Last updated: October 19, 2026
Understand what DrAtlas AI processes, where it goes, and the choices you have.
This policy explains how the developer of DrAtlas AI ("we", "us" or "our") handles information when you use the app, account, AI features and subscriptions. For privacy requests or support, contact huzaifaabubakr49@gmail.com. This policy covers DrAtlas AI; websites and apps you open from a publication, share action or other external link have their own policies.
Account information may include your name, email address, sign-in provider, provider user ID and profile photo URL. Apple or Google sign-in shares the information you authorize through that provider. We do not receive your Apple or Google password. Email/password authentication is handled by Firebase Authentication.
We process the questions you submit, AI answers, follow-up context, your selected practice or reading setting, and any image you choose to attach. Conversation context may include up to eight previous exchanges. Content can contain health or other sensitive information if you include it. Do not submit patient names, contact details, record numbers, identifiable health images, confidential clinical records or other information you are not authorized to share.
Account and service records may include device identifiers, device name/model, platform and operating-system version, app version, account timestamps, request timestamps, request counts and subscription status. These records support account operation, security, troubleshooting and abuse prevention.
Apple processes App Store payments. RevenueCat processes the account user ID, store purchase/receipt and transaction information, subscription status and relevant SDK/store information to validate access, restore purchases and handle subscription changes. DrAtlas AI does not collect your full payment-card details.
We use information to authenticate accounts; answer questions and retrieve relevant publications; maintain your selected settings and history; validate subscriptions and restore purchases; respond to support and deletion requests; protect the service; prevent fraud or misuse; and comply with applicable legal obligations. We do not sell your personal information or use your questions for targeted advertising. We do not operate an advertising-supported experience.
Before the first AI request, the app asks permission to send your question, relevant conversation context, reading setting and any selected image for external processing. You may decline. AI features cannot prepare an answer without the required processing. You can withdraw this permission in Settings; a later request will ask again. Withdrawing permission stops future processing through that consent flow; it does not automatically recall information already processed.
Google Gemini processes AI requests and generated responses. In the production service, requests pass through our authenticated backend. Development/test builds may connect directly to Gemini. Search terms used to find publications are sent to Europe PMC. A question may be rewritten into a search query for relevance. Avoid personal identifiers even in search terms.
Google handles submitted content under the applicable Gemini API terms and service configuration. These terms distinguish paid and unpaid services, including how data may be used for service improvement and reviewed to detect abuse. We do not promise zero retention or that provider processing is anonymous. Please review Google's current terms at https://ai.google.dev/gemini-api/terms and abuse-monitoring information at https://ai.google.dev/gemini-api/docs/usage-policies before submitting sensitive content.
We use Google Firebase/Google Cloud for authentication, account records and backend infrastructure; Google Gemini for AI processing; Europe PMC for literature retrieval; RevenueCat for subscription validation and management; and Apple for App Store billing and relevant sign-in services. Providers receive information necessary for these functions and handle it under their applicable service, privacy and security terms.
Relevant policies include https://policies.google.com/privacy, https://www.revenuecat.com/privacy, https://europepmc.org/PrivacyNotice and https://www.apple.com/legal/privacy/. We may disclose information when required by law, to protect people or the service, to investigate misuse, or in connection with a business transfer subject to applicable privacy safeguards. We do not give public access to your private account records.
Conversation history is stored on your device using authenticated encryption and a key held in platform secure storage. There is no cloud conversation-history synchronization in the current app. Account/profile and operational records are stored separately on backend services. Device security, backups and information you export or share can affect confidentiality. No storage or transmission method is completely secure; encryption is not a guarantee against every risk.
You control photo access through the operating system and choose any image to attach. Selecting an image for a request sends that image for the processing described above. We do not use HealthKit or read your general photo library for clinical profiling.
We retain account/profile information while your account is active and for as long as reasonably needed to provide the service, address support/security issues and satisfy applicable legal obligations. Local conversations remain on a device until you delete them, clear local history or the app's device storage is removed; other offline devices and backups may retain their own copies.
The backend assigns response-cache records an expiry of approximately 15 minutes for retry and idempotency support. Database cleanup is asynchronous, so this expiry is not a promise that every physical copy is erased at exactly 15 minutes. Account records, rate-limit/security records, infrastructure logs, backups and provider-held information have separate operational and legal retention needs. Provider abuse-monitoring or other retention may continue after an app cache expires. We do not claim zero-data retention.
Use Settings to delete individual conversations or clear available local history. Account deletion is available in Settings without buying a subscription; recent authentication may be required. The account-deletion flow removes the Firebase account/profile and associated backend request records, and clears current-device conversation history. Other offline devices may keep local encrypted history until it is cleared on those devices. Service-provider backups, billing records and records that must be retained for security or legal reasons may not be immediately erased.
For an access, correction or deletion request, email huzaifaabubakr49@gmail.com from your account email and describe the request. Do not email passwords, payment-card details, patient records or unnecessary health information. We may verify account ownership before acting. Deleting the app or your account does not cancel an App Store subscription; cancel it separately in your Apple Account subscription settings.
You may decline or withdraw AI-processing permission, manage photo permissions in system settings, edit available profile information, delete local history, request account deletion, and manage subscriptions through the store. Depending on your location, you may have rights to access, correct, delete, obtain a copy of or restrict the use of personal information; object to certain processing; or withdraw consent. Contact the support/privacy email above to exercise applicable rights. You may also contact your local data-protection authority.
Where data-protection law requires a legal basis, we rely as applicable on providing the requested service, your consent for optional processing, legitimate interests such as security and preventing misuse, and legal obligations. We do not use solely automated processing to make decisions about eligibility for employment, lending, insurance or other similarly significant outcomes.
The providers we use may process information in countries other than the country where you live. Applicable laws and protections can differ. Where required, transfers must use applicable legal safeguards, such as contractual protections provided by the relevant service provider. Contact us for questions about processing that applies to your account. We do not claim a specific data-residency guarantee.
DrAtlas AI is intended for educational use and is not directed to children under 13. Do not create an account or send personal information if you are below the minimum age permitted by applicable law. If you believe a child has supplied personal information without required authorization, contact us so we can investigate and take appropriate action. The app is not an emergency service, a patient-record system, or a substitute for professional care. Do not use it to store identifiable clinical records.
Opening original publications, signing in with a provider, managing subscriptions or sharing/copying an answer can transfer information to the selected destination. Those destinations may collect device/network information and apply their own terms. Review the destination and remove personal details before sharing. Publication links and citations do not establish an endorsement or guarantee accuracy.
We may update this policy when the app, providers or legal requirements change. The latest version will be available inside the app and on this public page, with an updated date. Where required, we will provide notice or request fresh consent before materially different processing.
Privacy and support: huzaifaabubakr49@gmail.com. Please identify DrAtlas AI and the relevant account email in your request, without including passwords or patient information.