Privacy Policy
HeyDoc! keeps what it needs to run your account: who you are, the cases you write and the text of your conversations. Your voice is never recorded or stored by us. We do not sell data, show ads or use tracking cookies. You can ask us to delete everything at any time.
Who we are
This policy is provided by HeyDoc! ("we", "us"). We decide how the information described here is used. Contact us at support@heydocapp.com.
What we collect
Your account
When you sign in with Google, Google tells us your name, email address, a Google account identifier and a link to your profile picture. We never see your Google password.
Cases you write
The case title, the case text you paste and the patient HeyDoc! builds from it, including any learner name and timer you set.
Conversations
The written transcript of each conversation, who was practising, when it ended and how long it lasted. Audio travels directly between your browser and OpenAI, and we do not record or keep it.
Usage and billing
How much talk time each call used, your plan and its status, and a reference to your customer record at Polar, our payment provider. Card details go to Polar and never reach us.
Technical information
Sign-in session records, request logs (such as the page or address requested, the time and any error) kept for up to 7 days, and short-lived counters that stop abuse. Bot checks when you sign in, check out or save a case are run by Cloudflare Turnstile.
How we use it
- To run HeyDoc!: sign you in, build patients from your cases, connect live conversations and save transcripts.
- To apply your plan: patient and talk-time limits, trials and billing.
- To keep the service safe: stopping bots, abuse and misuse of the voice service.
- To answer you when you contact us.
What we do not do
We do not sell or rent your information, show advertising, or use analytics or advertising cookies. We do not use your cases or transcripts to train AI models, and we ask OpenAI not to store them for later use.
Who processes it for us
These companies handle information on our behalf, only to provide HeyDoc!:
- Cloudflare hosts the site and its database, keeps request logs and runs bot checks; see Cloudflare's privacy policy.
- Google signs you in.
- OpenAI runs the live voice conversations and reads each case to build the patient. We send these requests with storage turned off, and with an anonymous code instead of your name or email. OpenAI states that it does not train on business API data by default and may keep it for up to 30 days to detect abuse; see OpenAI's business data commitments.
- Polar sells subscriptions as our merchant of record and processes payments, taxes and refunds; see Polar's privacy policy.
These providers may process information in the United States and other countries. We may also disclose information if the law requires it.
No real patient information
HeyDoc! is built for training cases, not health records. Do not paste anything that could identify a real patient, such as names, dates of birth, record numbers, addresses or photos. If you notice you have, delete that patient or contact us and we will remove it.
How long we keep it
- Your account, patients and transcripts stay until you delete them or ask us to delete your account.
- Deleting a patient also deletes its transcripts.
- When you ask us to delete your account, we do so within 30 days. Database backups roll over within a further 30 days.
- Request logs are kept for up to 7 days, and sign-in sessions end after 30 days.
- Polar keeps payment records for as long as tax and accounting law requires.
Your choices and rights
You can download any transcript and any patient's trainer script from your dashboard. To see, correct, export or delete anything else we hold about you, or to object to how we use it, email support@heydocapp.com from your account's address. We reply within 30 days.
Depending on where you live, you may also have the right to complain to your data protection authority.
Age
HeyDoc! is for people aged 16 or older. We do not knowingly keep information about anyone younger; if you believe we do, contact us and we will delete it.
Security
Everything is sent over encrypted connections. Sign-in sessions are stored only as one-way codes, secret keys stay on our servers, and each account can only reach its own patients and conversations. No system is perfectly secure; if we learn of a breach that affects you, we will tell you without undue delay.
Changes
We will update this page and its date when our practices change, and email you before any change that affects how your information is used. The Terms and Refund Policy cover the rest of our agreement with you.