Privacy Policy

Effective October 6, 2026

What Did the Doctor Say? (the "app") is made by Desert Gate Holdings ("we", "us"). This policy explains what the app collects, where it goes, and your choices.

The short version

• Your health information stays on your iPhone. Recordings, transcripts, summaries, symptoms, photos, documents, doctors, your insurance card and your health profile are stored only on your device, encrypted, and are left out of iCloud and computer backups.
• If you choose to share with someone, what you pick is locked (encrypted) on your iPhone first. Our server holds only that locked copy, can't read it, and deletes it when the share ends.
• An account is optional. If you create one, it holds your name, email, country and region and your email choices, never health information.
• We do not sell your information, use it for advertising, or track you across other apps or websites.

What stays on your iPhone

Everything health related: recordings and transcripts, visit summaries, your health profile and medicines, information read from Apple Health, symptom, mood and food entries and their photos, scanned or imported records and the tests found in them, your doctors and notes, your insurance card, and AI reports. Transcription happens on the device, and so do summaries.

Apple Health

If you allow it, the app reads information from Apple Health, such as your date of birth, sex, measurements, heart rate, heart rate variability, sleep, breathing rate, wrist temperature, blood pressure, glucose, mindful minutes, moods you log (State of Mind) and connected health records. It uses them to fill in your health profile and to show readiness and stress. The app never writes to Apple Health. Apple Health information is never used for advertising or marketing, is never sold, and is only sent to an AI service if you choose it as a source for an analysis, as described below.

What we collect

Account information (optional). If you sign in with Apple or Google we receive your email address and, if shared, your name (Apple may give us a private relay address). You may add your country and state or region. We store these with your email choices (product updates and newsletters), each off unless you turn it on, with the date and wording of your choice.

Provider details (clinicians only). If you use provider mode while signed in, we store the details you enter about yourself as a clinician: name, credentials, specialty, practice, practice phone, fax, email and address, and NPI. These never include anything about your patients.

Subscription status. When you subscribe, Apple tells us whether your subscription is active. We never see your payment details.

AI usage. If you use the included AI, we record the cost of each request against your monthly allowance. We do not store what you sent or what came back.

Approximate location, only when you search. When you use Doctors near me, your location (or the ZIP code or city you type) is rounded to about 6 miles on your iPhone before the search is sent. The search is not tied to your account or to any health information, and we do not keep it.

When information leaves your iPhone

1. AI analysis, when you ask for it. Before anything is sent, the app removes personal details on your iPhone (names, birth dates, contact details, addresses, record numbers and more; dates become day numbers such as "Day 15"). You see the exact text, and the first time, the app asks your permission, naming the companies that will receive it; you can withdraw that permission in Settings, under AI. With your own key, it goes directly to the AI company you chose: Groq, OpenAI (ChatGPT) or Anthropic (Claude), whose own policies then apply. With the included AI, it goes through our relay to Anthropic (Claude); the relay does not store it. We ask you to check the text before sending and make sure it contains no personal or patient information, for your own privacy.
2. Sharing with a clinician, when you approve it. Transfers by QR code go directly between two iPhones in the same room, encrypted, and never through our servers. A clinician who receives your records is responsible for them under the rules that apply to them.
3. Sharing with someone you choose. You pick what to share (for example visit recaps, medicines and labs) and for how long. Your iPhone encrypts it before it's sent, and our server stores only the encrypted copy. The key to open it is in the link you send, in the part after the # sign, which web browsers never send to any server, and the person also needs a 6-digit code you tell them. So we can't read what you shared. The stored copy is not linked to your account, your name or your device. It's deleted when it expires, when you stop sharing, or after five wrong codes; a share set to end after it's opened is deleted 30 minutes after the first open. If you keep someone updated, your iPhone replaces the copy when your records change. We record only when a share was opened and how many times, so you can see it; we don't record who opened it. Once someone opens what you shared, they can save or copy it, and it's then in their care.
4. Exports and backups you make. PDFs and encrypted backups go wherever you choose to send or save them.

Our website

The website counts visits without cookies or tracking: for each page we record the day, the page and the name of the site you came from (for example "reddit.com"), as a running total. We do not store your IP address or any identifier. Short links such as whatdiddocsay.com/go/... and invite links count clicks the same way. If you join the launch list, we keep your email address and the choice you made, and use it only for what you agreed to. You can ask us to remove it at support@whatdiddocsay.com.

Partner codes. If you enter a partner's code under "Who sent you?" when you subscribe, the app sends that code with Apple's signed record of your purchase, so the partner can be paid when Apple charges you. We store only the code and the purchase's transaction number: not your name, account or anything about your health. If you join the partner program yourself, we keep your name, email, payout details, where you said you'll share, and your code's clicks and earnings, and use them only to run the program and pay you.

Invite codes. If you enter a friend's invite code in the app, we record which account invited yours and when, so the friend can be thanked. Nothing about your health is involved.

Service providers

Account and subscription information, and the locked copies of anything you share, are stored with Supabase, our database host, in the United States. Our website is served by Cloudflare. The included AI is provided by Anthropic (Claude). These providers process information only to run the service for us.

AI providers. What reaches an AI provider is only the de-identified text you reviewed and allowed, used only to write the analysis or assessment you asked for. Anthropic (included AI) receives it under its commercial API terms, which require it to keep the text confidential and secure and not use it to train its models, giving it the same or equal protection described in this policy. If you use your own key, your text goes directly to the company whose key it is (Groq, OpenAI or Anthropic) under your own agreement with them; their API terms likewise exclude training on it.

Your choices

• Use the app without an account; only the included AI needs one.
• Change your email choices any time in Settings, or use the unsubscribe link in any email.
• Delete your account in Settings, Account, Delete account. This removes your account, contact details and provider details from our systems. Health information on your iPhone is not affected; delete it in the app or by deleting the app.
• Ask for a copy of your account information, or for it to be corrected, at support@whatdiddocsay.com.

Children

The app is not directed to children under 13, and we do not knowingly collect information from them.

Security and encryption

• On your iPhone. Everything the app stores is protected by iOS Data Protection at its strongest level ("complete protection"). iOS encrypts each file with its own AES-256 key, and those keys are protected by a key made from your device passcode together with a secret built into the iPhone's hardware. While the phone is locked, the files can't be read, even by the app. Recordings in progress use the next level down ("complete unless open") so a recording keeps going if the screen locks; once it stops, it is fully protected. This protection depends on your iPhone having a passcode, and the app warns you if it doesn't.
• Not in backups or the cloud. The app's files are marked to be left out of iCloud and computer backups, and its database is not synced to iCloud.
• The app lock. Face ID or your passcode is needed to open the app. This controls who can open it; the encryption above is what protects the data itself.
• Sharing with a clinician. The QR code carries a one-time session code and a random 256-bit key. The two phones connect over Wi-Fi or Bluetooth with Apple's Multipeer Connectivity set to require encryption, and everything sent is also sealed with AES-256-GCM using the key from the QR code, so only the phone that scanned it can read it. No server is involved.
• Sharing with someone you choose. Each share has its own random 256-bit key and a random 6-digit code. Your iPhone seals it with AES-256-GCM, using a key derived (HKDF-SHA256) from both. To fetch the sealed copy, the person's browser or app proves it knows the code with an HMAC-SHA256 made with the link key; our server keeps only a hash of that proof, so it learns neither the key nor the code. Opening happens in their browser or app, never on our server. Sharing pages load no analytics, are not indexed by search engines, and send no referrer.
• Backups you export. A backup file is encrypted with AES-256-GCM using a key made from the password you choose (PBKDF2-HMAC-SHA256, 310,000 rounds, with a random salt). Without the password it can't be opened, by anyone, including us.
• AI requests. De-identified text you approve is sent over HTTPS (TLS). Our relay for the included AI passes it to Anthropic and doesn't store it.
• Your account. Account information is protected in transit and at rest by our database host, and each person can reach only their own account.

Changes

We will post changes here and, for significant changes, tell you in the app.

Contact

Desert Gate Holdings, support@whatdiddocsay.com.