Privacy policy

The short version

• Your medical information is confidential. We never sell it or use it for advertising.
• Nothing is requested from a provider and nothing is sent to an AI provider unless you sign for it, and you can revoke either at any time.
• Your site is private by default and you can delete it whenever you like.

What we collect

• Account details: your email address, your name if you sign in with Google, and sign-in times.
• What you put on your site: the condition, story, goals, journal entries, and any records you upload.
• Records requests: if you sign a records authorization, the patient's legal name, date of birth, state, contact details, the providers and record types you chose, your typed signature, and the date, time, IP address, and browser used to sign. These are the details providers need to match a request to a chart.
• Records we receive: copies of the records providers send under your authorization.
• Technical logs: standard server logs and an access log of who viewed or changed a records request, kept for security and accountability.

Vocal does not use advertising trackers or third-party analytics, and does not track you across other websites.

Who can see it

• You, and anyone you deliberately share a site link with.
• The patient who signed a records authorization, who can always view, print, and revoke it.
• Records-desk operators designated by Vocal, only as needed to obtain and deliver the records in a signed authorization.
• The providers you name, who receive the signed authorization and the patient details needed to locate the chart.
• Service providers that run Vocal under confidentiality obligations: Vercel for hosting, a managed Postgres database host for storage, and Resend for email. Medical records and signed authorizations are never attached to emails, and notification emails omit names, conditions, providers, and record contents.
• Anthropic, only when you separately authorize AI processing (see below).
• Legal requirements: we disclose information when the law requires it, and we will tell you unless we are legally barred from doing so.

Records requests

A signed authorization controls exactly what may be requested, from whom, for what purpose, and until when. The provider identities and record scope are frozen at signing; changing them requires a new authorization. Vocal's authorization currently supports only patients who are at least 18 and live in California, requesting records from providers located in California. It expressly excludes psychotherapy notes, substance-use-disorder treatment records protected by 42 CFR Part 2, HIV/STI, genetic, and reproductive-care records that require specific authorization, and records for care a minor authorized on their own.

AI processing is separate and optional

Authorizing providers to release records does not authorize AI processing. Unless the patient separately opts in and the operator has enabled the feature, records are stored without being sent to an AI provider. When separately authorized, Vocal sends record contents and relevant site context to Anthropic's API solely to extract and summarize them for the personal site, never for advertising or model training. Vocal does not use Anthropic's consumer chat products for this. A site owner cannot override a different patient's refusal or revocation.

Your choices and rights

• View, print, or revoke a signed authorization from your signed copy at any time. Revocation stops future requests or processing but cannot undo action already completed.
• Delete your site from its settings. This removes its records, content, invitations, and processing tasks from the application database.
• Ask us to access, correct, or delete your personal information, or to send a paper copy of a signed authorization at no charge, by emailing raymond@rayxc.com. We respond within 30 days.
• California residents may also ask what personal information we hold and how it is used. We do not sell or share personal information for advertising, so there is nothing to opt out of.

How long we keep it

Your site and its records stay until you delete them. Signing links expire after seven days. Signed authorizations, revocations, and the access log are kept for seven years as legal evidence of what was consented to and when, even after a site is deleted; these evidence records contain the authorization itself, never the medical records. Infrastructure backups are removed on our providers' standard schedules.

Security

Data is encrypted in transit and at rest by our hosting and database providers. Sign-in uses one-time links or Google, so there is no password to steal. Access to records requests is limited to the people listed above and is logged. If a security incident affects your information, we will notify you as the law requires.

Children

Vocal is for adults. We do not knowingly collect information from anyone under 18, and the records authorization cannot be signed for a minor.

Do Not Track

Vocal does not track visitors across other sites or serve targeted ads, so it behaves the same whether or not your browser sends a Do Not Track signal.

Changes to this policy

When we change this policy we update the effective date above. For meaningful changes we email account holders before the change takes effect.

Limits

Vocal is a personal information and records-retrieval service, not a health-care provider, emergency service, or substitute for professional medical advice. Do not use Vocal for an emergency. See the terms of service for the full picture.

Questions or requests

Contact raymond@rayxc.com or write to Rayxc, Inc., 65 Cleary Ct Apt 7, San Francisco, CA 94109.