MediGuide AIEffective date: 2 October 2026
This policy explains what MediGuide AI collects, why, who receives it, how long it is kept, and the choices you have. MediGuide AI is a general health-information app. It is not a medical device and does not diagnose or treat any condition.
1. Who we are
MediGuide AI (“we”, “us”) is developed by AI Mediguide in Dhaka, Bangladesh. Contact us about privacy at [email protected].
2. What we collect
Account information. Your name, email address and username are collected when you register. Your password is stored only as a one-way hash. If you sign in with Google, we receive your Google account’s email address, name and a Google account identifier.
Profile information you choose to add. This can include your phone number, date of birth, blood group, weight, profile photo and medical interests.
Health information you enter or sync.
- Medication schedules: the medicine name, dose and reminder times.
- Meals you log, with their nutrition values.
- Symptoms you describe to the Symptom Checker, together with the answer it gave.
- Daily health records: heart rate, blood oxygen, steps, calories and sleep.
Health Connect data. With your permission, the app reads steps, heart rate, sleep, total and active calories burned, and blood oxygen from Android Health Connect.
- These readings are kept on your device so the app can show them.
- When you connect a wearable through the app, up to the last 8 days of these readings are uploaded to your account as daily health records, unless you turn off Back up Health Connect data in Data & Privacy.
See section 6 for how Health Connect data is used.
Photos you scan. These are photos of medicine labels, prescriptions and meals. They are sent for analysis (see section 4) and are not stored on our servers.
Chat. If you use chat, we store:
- the messages, photos, videos and files you send;
- who you are chatting with;
- whether a message was read.
Reports. If you report an AI answer, a message or a user, we store the report and a copy of the reported text.
Devices. For wearables you connect, we store the device name, model, type, Bluetooth address and sync times.
Sign-in and security information. When you register, sign in or change your password, we record:
- the time and your IP address;
- the app’s user agent;
- a random identifier for your installation of the app.
To show this in security emails (“a new sign-in to your account”), the app also looks up your approximate location (city, region, country) and time zone from your IP address (see section 5). This location is used only in that email and is not stored.
Crash reports. If the app crashes, we receive a technical report through Firebase Crashlytics. It contains the error, the device model, the Android version and an installation identifier. We do not attach your name, email or any health information.
We do not collect your precise location. On Android 11 and below, the system requires location permission for Bluetooth scanning. The app uses it only to find nearby wearables.
3. How we use it
We use this information to:
- Run your account: registration, sign-in, email verification, password reset and account security, including locking an account after repeated wrong passwords.
- Provide the features you use: the symptom checker, the AI coach, medicine search and scanning, nutrition analysis, health tracking and reports, medication reminders and chat.
- Send you service emails: verification codes, a welcome email, password and security alerts. We do not send marketing email.
- Keep the service safe: review reports, stop abuse and investigate security events.
- Fix crashes and bugs.
We do not sell your information, use it for advertising, or build advertising profiles. The app contains no ads and no analytics or tracking SDKs.
4. AI processing
The symptom checker, the coach, medicine search, prescription and food scanning, and the daily insight are answered by an AI model run by Groq. To answer, we send it what that feature needs:
- your question and the conversation so far;
- the medicine name;
- the photo you took;
- for the daily insight, today’s heart rate, steps, sleep and calories.
We do not send your name, email or account identifier with these requests. The request passes through our server, which adds safety instructions. Groq processes it to produce the answer; see Groq’s own privacy policy for how it handles API data.
AI answers can be wrong. They are general information, not medical advice.
5. Who receives your information
We share information only with the service providers that run the app, and only for the purpose stated:
| Provider | What it receives | Why |
|---|---|---|
| Supabase | All account, health, chat and report data listed above | Hosting our database, file storage and server functions |
| Groq | The AI requests described in section 4 | Generating AI answers |
| Google (Sign-In) | Your Google sign-in | Signing in with Google, if you choose it |
| Google (Firebase Crashlytics) | Crash reports | Fixing crashes |
| Google Fonts | Your device’s IP address, when the app downloads its fonts | Displaying text |
| Brevo | Your email address and the content of service emails | Sending emails |
| ipwho.is, ipinfo.io | Your device’s IP address | Approximate location for security emails |
| Medex (medex.com.bd) | The medicine name you search for | Looking up medicine information |
Other users of the app. People you chat with, and people browsing the chat directory, can see your name, your profile photo and whether you are online. They cannot see your email address.
Legal reasons. We may also disclose information when the law requires it, or to protect someone’s safety.
Some providers process data outside Bangladesh, including in the United States.
6. Health Connect data
MediGuide AI’s use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.
- What it is used for. Health Connect data is used only to show your health metrics, trends and reports in the app, and to give AI insights you ask for.
- What it is not used for. It is never used for advertising and never sold. It is shared only as described in sections 4 and 5, and only to provide these features.
- How to stop. You can withdraw access at any time in Android Settings → Health Connect.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account, profile, health, medication, nutrition, chat and device data | Until you delete it or delete your account |
| Sign-in sessions | Up to 90 days. You are signed out after 30 days without use. |
| Verification and reset codes | Valid for 10 minutes, deleted within 30 days |
| Security logs (sign-ins, password changes) | 12 months |
| Reports | While they are reviewed, and up to 12 months after |
| Crash reports | 90 days (Firebase Crashlytics) |
8. Your choices and rights
- See and correct: you can view and edit your profile in the app.
- Delete: you can delete your account in the app
(Settings → Data & Privacy → Delete account), or from the web; see
Delete your account.
- This permanently removes your account and the data listed in section 7. Your chat conversations are removed for both people, with the messages and files in them.
- Data & Privacy switches in the app:
- Share health data with AI: off means today’s vitals are not sent for the dashboard insight.
- Back up Health Connect data: off means Health Connect readings stay on your phone and are not uploaded.
- Screenshot protection: blocks screenshots and screen recording.
- Health Connect: you can turn access off in Android Settings.
- Notifications: you can turn notifications and reminders off in the app’s Settings.
- Ask us: email us for a copy of your data or with any other privacy request. We reply within 30 days.
9. Security
- Data is encrypted in transit (HTTPS).
- Passwords are stored only as strong one-way hashes.
- Database access rules let each user reach only their own records.
No system is completely secure. If we learn of a breach that affects you, we will tell you.
10. Children
MediGuide AI is for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a child has created an account, contact us and we will delete it.
11. Changes to this policy
If we change this policy, we will update the effective date above. If the change is significant, we will also tell you in the app or by email.