Privacy policy

1. Introduction and Overview

Physicians Copilot ("the App," "we," "us," or "our") is an AI-powered clinical assistant designed exclusively for licensed healthcare professionals. It is developed and operated by Healthcare3.0 a company incorporated under the laws of Wyoming, USA. Physicians Copilot provides AI-assisted clinical decision support, medical literature search, continuing medical education resources, and a physician job-matching agent (collectively, the "Services").

This Privacy Policy describes, in comprehensive detail, how we collect, use, process, store, share, protect, and delete personal information — including sensitive professional, clinical, and financial data — when you access or use the Physicians Copilot mobile application, web application, backend API, and any related communications (collectively, the "Platform").

Physicians Copilot is intended solely for use by licensed or training healthcare professionals. It is not designed for patients, and it does not create a patient-provider relationship. If you are a patient seeking medical advice, this App is not intended for you.

If you have any questions about this Policy or our data practices, contact us at admin@physicianscopilot.com.

This Policy applies to: all registered and anonymous users of the Physicians Copilot iOS and Android mobile applications, the web application at www.physicianscopilot.com, and all backend Services.

This Policy does not apply to: third-party websites, job boards, or services linked from the App. Those are governed by their own privacy policies.

2. Definitions

3. Information We Collect

We collect information directly from you, automatically from your use of the Platform, and from third-party sources (including AI-extracted data from your uploaded CV). The following subsections provide a complete breakdown of all data collected.

3.1 Account Registration and Profile Information

3.2 Information Collected Automatically

3.4 Transaction and Payment Data

H3O does not store payment card numbers, bank account details, or any raw payment instrument data. All payment card processing is handled exclusively by Stripe and the respective mobile platform stores, both of which are PCI-DSS compliant.

3.5 Content You Create or Upload

3.6 Information We Do NOT Collect

National Provider Identifier (NPI) — not collected or verified against any external registry

Biometric data (fingerprint, Face ID) — authentication biometrics are handled entirely by your device OS

Social Security Number or government-issued ID number

Patient names, patient dates of birth, or other direct patient identifiers (we do not operate as a medical records system)

Advertising IDs or third-party advertising tracking data

Social media profile data or social graph information

4. How We Use Your Information

We use the information we collect only for the purposes described in this section. We do not sell your personal information.

5. How We Store Your Information

5.1 Storage Infrastructure

5.2 Data Retention

We are actively developing automated retention and expiry policies for collections currently lacking TTL enforcement. Until those controls are deployed, data in those collections is retained for the lifetime of your account unless you request deletion as described in Section 12.

5.3 Security Measures

We implement the following security controls to protect your information:

TLS/HTTPS in Transit: All communication between your device and our backend is encrypted using TLS.

Firebase JWT Authentication: Every protected API request is authenticated via a Firebase ID token, verified server-side by FirebaseAuthMiddleware on every request. Errors handled include expired, revoked, and invalid tokens.

Password Protection: Passwords are never stored in plaintext. During the email verification window, passwords are temporarily held as Fernet-encrypted ciphertext. After verification, password management is handled entirely by Firebase Authentication.

MongoDB Atlas Encryption at Rest: All data in MongoDB Atlas is encrypted at rest using AES-256 by default.

GCS Encryption at Rest: Files stored in Google Cloud Storage are encrypted at rest by Google using AES-256.

Device Metadata Restricted from Public API: The UserMetadata subobject (IP, geolocation, device fingerprint) is explicitly excluded from public API responses via UserPublicSchema.from_document(), though it remains stored in MongoDB.

Redis Rate Limiting: Redis-based rate limiting is implemented to restrict abusive or anomalous request patterns.

6. How We Share Your Information

We do not sell or rent your personal information. The following describes every category of third-party sharing in the Physicians Copilot platform.

6.1 AI and Transcription Providers

By using the Chat, Job Agent, and Voice Transcription features, you consent to the following transmissions of your data to AI providers:

6.2 Payment Processors

6.3 Cloud and Infrastructure Providers

6.4 Location and Geocoding Services

When you use the Job Agent and provide a home address for commute-based job matching, your address is transmitted to the following service:

6.5 Healthcare Data and Research APIs

The following external APIs receive derived search queries only — no user PII or account identifiers are transmitted:

NCBI PubMed API — receives AI-derived clinical search queries to retrieve peer-reviewed medical literature references for attachment to AI chat responses. No user ID, email, or clinical context beyond the search query is transmitted.

YouTube Data API v3 (Google LLC) — receives AI-derived medical topic search queries to retrieve educational video references. Read-only access. No user data beyond the derived search query is transmitted.

6.6 Internal Monitoring

Performance metrics are sent to a private Discord channel via webhook for operational alerting. Data sent to Discord includes AI response latency, token counts, estimated billing cost, and subscription lifecycle events (e.g. 'User subscribed to Pro'). No PII, email addresses, clinical chat content, or CV data is included in these Discord notifications.

6.7 Legal and Regulatory Disclosures

We may disclose your personal information without prior notice where required by applicable law, including in response to valid court orders, subpoenas, or law enforcement requests from competent authorities in Wyoming, USA or other applicable jurisdictions; to protect the rights, safety, or property of H3O, our users, or the public; to investigate suspected fraud or illegal activity; or to comply with applicable laws and regulations. Where legally permissible, we will notify you prior to disclosure.

6.8 Corporate Transactions

In the event of a merger, acquisition, asset sale, or other corporate transaction involving H3O, your personal information may be transferred to the acquiring entity. We will provide prior notice before your data is transferred, and the acquiring entity will be required to honour this Policy or obtain fresh consent from you.

7. Third-Party Data Processors — Processing Agreements

All third-party service providers that process your personal information on H3O's behalf are required to handle that data in accordance with applicable data protection law. The following table reflects known DPA status as of the policy effective date:

8. Anonymous Users

Physicians Copilot supports anonymous (guest) access via the endpoint POST /api/v1/auth/login/anonymous-user. Anonymous users are assigned a Firebase anonymous UID and may access certain features without providing an email address or creating a full account.

The following applies to anonymous users:

No email address, name, or professional profile is collected at login.

An anonymous Firebase UID is generated and used to associate any data generated during the session.

If an anonymous user creates chat sessions, those sessions are stored in MongoDB ChatHistory under the anonymous UID, including per-message IP addresses and device metadata.

Anonymous users may not access subscription-gated features or the Job Agent.

Anonymous accounts can be deactivated. There is no automatic expiry of anonymous account data.

If you convert an anonymous account to a registered account, your session history may be associated with the new registered account.

If you used Physicians Copilot anonymously and wish to have your data deleted, you may contact admin@physicianscopilot.com with a description of the sessions and approximate timeframe.

9. QR Code Login and Cross-Device Sessions

Physicians Copilot offers a QR code-based cross-device login flow, allowing a user authenticated on a mobile device to log in on a web browser by scanning a QR code displayed on the web interface.

The following data is processed during QR login:

A session token is generated and stored in MongoDB QrCodeSessions with a 5-minute expiry (TTL).

Your Firebase UID is associated with the session token when you authenticate via mobile.

The web client listens for authentication completion via Server-Sent Events (SSE).

On completion, the session record is marked as 'completed' and a Firebase custom token is issued to the web client.

Session records are automatically deleted after 5 minutes regardless of completion status.

No additional personal data beyond your Firebase UID is transmitted or stored during QR login.

10. Cookies and Tracking Technologies

10.1 Mobile Application

The Physicians Copilot mobile app does not use browser cookies. Device-level data collected includes:

FCM Device Tokens: Unique per-device identifiers used exclusively for push notifications. Stored in MongoDB Profiles.fcm_tokens[]. Multiple tokens may be stored if you use more than one device.

Device Fingerprint: Device type, OS version, browser (if web), screen resolution, and user agent are collected and stored as part of account and session metadata for debugging and security purposes.

Firebase Authentication Tokens: JWT session tokens managed by the Firebase SDK. Not stored by H3O beyond the active request.

10.2 Web Application

If you access Physicians Copilot through a web browser:

Firebase Web SDK may store authentication session tokens in browser memory or local storage for session persistence.

OpenTelemetry instrumentation captures all HTTP requests for distributed tracing, including the request path, user ID, and response time. These traces are exported to Google Cloud Trace.

No advertising networks, retargeting pixels, or third-party marketing cookies are used.

No third-party analytics SDK (e.g. Google Analytics, Mixpanel, Amplitude) is installed. All usage insights are derived from internal application logs.

11. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information. To exercise any right, contact admin@physicianscopilot.com. We will respond to all verifiable requests within 30 days.

We will not discriminate against you for exercising any of these rights. Requests that are manifestly unfounded or repetitive may be subject to an administrative fee, in which case we will notify you in advance.

12. Account Deletion and Data Deletion

To request account deletion, use the 'Delete Account' function in App Settings or email admin@physicianscopilot.com with the subject line 'Account Deletion Request' from the email address associated with your account. We will confirm completion within 30 days.

13. Data Breach Notification

In the event of a personal data breach that is likely to result in risk to the rights and freedoms of affected individuals, H3O will:

Notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, where required by applicable law;

Notify affected users directly, without undue delay, where the breach is likely to result in high risk to their rights and freedoms;

Include in any notification: the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed.

Given that Physicians Copilot stores highly sensitive professional data — including home addresses with GPS coordinates, CV documents, and clinical chat content — we classify data breaches involving this system as high-priority incidents and maintain a documented incident response procedure.

14. International Data Transfers

H3O is based in Wyoming, USA. Our cloud infrastructure and third-party processors operate in multiple countries, primarily the United States, and potentially others depending on Google Cloud regional configuration. By using Physicians Copilot, your personal information — including sensitive professional and clinical data — may be transferred to and processed in countries outside your country of residence.

Where we transfer personal data internationally, we rely on the following safeguards:

Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms, where required by applicable law;

Data Processing Agreements with service providers incorporating appropriate international transfer protections;

The adequacy of data protection in the destination country, where applicable.

For users in jurisdictions with specific international transfer requirements (EEA, UK, Nigeria under NDPA), please contact admin@physicianscopilot.com for details of the applicable safeguards.

15. Children's Privacy

Physicians Copilot is intended exclusively for licensed healthcare professionals and medical trainees aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that we have inadvertently collected data from a minor, we will delete that data within 30 days. Please contact admin@physicianscopilot.com if you believe a minor has accessed the service.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, legal obligations, or new features. When we make material changes, we will:

Update the 'Last Updated' date at the top of this document;

Notify you via a prominent in-app notification and/or email at least 14 days before changes take effect;

Obtain fresh explicit consent for material changes affecting how sensitive professional or clinical data is processed.

Continued use of Physicians Copilot after the effective date constitutes acceptance of the revised Policy. If you do not agree, you may discontinue use and request account deletion as described in Section 12. All prior versions of this Policy are archived and available on request from admin@physicianscopilot.com.

17. Contact Information

This Privacy Policy was drafted specifically for Physicians Copilot, a product of Healthcare 3.0 LLC. It reflects the actual data architecture, authentication systems, third-party integrations, and data flows of the application as audited on 15th April, 2026. It is a standalone document separate from the My Health Diary Privacy Policy.

Physicians Copilot Privacy Policy | Healthcare 3.0 LLC | Version 1.0 | Effective 15th April, 2026.