Privacy Policy

We collect the information you provide and a limited amount that is generated automatically when you use SymptoSeek:

• Account information — your name, email address, and password (stored only as a salted hash, never in plain text). If you sign in with Google, we receive your name, email, and profile picture from Google.
• Profile & health information you enter — age, gender, and any medical details you choose to add such as blood group, height, weight, allergies, conditions, medications, surgeries, family history, and emergency contact.
• Health activity — symptoms, vitals, mood check-ins, reminders, appointments, and uploaded medical reports.
• Chatbot conversations — the messages you send to our AI assistant and any documents you upload for analysis.
• Technical & security data — sign-in activity including approximate location, IP address, and device/browser, used to secure your account.

We use your information to operate and improve the service, specifically to:

• Create and manage your account and authenticate you (including two-factor authentication, if enabled).
• Provide AI-assisted health information, symptom guidance, and personalized insights.
• Help you discover doctors and request appointments.
• Send transactional emails (verification, password changes, security codes) and reminders you set up.
• Detect, prevent, and investigate fraud, abuse, and security incidents.

We do not sell your personal information, and we do not use your health data for advertising.

To generate responses, the messages and documents you send to the AI assistant are processed by third-party AI providers on our behalf. We send only the content needed to produce a reply and do not include unnecessary identifiers. These providers process the content to return a response and act as our service providers.

AI responses are generated automatically and may be incomplete or inaccurate. They are general information only and are not a medical diagnosis. Always confirm important decisions with a qualified healthcare professional.

We share information only with service providers that help us run SymptoSeek, and only as needed:

• Cloud database hosting (MongoDB Atlas) — stores your account and app data.
• Image hosting (Cloudinary) — stores profile pictures and uploaded images.
• Email delivery (Resend / SMTP) — sends verification, security, and notification emails.
• AI processing — generates chatbot and report-analysis responses.
• Google Sign-In — if you choose it, to verify your identity.

We may also disclose information if required by law, to enforce our Terms of Service, or to protect the rights, safety, and security of our users and the public.

We use your browser's local storage to keep you signed in (your session token) and to remember preferences such as your language and theme. We do not use third-party advertising or tracking cookies. Clearing your browser storage will sign you out.

We protect your data with measures including encrypted connections (HTTPS), hashed passwords, scoped access tokens, optional two-factor authentication, and rate limiting on sensitive endpoints. No method of transmission or storage is completely secure, so we cannot guarantee absolute security — but we work to protect your information and to respond promptly to any incident.

We keep your information for as long as your account is active. You can delete your account at any time from Settings → Danger Zone. Deleting your account permanently removes your profile and cascades to your appointments, reminders, notifications, reports, and feedback. Some records may be retained briefly where required for legal, security, or backup purposes before being purged.

You can:

• Access and update your profile and health information from your account at any time.
• Download a conversation summary from the chatbot.
• Disconnect a linked sign-in provider (e.g. Google) from Settings.
• Delete your account and associated data.

To exercise any other privacy right, email us at hello@symptoseek.com.

SymptoSeek is not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it. Minors should use SymptoSeek only with the involvement of a parent or guardian.

SymptoSeek is operated from Bangladesh and relies on cloud providers that may store and process data in other countries. By using the service, you understand that your information may be transferred to and processed in locations outside your own, with safeguards appropriate to the provider.

We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you. Your continued use of SymptoSeek after an update means you accept the revised policy.

If you have questions about this Privacy Policy or how we handle your data, email hello@symptoseek.com.