers.

We do transfer other personal information for advertising and measurement. Under the CCPA/CPRA that transfer is a "sale" or "share" when we disclose identifiers or inferred interests to advertising, identity, or measurement partners for valuable consideration or for cross-context behavioural advertising. You may opt out in Section 9.

We share information in these circumstances:

• Service providers: hosting, database, analytics, and email providers acting on our behalf under contractual confidentiality obligations.
• Payment processing: Stripe processes payment methods and subscription billing on our behalf under its own privacy terms.
• AI and transcription providers: OpenAI for response and Scribe note generation, Google (Gemini) for question interpretation and classification, Voyage AI for text embeddings, ElevenLabs for question dictation, AssemblyAI for Scribe transcription, and Omi Health for the limited synthetic Scribe evaluation.
• Search providers: Exa receives search queries derived from your questions to find relevant sources.
• Advertising, identity, and measurement partners: as described in Section 6.
• Sponsors and their agents: professional identifiers and ad-view timestamps, plus aggregate campaign metrics, as described in Section 6.
• Partners and the public: de-identified, aggregated topic-trend reports, as described in Section 6.
• Compliance and safety: when required by law, valid legal process, or to protect rights, safety, or property.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to standard confidentiality protections.
• With your consent: when you direct us to share information.

6. Advertising, measurement, and partner insights

The clinician product may be funded by advertising and by reports we provide to life-sciences and other partners. We keep the answer engine separate from ad selection: advertisers cannot set retrieval, ranking, or citation content.

We may personalize advertisements on the Service and in our emails from first-party use data. For example, a user we treat as a cardiologist, or who has viewed or asked about cardiology topics, may see an advertisement for a cardiac product. We may also show query-relevant advertisements at the moment you ask about a disease state. The advertisement is labelled as advertising or sponsored content. We do not send the question text to the advertiser.

Ad viewability and sponsor measurement

To confirm that an advertisement was shown to a licensed clinician, we may disclose a professional identifier — National Provider Identifier (NPI), licence number, or an equivalent credential — and the timestamp of the ad view to selected measurement vendors and to the sponsor or its agents. We treat that pair as personal information. Anyone with the public NPI registry can attach a name to an NPI. We do not include your question text or your full search history in that disclosure.

Other sponsor reporting is aggregated: view counts and general trends by specialty or topic. Those reports do not name you.

Audience extension (United States)

For users located in the United States, we may share limited identifiers (hashed email address, cookie IDs, device or advertising IDs, IP address, and professional identifiers such as NPI or licence number) and interest categories inferred from your on-platform activity with advertising and identity partners so they can deliver and measure related advertisements on third-party websites and applications for a limited time. We do not share your questions or conversations for this purpose. Audience extension is not offered to users we locate outside the United States.

Aggregated topic insights

We may create aggregated, de-identified, or anonymous data from information you provide, including trends in the clinical topics being searched, so that it can no longer be linked to you personally. We may share those insights with partners or the public. We take steps so the data does not identify individual users and cannot reasonably be re-associated with them. Small cells may still carry re-identification risk; we do not intend those reports to identify you.

Scribe transcripts, encounter context, and clinical notes are not used for advertising, audience building, sponsor reporting, or product analytics. Approved Business API PHI request content is also excluded from these uses.

7. Data Retention

We retain account information for as long as your account is active and for a reasonable period afterward to satisfy legal, accounting, or reporting obligations. Other categories of data are retained as follows:

• Query logs (question, response, and diagnostic data), citation audits, follow-up events, and usage analytics are retained for up to 12 months. This limit applies to anonymous and signed-in use.
• Business API PHI requests do not create application query logs or citation-audit records. Gateway metadata does not contain question or answer text and is removed after 90 days. Provider records, service logs, and backups follow their approved terms and procedures.
• IP addresses and browser user-agent strings attached to query logs and usage analytics are removed after 30 days.
• MCP / ChatGPT tool rate-limit records contain a one-way hash of your account identifier or of another caller identifier. They do not contain the question or answer and are removed after seven days. MCP questions and answers are kept as query logs, under the query log limit above.
• De-identified aggregate reports may be kept longer when they cannot reasonably be linked to an individual. We retain coarse monthly service totals without user, session, IP, browser, question, answer, or topic identifiers. We do not create a retained monthly row from fewer than 10 source events.
• Saved patient health history stays until you edit or delete it, or delete your account. Copies included in earlier questions remain under the query-log limit above. Deleting saved history does not erase earlier questions or answers.
• Saved conversations and bookmarks are kept until you delete them or your account.
• Scribe transcripts and notes expire 30 days after creation. An hourly job removes expired records from the active database. You can delete them sooner from Scribe history. Backup copies and provider records have separate retention rules.
• Scribe rounding rosters are kept until the clinician edits or deletes them, or deletes the account. A clinic should remove a resident when the roster no longer needs that record.
• Scribe user activity records are kept for at least one year after the access. They describe the record that was opened. They do not copy the transcript or generated note.
• Billing and transaction records may be retained by us and Stripe as required for tax, accounting, fraud-prevention, dispute, and other legal obligations.

These practices apply to anonymous usage as well as signed-in accounts. You may request deletion of your account and associated personal data at any time as described below. Deleted active-database records may remain for a limited period in disaster-recovery backups. Retention jobs apply again after a backup restore.

8. Security

We use encryption in transit and access controls to protect information. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

9. Your Rights

Depending on your jurisdiction (including under PIPEDA, Quebec Law 25, GDPR, UK GDPR, and the CCPA/CPRA), you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your personal information.
• Object to or restrict certain processing.
• Request portability of your personal information.
• Withdraw consent where processing is based on consent.
• Opt out of the sale or sharing of personal information for advertising and measurement (CCPA/CPRA "Do Not Sell or Share"), including audience-extension advertising.
• Lodge a complaint with a supervisory authority.

To exercise these rights, including a Do Not Sell or Share request, email us at rishad@primaryai.world or use the in-product feedback controls. We honour a verified email request. We do not yet honour automated Global Privacy Control signals.

10. International Transfers

We operate globally and may transfer, store, and process information in countries other than your own, including the United States. We remain accountable for personal information under our control. Before an approved patient-data flow uses a service provider, we review the applicable agreement, account settings, purposes, retention, safeguards, subprocessors, and incident duties. We require contractual and technical safeguards appropriate to the information and the applicable law.

11. Children's Privacy

The Service is not directed to children under 18 and we do not knowingly collect personal information from them. If you believe a child has provided us information, please contact us so we can delete it.

12. Cookies

We use essential cookies to keep you signed in and to remember preferences (e.g., theme). We may use analytics cookies to understand aggregate usage. We may use advertising and measurement cookies or similar technologies, including with partners described in Section 6. You can control cookies through your browser settings; disabling them may impair some features. A Do Not Sell or Share request is described in Section 9.

13. Changes to this Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

14. Security reporting

If you discover a security vulnerability in Primary AI, please email rishad@primaryai.world. Our security disclosure policy and contact details are also available at /.well-known/security.txt and on our Security & Trust page. We appreciate responsible disclosure and will acknowledge valid reports.

15. Contact

Our Privacy Officer is Rishad Usmani. For privacy questions, complaints, or requests to access or correct personal information, email rishad@primaryai.world or use the in-product feedback controls. Primary AI is operated by 18058458 CANADA CORP..

For patient records held for a clinician or clinic, we coordinate requests with the responsible clinician or clinic. Please do not send patient records in your first email.