Privacy notice
Last updated 27 October 2026
What we store
Your account details, the projects you create, and the files you upload. Uploaded clinical data is stored as files rather than in the application database, and the database holds only metadata about it.
Protected health information
Fields that look like PHI are detected automatically and excluded from AI prompts, charts and exports until a person decides otherwise. Treating a field as less sensitive requires a justified request that an account owner approves, and every such decision is recorded.
What leaves the system
AI features send the minimum context required for the task, never raw clinical rows. A request that would carry protected data outside the approved boundary is blocked rather than trimmed silently, and the block is explained.
Logging
Application logs carry correlation identifiers so a failure can be traced. They are filtered so clinical values, credentials and provider keys do not reach them.
Security activity
Sign-ins, sign-outs, uploads, exports and sensitivity decisions are recorded with the time and the person who acted. You can see recent activity on the settings page. Account owners see activity for their whole workspace; other members see their own. These records hold no file names and no patient details.
Automatic sign-out
You are signed out after 30 minutes without activity, and every session ends after 12 hours. This protects your data on a shared or unattended computer.
Deletion
Deleting a project removes its data and the artifacts derived from it. Audit records of privacy-relevant decisions are retained, because their purpose is to survive the thing they describe.
Contact
Questions about this notice, or a request to access or delete your data, can be sent to the FairPeak team. Deleting a whole account is handled by the team for now, not from settings.