DocBuddy Privacy Policy

Effective date: 13 June 2026

Last updated: 13 June 2026

This Privacy Policy explains how DocBuddy ("DocBuddy", "we", "us", or "our") collects, uses, shares, and protects information when you use the DocBuddy mobile application (the "App") and related services (collectively, the "Service"). The App is an educational tool for medical students and healthcare trainees.

If you do not agree with this Privacy Policy, please do not use the Service.

1. About DocBuddy

DocBuddy is an educational application that helps medical students practice clinical reasoning through AI-assisted case discussions, quizzes, mock patient encounters, and study checkpoints.

Contact: info@docbuddy.live
Website: https://www.docbuddy.live/

2. Information We Collect

We collect only the information needed to provide the Service.

2.1 Account and profile information

When you create an account, you provide:

• Email address
• Full name
• Year of study (1–5)
• Institution name
• Interested medical specialties

If you sign in with Google, we receive your name, email address, and Google account identifier from Google in order to create or look up your DocBuddy account. We do not receive your Google password.

2.2 Learning and practice data

• Clinical cases you start, continue, or complete
• Patient practice records that you enter for educational practice
• Quiz attempts, answers, and scores
• Study checkpoints and progress
• Saved preferences such as quiz difficulty and study plan settings

2.3 Voice and audio

Some features (clinical case discussions, "Ask a Senior", mock patient encounters) let you speak instead of typing. When you use these features:

• The microphone is activated only while the feature is in use.
• Your speech may be transcribed and processed by our AI service provider to generate a response.
• Spoken responses are produced using your device's built-in text-to-speech engine; audio playback is generated on your device.

Audio recordings are used to produce a transcript and response for that session and are not used for advertising or sold to third parties.

2.4 Notification preferences and device tokens

If you enable reminders, we store your preferred reminder times, your timezone, and a device push notification token issued by Apple or Google so we can deliver notifications. You can disable notifications at any time.

2.5 Subscription and billing information

DocBuddy offers in-app purchases through the Apple App Store and Google Play. Payment is processed by Apple or Google. DocBuddy never sees or stores your card number, bank details, or full payment information. We receive a purchase receipt or entitlement signal so we can unlock features and record your subscription state and billing-period end date.

2.6 Device and technical information

• A locally stored authentication token (kept in your device's secure keychain or encrypted storage) so you stay signed in.
• Local app data such as cached content and your settings, stored on your device.
• Network status (online/offline) detected on your device; we do not collect IP-based location.

2.7 Information we do not collect

• No third-party analytics SDKs (no Firebase Analytics, Mixpanel, Sentry, Amplitude, or similar).
• No advertising identifiers and no ads.
• No precise or background location.
• No access to your photos, camera, contacts, calendar, or files.
• We do not sell your personal information.

3. How We Use Information

• Create and secure your DocBuddy account and verify your identity at sign-in.
• Personalize your study experience based on your year of study, institution, and selected specialties.
• Generate AI responses to your case discussions, mock patient encounters, and questions.
• Track your progress, surface review prompts, and award checkpoints.
• Process subscriptions, manage entitlements, and provide receipts.
• Send notifications you have opted into (such as study reminders).
• Provide customer support and respond to your messages.
• Detect, investigate, and prevent abuse, fraud, and violations of our Terms of Use.
• Comply with legal obligations.

We do not use your content or recordings to serve advertising, and we do not sell your personal information.

4. Legal Bases (for users in the EEA/UK)

If you are in the European Economic Area or United Kingdom, we rely on the following legal bases under the GDPR / UK GDPR:

• Performance of a contract — to create your account and provide the Service you requested.
• Consent — for optional features such as push notifications and microphone access; you can withdraw consent at any time.
• Legitimate interests — to keep the Service secure, prevent abuse, and improve the product, provided your rights do not override these interests.
• Legal obligation — to comply with applicable laws.

5. Patient-Data Guidance (Important)

DocBuddy is an educational practice tool. When you enter case content for practice, you must not enter information that could identify a real patient.

• Do not enter full names, phone numbers, home addresses, national ID numbers (such as CNIC), hospital record numbers, dates of birth, or other identifiers of real patients.
• Use first name plus initial, an age range, or fictional identifiers when practicing.
• Follow your institution's rules on protected health information at all times.

You are responsible for the content you enter. DocBuddy is not a HIPAA-covered service, is not certified for processing protected health information, and must not be used as part of real clinical care.

6. How We Share Information

We share information only as described below. We do not sell personal information.

6.1 Categories of service providers (sub-processors)

We work with a small set of vetted service providers to operate the Service. Each receives only the data needed to perform its function and is bound by contractual confidentiality and security obligations. The categories below describe the recipients of your information:

Category	Purpose	Data shared
Cloud backend and database provider	Storing your account, profile, learning records, notification preferences, and subscription state; running authentication and server-side functions	Account, profile, learning data, notification preferences, subscription state
Authentication providers (including Google Sign-In)	Letting you sign in with a third-party account, when you choose to	Email, name, and provider account identifier returned by the sign-in provider
App store and in-app billing providers (Apple App Store on iOS, Google Play Billing on Android)	Processing subscriptions and in-app purchases	Purchase receipts and entitlement signals (DocBuddy never receives card or bank information)
Push-notification delivery services (Apple Push Notification service on iOS, Firebase Cloud Messaging on Android)	Delivering reminders and notifications you enable	Device push token and the notification payload
AI / machine-learning service providers	Generating AI responses in case discussion, mock patient, and "Ask a Senior" features, and transcribing voice input from those features	The text of your message, or the audio recorded for that specific voice interaction

We do not sell your personal information, and we do not use these providers for advertising. The specific service providers we use may change from time to time as we improve the Service. If you want the current list of named sub-processors, contact us at info@docbuddy.live and we will provide it.

6.2 Legal and safety disclosures

We may disclose information if we believe in good faith that doing so is necessary to comply with a law, regulation, subpoena, court order, or other legal process; protect the rights, property, or safety of DocBuddy, our users, or others; or investigate or prevent fraud, security incidents, or violations of our Terms of Use.

6.3 Business transfers

If DocBuddy is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this Privacy Policy or a successor policy with equivalent protections.

7. International Data Transfers

Our service providers may store and process information in countries other than the one in which you live. Where required by law, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) for cross-border transfers.

8. Data Retention

We retain your account and learning data for as long as your DocBuddy account exists and for a limited period afterward as needed to resolve disputes; meet legal, tax, accounting, or reporting obligations; and enforce our agreements. When you delete your account, we delete or de-identify your personal data within a reasonable period, except where we are required to keep certain records.

9. Your Rights and Choices

• Access — request a copy of the data we hold about you.
• Correction — ask us to correct inaccurate data; you can update most fields directly in the App.
• Deletion — ask us to delete your account and personal data.
• Restriction or objection — ask us to restrict or stop certain processing.
• Portability — request your data in a portable format.
• Withdraw consent — for processing that relies on consent (such as notifications or microphone access).
• Lodge a complaint — contact your local data protection authority.

How to exercise your rights: In the App go to Settings → Account → Delete account, or Settings → Legal & safety → Data & privacy. By email: info@docbuddy.live. We may need to verify your identity and aim to respond within 30 days (or as required by applicable law).

10. Account Deletion

You can delete your DocBuddy account at any time from Settings → Account → Delete account. Deleting your account permanently removes your profile, learning records, practice records, quiz history, checkpoints, and notification preferences from our active systems.

If you subscribed through the App Store or Google Play, deleting your DocBuddy account does not automatically cancel your store subscription. You must cancel the subscription in your Apple ID or Google Play account.

If you need help, email info@docbuddy.live.

11. Security

• Encryption of data in transit (HTTPS/TLS).
• Encryption of authentication tokens stored on your device using the platform keychain.
• Access controls and least-privilege access for our team.
• Database row-level security for user data on our backend.

No system is completely secure. If we become aware of a security incident affecting your personal information, we will notify you and the relevant authorities as required by law.

12. Children's Privacy

DocBuddy is intended for medical students and healthcare trainees and is not directed at children. You must be at least 16 years old (or the age of digital consent in your country) to use the Service. We do not knowingly collect personal information from children below that age. If you believe a child has provided us with personal information, please contact us at info@docbuddy.live and we will delete it.

13. Third-Party Services and Links

The App may contain links to third-party websites or services (for example, the App Store, Google Play, Google Sign-In, or your institution's resources). Their privacy practices are governed by their own policies, and we are not responsible for their content or practices.

14. Region-Specific Disclosures

14.1 California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to delete it, to correct it, to opt out of any "sale" or "sharing" of personal information, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising. To exercise your rights, contact info@docbuddy.live.

14.2 EEA / UK residents (GDPR / UK GDPR)

See sections 4 and 9 above. The data controller is DocBuddy, contactable at info@docbuddy.live.

14.3 Other regions

We follow the principles of this Policy globally and will honour applicable local data-protection rights on request.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are material, we will provide a more prominent notice (for example, an in-app message). Your continued use of the Service after the changes take effect means you accept the updated Policy.

16. Contact Us

If you have questions, concerns, or requests about this Privacy Policy or your personal information, contact us at:

DocBuddy
Email: info@docbuddy.live
Website: https://www.docbuddy.live/