Effective 17 October 2026. This notice covers My Medical's native app. My Medical is publicly available on the App Store and Google Play in supported countries. Features depend on your platform and installed version. The private browser review has separate host-managed sign-in.
Who is responsible
TRUSTWELL SAFETY LIMITED operates My Medical from New Zealand, trading as Trustwell Safety. Company number: 9347523. NZBN: 9429052891755. For privacy and support enquiries, contact Trustwell Safety at support@trustwellsafety.co.nz. Postal contact: 8 Winton Street, St Albans, Christchurch 8014, New Zealand.
What you choose to share
You choose whether to send a health question, mental-wellbeing message, written report, report photo/PDF or eligible adult skin photo. We ask for consent before AI processing. Without consent, we cannot provide an AI response. Remove unnecessary names, addresses and other identifiers before uploading. Adult intimate medical photos are accepted only through the separate Adult intimate health flow, after confirming you are 18 or older, the photo is of your own external skin, and you understand the processing. Do not upload children, sexual activity, internal images, diagnostic scans or intimate photos of other people. Only share records you are entitled to share.
Our backend forwards the content needed for your request to OpenAI. A chat request may include up to eight recent messages so the reply can follow the conversation. Images may be resized or compressed; this does not guarantee that identifying information is removed. Written reports are sent inline and their original filenames are not forwarded by the report feature. No radiology provider is connected.
Mental-health content is handled in the same way as other health content. This is AI support, not confidential therapy. No clinician or crisis team monitors the conversation.
Accounts and devices
Before native health features are enabled for your account, we ask for your declared age group (under 16, 16–17 or 18+) and country of residence. We store these details, your account ID and the declaration time to apply age, feature and country restrictions. We do not request a date of birth or identity document in this flow. The declaration is not independent age verification. Contact support to correct a mistake or update your age group; it cannot be changed directly in the app. Successful account deletion removes this declaration. An account that is not eligible can still use account-deletion and support options.
When native sign-in is enabled, Supabase processes your email address, account ID and information needed to verify login codes and protect the account. Brevo delivers sign-in messages from sign-in@signin.trustwellsafety.co.nz, with the sender name Trustwell Safety. Brevo processes the recipient address, message content and delivery information for this purpose. Its hosting and database storage are in the European Union, including France, Germany and Belgium. Its transactional service records email opens and link clicks anonymously, without associating those events with specific contacts. Domain-authentication reports are sent to Brevo to help monitor email delivery. Resend previously delivered sign-in mail and may retain earlier delivery records under its retention policies, including in the United States. Sign-in emails do not include your health questions or uploads. The app stores a refresh token in the device's secure storage; active sessions are also checked by the backend. Your language preference is stored separately on your device.
From Android test build 6, completed questions and AI explanations (including photo/report explanations), plus notes you add, save automatically as text in an encrypted journal on the same phone, separately for each signed-in app account. Uploaded photos and PDFs are not saved in the journal. The encryption key is kept in the device's secure storage. Signing out hides the journal; signing back into the same account on that phone restores it. You can delete individual notes or clear the saved journal in the app. Account deletion from that phone clears its local journal before the server deletion request; the local deletion cannot be undone even if the server request fails. There is no journal cloud sync or backup. Removing app data or uninstalling can lose this history. Other devices keep their own local copies; clear those separately. Earlier builds and the private browser review keep notes only for the current session. The journal is not a medical record or a substitute for keeping your original reports. Camera-roll files, downloads, device caches and personal backups are outside the journal's deletion controls.
The application does not intentionally save ordinary questions, uploads or AI replies in its backend database. Choosing Report response is a separate exception, described below. Technical providers may still process information while delivering and protecting the service.
Health Coach and local report library
The AI Health Coach and encrypted report library are available on Android. This section applies to app versions that include these features. Check your installed version and store listing.
The native library saves copies of supported written reports, titles, dates, checked notes and optional health history in encrypted storage on the phone, separately for each account, with a key held in secure device storage. Saving alone does not send content to AI. Imported report images may be resized or compressed. There is no app cloud sync or recovery service. Keep originals: loss of the phone, app data or encryption key can make saved information unavailable. Operating-system backups may include encrypted files, but the device-only key is not intended to migrate. Browser previews use session memory only.
For each coach question, you choose up to three checked report notes and whether to include saved history. After consent, the question, selected report titles, dates and notes, chosen history and response language go through our backend to OpenAI. App versions that support conversational follow-ups may also include up to eight recent messages in that same Coach conversation. Original PDFs/images, unselected reports and prior sessions are not included in that coach request. Sending an original for explanation is a separate action with its own consent. Provider processing and safety retention still apply: local report storage does not mean the AI runs on the phone. Check AI-drafted notes against the original before selecting them.
The controls let you delete reports and notes, edit or remove history, or clear the library. Signing out hides the library until the same account signs in on that phone. Account deletion from that phone clears its local library and journal before the server request completes; this local deletion cannot be undone even if the server request fails. Deletion elsewhere cannot remotely erase an offline phone. Completed coach questions and answers are saved separately in the text journal. Deleting a report will not delete earlier journal entries, source copies in Photos or Files, import caches, or records held by providers under their retention policies.
Reports, support and payments
If you choose Report response and consent, we store the excerpt you review, category, language, feature, account ID, receipt and submission time to investigate it. Photos and conversation history are not automatically attached. Trustwell Safety reviews these reports. Reports normally expire after 30 days at the next hourly cleanup; an ongoing complaint may require a documented longer hold. Deleting the app account removes its submitted reports.
If you contact support, we receive your email address and message through Gmail and use them to answer the request. Send a brief description and app/device version, not medical records, passwords, login codes or card details. Support correspondence is kept while needed to resolve the request and related complaints or legal obligations, then reviewed for deletion.
For subscriptions offered in your app and store, Apple or Google handles payment and RevenueCat helps verify and restore subscription access using an app account ID and purchase information. We do not receive your full card details through the app. A pending-checkout marker, including the attempted product and previous purchase date, may be stored securely on your device until the transaction is resolved. Public Google Play purchases and authorised sandbox test purchases are separate. A test purchase does not establish a public paid entitlement.
Account-linked request counters enforce usage limits and protect service capacity. They store counts and time periods, not the contents of health conversations. RevenueCat provides subscription reporting using purchase history. We do not use an advertising SDK or collect browsing history, and have no HealthKit or Health Connect integration. We do not sell health content or use it for targeted advertising.
To measure and control AI operating costs, we keep account-linked request metadata in our private Supabase database: request times, plan, model, processing outcome, token counts, pricing-rate version and estimated cost in US dollars. These records do not contain your question, AI answer, photos, documents or email address. Access is restricted to authorised service administration. Individual cost records are deleted after 90 days and are removed when your account is successfully deleted. We also keep a per-account record of whether the free first explanation has been used, until account deletion, to enforce the introductory allowance. These records are not used for advertising or AI model training.
Providers, international processing and retention
The native Supabase database is hosted in Sydney, Australia. OpenAI processes AI requests; Cloudflare hosts public information pages; Brevo handles sign-in mail; Resend may retain earlier mail-delivery records; Gmail handles support mail. RevenueCat and the relevant app store process purchase information when connected. Provider operations and support can involve the United States and other countries. A Sydney database does not mean every part of the service stays in Australia. We assess applicable safeguards before introducing a provider or releasing the service in a new market.
AI requests use the provider's setting to avoid saving responses as retrievable application history. This is not a zero-retention promise. OpenAI's standard API policy permits abuse-monitoring retention for up to 30 days, with longer retention for specified legal or safety reasons; image/file safety review and temporary processing caches can have separate rules. Clearing My Medical cannot retract completed processing. See OpenAI's data controls.
Account information and owned counters remain while the account exists, then are removed on successful deletion. Authentication/security audit records, infrastructure logs and provider records may remain for security, fraud prevention, accounting, complaints or legal purposes under applicable provider schedules. Backups, where enabled, expire on their own schedule rather than being individually rewritten for each deletion. We do not promise immediate erasure from every provider or backup.
Provider information: Supabase privacy, OpenAI privacy, Cloudflare privacy, Brevo privacy, Resend privacy, Google privacy, RevenueCat privacy, and Apple privacy.
Product updates and support enquiries
If you email for product updates or support, we use your email address, country, device type and stated preference to respond and manage that request. Do not include health information. You can ask us to stop product updates or delete the enquiry by replying or contacting support.
Your choices, rights and complaints
You can decline AI processing, remove selected uploads before sending, manage camera permissions, delete individual journal entries or clear saved history, sign out and request account deletion. Information needed to operate an account or process a request is necessary for those features; optional health content is your choice.
Contact support@trustwellsafety.co.nz to request access, correction, deletion or an explanation of our handling of your information. We may make proportionate ownership checks. Do not send identity documents unless we agree a suitable method with you. Where applicable law requires a response deadline or other rights, those requirements apply. If we cannot fulfil a request, we explain why and the available complaint route.
Raise privacy concerns with Trustwell Safety first. You can also contact the New Zealand Privacy Commissioner or, where Australian privacy law applies, the OAIC. Other mandatory rights in your jurisdiction are not excluded.
Account deletion instructions explain what is deleted and what may remain. Account deletion does not cancel an Apple or Google subscription; cancel renewal separately through the store.
Sign-in abuse prevention
Updated native builds use Cloudflare Turnstile in your browser before requesting an email sign-in code. Cloudflare processes technical browser, device and connection information to distinguish legitimate requests from automated abuse. The verification page does not receive your email address, health questions, journal or uploads. It returns a short-lived verification token to the app, which submits that token with your email address to Supabase for validation. Closing or failing the check prevents that updated app from sending the email request. The authentication server also validates this verification before accepting a code request. See Cloudflare's privacy policy.
Eligibility and changes
My Medical is intended for people aged 16 and older. My Medical is available in New Zealand, Australia, Canada and the United States, with access limited to countries and features supported by the app stores, our providers and applicable local requirements. A higher local age requirement takes precedence. Availability in these countries does not mean that the service is available or approved in every country.
People aged 16 or 17 may use eligible written health questions, written-report explanations and mental-wellbeing information where supported. Body-photo features remain for adults aged 18 and older, including intimate medical photos of your own external skin through the separate consent flow. Do not submit body photos of anyone under 18. Self-attestation does not independently verify age or ownership. Diagnostic scans are not assessed.
Information for younger users must be understandable and age-appropriate. Where local requirements call for parental or guardian permission or additional age assurance, these requirements must be satisfied through a supported process before access is offered. The app does not currently provide a verified parental-consent service. If required permission cannot be obtained appropriately, the relevant service will not be offered. We do not automatically share a young person's conversations with parents or guardians; requests are assessed for authority, privacy and applicable law.
The service is not intended for users under 16. If you believe an underage account or an underage body photo has been submitted, contact support with the minimum information needed; do not email or resend the photograph. Availability in a language does not mean the service or its medical wording has been approved or clinically reviewed in every country.
We update this notice when relevant practices change and show the effective date with the published version. Material changes requiring notice or consent will be presented before the changed processing begins.
My Medical privacy notice · My Medical terms of use · My Medical support · Delete your My Medical account