Pulse Health AI collects the following categories of personal and health-related data to provide our services:

• Symptoms you report through Symptom Check and AI Chat
• Health records and medical history entered in My Health Record
• Medications, dosages, and reminder schedules you save
• Mood entries, mental health check-in responses, and journal notes
• Workout plans, exercise logs, and weight progress entries
• Insurance profile information (provider, plan name, member ID) — optional
• Device location, if you explicitly enable it for local provider search
• App usage analytics (feature usage, session duration) — anonymized

Your data is used solely to deliver and improve Pulse Health AI services:

• Generate personalized health insights, symptom assessments, and AI-driven recommendations
• Send medication reminders and health-related notifications you configure
• Improve our AI models and app features using anonymized, aggregated data patterns
• Display relevant cost estimates and insurance coverage guidance when you choose to use those features
• We never sell, rent, or share your personal health data with third parties for advertising or marketing

Pulse Health AI is committed to protecting your health information in accordance with the Health Insurance Portability and Accountability Act (HIPAA). We implement administrative, physical, and technical safeguards designed to maintain the confidentiality, integrity, and availability of your protected health information (PHI).

While we follow HIPAA-aligned practices, please note that Pulse Health AI is a general wellness and health information tool and does not replace a covered healthcare provider. For formal medical diagnosis or treatment, always consult a licensed physician.

We employ industry-standard security measures to protect your data at every layer:

• All data is encrypted in transit using TLS/SSL (HTTPS)
• Data at rest is encrypted using AES-256 standards
• Database access is protected by Row-Level Security (RLS) so only you can access your records
• Authentication is handled via secure OAuth 2.0 and JWT sessions with automatic expiration
• Regular automated security audits and dependency scanning are performed
• Our backend is powered by Lovable Cloud with enterprise-grade infrastructure security

Pulse Health AI integrates with the following third-party services to deliver core functionality:

• Lovable Cloud — secure backend database, authentication, and file storage
• Apple In-App Purchase — processes subscription purchases made inside the iOS app; payment is charged to your Apple ID account and Pulse never receives or stores your payment card details
• Stripe — processes subscription purchases made on the Pulse website (PCI-DSS compliant); Pulse receives only the identifiers required to manage the subscription and does not store card numbers
• AI providers — Google (Gemini) and OpenAI — process the text of your question and any photo you upload to return general health information; personal identifiers (name, email, account ID) are never sent. See AI Services & Your Consent below for full details

Each provider is bound by their own privacy and security commitments. We only share the minimum data necessary for each integration to function.

Some Pulse features are powered by third-party artificial intelligence services. Before any AI feature is used, Pulse asks for your explicit consent inside the app — not only in this policy or our Terms. The first time you trigger any AI-powered feature (Symptom Guide, AI Chat, Medication Identifier, Lab Reference, Testosterone Reference, or Mental Health Reference), a one-time disclosure appears and you must tap "I agree" before anything is sent. No AI feature is enabled until you accept, and the choice is stored on your account so it does not reappear in later sessions. You can withdraw consent at any time by deleting your account in Profile.

What is sent. Only the text you write or dictate — the symptoms, questions or notes you describe — plus any photo you choose to upload.

Who receives it. Third-party AI providers — Google (Gemini) and OpenAI — which process the text and return general information.

Personal identifiers are removed. Your name, email and account ID are never included in the request. The AI providers receive only the text of your question.

Pulse provides general wellness and educational information only — not a diagnosis or medical advice. AI providers are bound by their own privacy and security commitments, and we only share the minimum data necessary for each request to function. AI providers may retain submitted text and images for a limited period under their own policies; do not include sensitive details you do not want processed by a third party.

You have full control over your data. At any time, you can:

• Access — view all health records, medications, mood history, and workout data stored in your account
• Export — download your complete data as a structured file by contacting privacy@docpal.health
• Correct — update any inaccurate information directly in the Profile and Health Record screens
• Delete — permanently delete individual records or your entire account and all associated data
• Withdraw consent — revoke HIPAA consent and data processing permissions from the Profile screen

Subscription purchases made in the iOS app are managed by Apple: you can view, change, or cancel them in your Apple ID account settings, and Pulse cannot cancel them for you. Subscriptions purchased on the Pulse website are managed through Stripe from the Profile screen.

Pulse Pro costs $9.99 USD per month. How your payment is handled depends on where you subscribe:

• iOS app — purchases are processed by Apple through In-App Purchase. Payment is charged to your Apple ID account at confirmation of purchase. The subscription renews automatically unless cancelled at least 24 hours before the end of the current period. You manage or cancel it in your Apple ID account settings; Pulse cannot cancel it for you. Pulse does not receive or store payment card details for these purchases.
• Pulse website — purchases are processed by Stripe. Pulse receives only the identifiers required to manage the subscription and does not store card numbers.

In both cases we store only your subscription status, plan, renewal date, and the provider identifiers needed to keep your access in sync. This billing data is protected by the same encryption and access controls described under Data Encryption & Security, and card data never reaches our servers.

Pulse Health AI is not intended for users under the age of 18. We do not knowingly collect personal or health-related data from children. If you believe a child under 18 has provided us with personal information, please contact us immediately at privacy@docpal.health and we will delete the information promptly.

You can permanently delete your Pulse Health AI account and all associated data at any time:

• Go to Profile → scroll to the bottom and tap 'Delete my account'
• Confirm the deletion — this action is irreversible
• All health records, medications, mood history, workout plans, insurance info, and chat history will be permanently removed within 48 hours
• Subscription data may be retained for legal/tax purposes for up to 7 years per applicable law

For account deletion assistance, email privacy@docpal.health.

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or app features. When we make material changes, we will notify you via an in-app alert and update the effective date at the top of this page. Continued use of Pulse Health AI after changes constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding your privacy or this policy, please reach out to us: