Privacy Policy

1. Overview

Analyze My Hand ("the Service") is designed with privacy as a core principle. This Privacy Policy explains what data is collected, how it is used, and what control you have over your information.

2. Chat Data and History

Your conversation and analysis history is saved in your web browser using IndexedDB. This means:

• To answer you, your chat messages are sent to our server and passed on to AI providers (see section 4). Our server processes them for that request and does not save them.
• Clearing your browser data or switching browsers will remove your conversation history.
• We cannot restore your conversation history, because the saved copy exists only in your browser.

3. Uploaded Medical Images

When you select medical imaging files (DICOM, X-ray, PDF reports):

• Raw DICOM files, ZIPs, and PDFs are parsed and rendered in your browser.
• The server receives only rendered images and extracted text needed for AI analysis.
• Analysis requests are handled statelessly and are not used to create a medical file store.
• We do not create long-term copies, backups, or archives of your raw medical files.

4. Third-Party AI Processing

To answer you, your chat messages and the rendered images and extracted text needed for analysis are sent through the Vercel AI Gateway to third-party AI model providers, including:

• OpenAI (GPT models)
• Google (Gemini models)
• Anthropic (Claude models)
• xAI (Grok models)

These providers process this data according to their own privacy policies and data retention terms. We recommend reviewing their policies. We use API-based access which typically has stricter data handling than consumer-facing products, but we cannot guarantee third-party provider behavior.

If you have concerns about third-party processing, use the built-in DICOM anonymization tool to strip Protected Health Information (patient name, ID, birth date, institution, referring physicians) before analysis.

5. Cookies & Tracking

The Service sets an httpOnly cookie with a random anonymous ID, kept for 1 year. Our server uses it to link your credits, purchases, and abuse-prevention checks to your browser. Using the Service also includes the following analytics:

• Vercel Web Analytics and Speed Insights run on our pages. They do not use cookies and collect page-view and performance data, such as the page address, browser and device type, and load times.
• After you accept the terms in the analyzer, Microsoft Clarity records session replays, heatmaps, and interactions such as clicks and scrolling on this site, and may set its own cookies. Text you type, file names, DICOM metadata, rendered medical images, AI chat replies, and analysis result cards are masked. The addresses of links you click can still be captured.
• When you upload or analyze a scan, Clarity also receives a random session identifier and coarse event details, such as the imaging type, body area, and a file-count range. These contain no names, file names, or image content.
• Our server counts product events, such as a started checkout or a completed purchase, as mostly aggregate totals per site.
• We do not use analytics for advertising, remarketing, or cross-site profiling.

Cookies and local storage in your browser also remember your language, theme, model choices, and acceptance of the terms, and take you from the home page straight to the analyzer once you have saved a chat. These cookies are kept for up to 1 year.

6. DICOM Anonymization

The Service includes a built-in DICOM anonymization tool that strips Protected Health Information (PHI) including patient name, patient ID, birth date, institution name, and referring physician names. We strongly recommend using this tool before uploading data if you are concerned about privacy.

7. Data Retention Summary

Card payments are processed by Monobank; we never receive your full card details. When Google Pay is offered at checkout, Google's payment script loads in your browser. The Service is hosted on Vercel. Resend delivers operational emails to us, such as payment notifications and the feedback or support messages you choose to send, with detected email addresses, phone numbers, dates, and ID numbers removed from your text.

8. Your Rights

Your chat history and files are saved in your browser, so you can view them in the app and delete them from Settings at any time. For data on our server, such as credit, purchase, and security records, or data held by our analytics providers, contact us to request access or deletion.

9. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, our legal basis for processing personal data is:

• Consent: You explicitly consent to our Terms of Service and this Privacy Policy before using the Service (via the consent modal).
• Legitimate interest: Temporary processing of rendered images, extracted text, and messages is necessary to provide the Service you requested.
• Contract performance: Processing is necessary to fulfill the service you are using.

Under GDPR, you have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. Since chat data is stored locally in your browser, you can exercise these rights directly. For server-side data, contact us.

10. Data Breach Notification

In the unlikely event of a data breach affecting personal data stored on our servers, such as credit, purchase, and security records, we will notify affected users within 72 hours of becoming aware of the breach, in accordance with applicable data protection laws. Chat history saved in your browser is not stored on our systems.

11. International Data Transfers

The chat messages, rendered images, and extracted text you send, and the analytics data described in section 5, may be processed by providers whose servers are located in other jurisdictions, including the United States. By using the Service, you consent to the transfer of your data to these jurisdictions. We cannot guarantee that all third-party providers meet the standards of your local data protection regulations.

12. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Your continued use of the Service after changes constitutes acceptance.

14. Contact

For privacy questions or requests about the data described in this policy, contact us.

You can reach us at support@jointlens.ai.