This page covers two things: themedstory.com, MedStory's marketing website and waitlist, and the MedStory product itself — a personal and family health-record vault currently available to a closed beta of early users. If you're a waitlist visitor, the only data we collect from you is the email address you give us. If you're a closed-beta user, MedStory also stores the account details, health records, and family member information you choose to add to your vault.
We don't sell your data, we don't share it with advertisers, and we don't use it for anything beyond notifying waitlist visitors and running the product for closed-beta users.
This page covers themedstory.com — the informational website you're reading, including the waitlist — and the MedStory product itself, currently available to a closed beta of early users. If you're using the product during this closed beta, this is the privacy policy that applies to you today.
As MedStory scales toward a full public launch, we expect this policy to be revised and expanded — including a more detailed, product-specific privacy policy as the platform and its compliance obligations mature. Material changes will always be reflected on this page with an updated effective date.
Your email address only — the waitlist form doesn't collect your name or any other information. No health information, no payment details.
Basic, non-identifying technical information via Cloudflare Web Analytics (page views, referring pages, device/browser type, approximate country/region-level location) — aggregate and cookieless, not used to build an advertising profile, not linked to your waitlist email or your MedStory account.
If you're a closed-beta user, MedStory stores: your account details (name and login credentials); information about any family members you choose to add to your vault (relationship, date of birth, and similar demographic details); and the health documents you upload — lab reports, prescriptions, discharge summaries, and similar — along with the structured data extracted from them (test results, medications, dates, and AI-generated summaries). MedStory doesn't currently process any payment information; the closed beta is free to use.
MedStory doesn't independently collect consent from family members you add to your vault — they don't hold their own MedStory account or login. By adding a family member's information, you're confirming you have the authority or permission to do so on their behalf (for example, as their parent, child, spouse, or caregiver).
To notify you when MedStory is available and share meaningful pre-launch updates (waitlist). To provide the core MedStory product to closed-beta users — organizing, parsing, and storing the health records you choose to upload, and enabling the family-vault and provider-sharing features you use. Basic analytics to understand which pages are useful. Never for advertising or behavioral profiling, and never to sell your data.
Your waitlist email address is sent directly to Amazon SES (AWS's email-sending service), which stores it on our behalf and sends the waitlist confirmation email. The website itself has no backend storage of its own.
Hosts this website; the waitlist form is processed through a Cloudflare Pages Function before being relayed to our email provider. No copy of your submission is retained in this website's infrastructure.
The MedStory product runs on Vercel (application hosting), Supabase (database and account authentication), and Cloudflare R2 (encrypted storage for uploaded documents) — primarily hosted in India. Health records stored in R2 are encrypted at rest (AES-256); all connections to MedStory are encrypted in transit (TLS). Access to your data is restricted at the database level so only your own account can read your records and those of family members you've added — no other MedStory user can query your data.
When you upload a report, MedStory uses third-party AI providers (OpenAI and Google Gemini) to read the document and extract structured health data from it. We do not permit these providers to use your data to train their models.
You can generate a time-limited link to share a filtered summary of your (or a linked family member's) records with a healthcare provider. These links never expose your original uploaded files — only the summary information you choose to include — and can be revoked at any time or left to expire automatically.
We don't sell your data, share it with advertisers or data brokers, or use "research partnership" arrangements as a backdoor to monetize your information — for waitlist emails or for the health records in your MedStory vault.
Yes — the MedStory product, currently in closed beta, stores real health information: lab results, prescriptions, medical history, and similar records for you and any family members you add. themedstory.com's static marketing pages themselves still don't process health data directly; your vault and its data live in the product application described above.
India's DPDP Rules 2025, notified on November 13, 2025, confirmed the Act does not create a separate "sensitive personal data" category — a tier that was proposed in an earlier draft was dropped from the final law. So health data isn't singled out for a distinct statutory tier the way it is under some other countries' data protection regimes; MedStory applies elevated care to health data as a matter of our own policy, not because the law mandates a separate category for it. The Act's procedural rollout — Consent Manager registration, the Data Protection Board — is a separate, genuinely ongoing timeline that continues to phase in through 2027.
As the "data principal," you can access, correct, or erase the data we hold about you — including your account, family member information, and uploaded health records — and withdraw consent at any time from your account settings. Consent for our waitlist is free, specific, informed, unconditional, and unambiguous — submitting the form means agreeing only to be contacted about MedStory's launch, nothing more. Consent to use the MedStory product is given when you create an account and accept its terms.
We retain your waitlist email until MedStory launches or you ask us to remove it, whichever comes first. If you're a closed-beta user, you can delete your account and data at any time from your account settings — either as a reversible 30-day soft-delete (with a window to reactivate) or an immediate, permanent erasure. Deleting your account removes your profile, family member records, health reports, lab results, and medications, along with the original uploaded files behind them.
Required under India's DPDP Act rules for handling privacy complaints and requests. MedStory, operated by Ashwin Zachariah, has designated Ashwin Zachariah as Grievance Officer. Complaints or requests can be sent to ashwin@themedstory.com and are acknowledged within 48 hours and resolved within 30 days.
If we make material changes to this policy, we'll update this page and adjust the effective date below. Continued use of the waitlist or the product after changes means you accept the revised policy.
This policy took effect on August 5, 2026.