Privacy Policy

Registration: email address and hashed password. We do not collect your real name, phone number or government ID (unless you voluntarily provide them for advanced features).

Usage data: questions you submit, conversation history, saved answers and feedback on AI output (satisfied/unsatisfied, edit records).

Log information: access time, IP, browser and device info, and operation logs (used for security audit and service improvement).

Cookies and sessions: used to maintain sign-in state and remember UI preferences. We do not use third-party advertising tracking cookies.

We use your information for the following purposes:

• Provide core AI features (compliance review, clinical plans, marketing copy, knowledge search)
• Maintain account security and detect anomalous sign-ins and abuse
• Evaluate and improve AI model output quality and product experience
• Aggregate statistics for business analytics (not personally identifying)
• Fulfill legal and regulatory compliance requirements

Data hosting: the database and authentication are provided by Supabase, with data stored in Supabase-designated cloud regions. We have a data processing agreement with Supabase — Supabase processes data only as a data processor and may not use it for its own purposes.

Large language model calls: to provide AI capabilities, the system sends your question (and necessary context) to integrated Chinese LLM vendors for inference. We transmit only the minimum data needed to complete the task, and require all vendors not to retain it for training.

Web search: when a task needs real-time retrieval, we may call search APIs such as Bocha Search. Only the search keywords are transmitted; your account info is not included.

Aside from the above cases and explicit legal requirements, we do not sell, rent or share your personal information with any third party.

Your account info and conversation history are retained for the lifetime of your account. After account closure we will delete or anonymise your personal information within a reasonable timeframe (typically no more than 30 days), except as otherwise required by law.

System logs are typically retained for 90 days for security audit and troubleshooting.

Under applicable laws, you have the following rights over your personal information:

• Access: request the personal information we hold about you
• Correction: correct inaccurate or incomplete information
• Deletion: request deletion under legally-qualifying conditions
• Portability: obtain an export of your conversation history and personal data
• Withdraw consent: withdraw consent previously granted (may affect feature availability)
• Account closure: request deletion of your account

To exercise these rights, email support@medcxy.com or contact us via in-app feedback. We will respond within 15 business days.

We use industry-standard security measures including, but not limited to: transport layer encryption (HTTPS/TLS), password hashing (bcrypt/argon2), row-level security (RLS) for database access, and least-privilege internal access auditing.

That said, no online service can guarantee 100% security. If a data security incident occurs we will notify you and regulators within a reasonable timeframe as required by law.

This service is for medical aesthetics professionals aged 18 or older. We do not actively collect personal information from minors. If we find a minor has registered without guardian consent, we will delete the account after verification.

We may update this policy from time to time and will notify you via in-app notification or email. Significant changes will be highlighted prominently.

If you have questions, comments or complaints about this policy, email support@medcxy.com or contact us via in-app feedback.