Privacy

Last updated 13 July 2026

Ouvela helps people understand medical records. We take the privacy of those records seriously, because they are among the most sensitive things a person owns. This page explains, in plain language, what we collect, how it is used, and the controls you have. It is a summary written to be read, not a substitute for the full legal terms.

What we collect

• The records you add (photos or PDFs of lab reports, prescriptions, and clinic notes) and the plain-language explanations we produce from them.
• Account basics needed to run your account: your name, email, and the people you add or care for.
• Operational data needed to keep the service secure and working, kept to the minimum required.

How your records are used

Your records are used for one purpose: to save them, translate them into plain language, and organize them on your timeline. Specifically:

• Never used to train AI. Your records and their explanations are not used to train or improve any AI model.
• Never sold. We do not sell your data, and we never show it to advertisers.
• Explained, never diagnosed. We put records into plain words and define terms. We do not provide diagnosis or medical advice.

Who can see your records

Records are scoped to your account by row-level security in the database. Each account’s records are kept isolated from other accounts’ by design. Within your account, the people you invite see the records their roles allow. Privileged access is intended to be least-privilege and logged; audit coverage across application, infrastructure, and support paths is validated separately.

Where your records are stored

Records are stored encrypted on Amazon Web Services in a fixed region. When a record is read, processing runs only through covered providers under signed Business Associate Agreements, with zero-retention controls where applicable. Processing geography can differ from storage geography.

Your controls

• Export. You can export your records and their explanations at any time.
• Delete. You can remove an individual record yourself at any time. Account deletion follows a verified request and documented retention/deletion process.
• Invitations. You decide who has access, and you can remove access.

Contact

Questions about privacy can be sent to the address in your account settings. We will respond promptly.