MedSay Privacy Policy
Effective October 11, 2026
MedSay, at medsay.app, is operated by AYI LLC, a Utah limited liability company doing business as MedSay. In this policy, "we" and "us" mean AYI LLC.
Your record is your property
The medical record you build here belongs to you. It is not ours. We hold it for you, the way a bank holds what you deposit.
That single idea decides every question in this document. When you want your record, you take it. When you want it moved, we move it. When you close your account, the record stays yours. When you die, it passes to whoever you named, the way the rest of your property does. If it ever earns money, the money is yours.
We are the custodian. You are the owner. Everything below is the detail of how that works.
What we collect
What you tell us. Your name, your date of birth, your phone number, and whatever you choose to tell us about your health: what you are taking, what you stopped taking and why, how you have been feeling, what happened at a visit, what you want to ask your doctor. Your own words are stored exactly as you said them and are never edited.
What we collect on your instruction. When you connect a source, we pull what that source holds about you and store it whole. Medicare claims through Blue Button. Your VA health record through the VA's own sign-in. Records from a hospital or clinic portal. Information from a health plan. Photographs of medication bottles, insurance cards, or paperwork you send us.
Your voice. If you speak to MedSay or record a visit, we keep the recording and the words written down from it, as part of your record.
Pictures. Pictures you take for your record: a medication label, an insurance card, a driver's licence, paperwork, and a photo of yourself if you add one.
Other people's names and numbers. The people you add: emergency contacts, family or helpers, and your doctors.
Where you are, only when you ask. If you press the button to find care near you, your phone sends us your location once so we can find your ZIP code, and we do not keep it. On the emergency page your location stays on your phone and goes only to the map you choose to open.
Payment. Your card is typed on Stripe's page, not ours. We never see or store the card number. We keep which plan you are on.
What the service generates. Summaries and views built from the material above, written for a particular purpose: a document for your cardiologist, a page for your own reading, a short view for an emergency responder. These are always built from your record and always show where each fact came from.
How you use the service. Sign-in times, which pages you opened, which questions you answered. We keep this to run the service, to keep your account secure, and to show you who has looked at your record.
What we do not collect. We do not buy information about you from data brokers. We do not track you across other websites. We do not collect your fingerprint or a scan of your face. If you sign in with a fingerprint or your face, that stays on your phone and we never see it.
How we use it
To build and hold your record. The main job. Everything scattered across the places that treated you, gathered into one place that belongs to you.
To prepare you for appointments. Helping you decide what to raise, what to ask, and what belongs somewhere else.
To notice things. A medication that appears twice under two names. A prescription that was never filled. A result that does not fit the pattern. When we notice, we show you what we noticed and ask you about it. We do not diagnose and we do not treat. Those belong to your doctors.
To ask you questions. By text message or in the app, about things nobody has asked you.
To keep the service working and secure. Fixing problems, preventing unauthorized access, meeting our legal obligations.
To improve the service. Studying patterns across patients so the service gets better at its job: better questions, better summaries, fewer mistakes. This is ordinary operation of the product and it is how any service improves.
Research is separate and you decide. Beyond improving the service, your information can be part of research: studies that produce findings, and findings that may be published or sold. That is a different thing from running the service, so it is a separate decision. We ask you once, plainly, and you can say no or change your mind at any time. If that research earns money, you get a share. Saying no changes nothing about the service you receive.
What we do not do. We do not sell your record. We do not use it to target advertising at you. We do not build profiles for anyone else's benefit. We do not hand it to your insurer, your employer, or anyone else unless you have told us to.
Information with your name taken off. We do not share or sell information from your record with anyone outside MedSay, even with your name and other details removed, unless you have agreed to it. Nobody who receives information from us may use it or pass it on for any reason without your consent.
Who else touches it
Companies that run the machinery. These are all of them, by name.
Google Cloud holds the database and runs the servers. Its AI reads your documents and pictures, writes down what is said in a recording, and writes summaries. Google does this under a signed agreement that binds it to the federal health privacy law (HIPAA). It may not use your information for its own purposes.
Twilio sends our text messages, such as your sign-in code. It receives your phone number and the words of the message. We keep health details out of text messages.
Stripe takes payment. It receives what you type on its payment page and nothing from your record.
Apple, Google or Mozilla, whichever makes your phone or browser, delivers a notification if you turn notifications on. It carries only the short words of the notification.
The National Library of Medicine gives us the standard name for a medicine. We send it the name of the medicine and nothing about you.
Each company that handles your information is bound by a written contract to protect it, to use it only to provide the service to us, and never for its own purposes. Our vendors and contractors are held to the same commitments we make to you in this policy.
The lettering on our pages is loaded from Google Fonts, and a map opens in Apple Maps or Google Maps when you press a map button. Those services see what any website or map sees, such as your internet address, and nothing from your record.
Anyone you have given access to. A daughter, a spouse, a paid caregiver, a doctor. You decide who, and you decide how much. You can see every change to that access, with the date and the reason, and you can take access away at any time. Your record can say things about your relatives too, such as a family history of an illness, so when you share your record you are sharing that as well.
Emergency responders, if you open the door. If you press the emergency button, a narrow view of your record opens: allergies, active conditions, medications, emergency contacts, and your past emergency situations. Not your whole record. Pressing the button is you giving permission.
Where you send it. You can take a complete copy of your record and give it to anyone. That is a right, not a favour, and we build the door for it.
The law. If we receive a valid court order or legal demand, we comply. Where we are permitted to tell you, we tell you.
Nobody else. Ever.
Information that arrives with conditions attached
Some of what lands in your record comes from a source that sets its own terms, and those terms travel with that information.
Medicare claims, through Blue Button. When you connect Medicare, we receive your claims history from the Centers for Medicare and Medicaid Services. CMS requires that this information is never sold, never used for advertising, and never used to build marketing profiles. We follow those terms, and they apply to the claims data specifically.
VA health records. When you connect the VA, you sign in with your own VA login and we receive your health record from the Department of Veterans Affairs. The VA requires that this information is never sold and never used to make money. We follow those terms. Information that came from the VA or from Medicare is never sold and is never part of research that earns money, whatever else you have agreed to.
Other sources. Where a hospital, a clinic, or a health plan sets conditions on what they send us, we follow those conditions and we name them here as they arise.
What this means in practice. A restriction follows the information it came with, not your whole record. Something you tell us directly is governed by this policy alone. Something Medicare sent us carries Medicare's terms on top.
Closing your account, and what happens to your record
Closing your account does not destroy your property. We stop running the service for you, and we keep holding your record so you can come back for it.
Before you go, you take a complete copy: everything, in a form you can read and a form another system can read.
If you want it deleted, say so and we delete it. Not a form, not a waiting period, not a retention schedule you have to argue with. You ask, and it is gone, except where the law requires us to keep something specific, and we will tell you what that is.
How to ask. Open Settings and choose Delete my account, or write to privacy@medsay.app. Delete my account removes your record at once. If you write to us, it is done within 45 days of your asking, and usually much sooner.
What deleted means. We permanently delete all of it, 100 percent: what you told us, what Medicare, the VA or anyone else sent us, your pictures, your recordings, and your account. Three things remain, and none of them is your record. One is a line with no name, phone number or anything else that could point to you, saying that an account was deleted. One is any feedback you sent us about the site, kept without your name so the problem you reported still gets fixed. The last applies only if you helped with someone else's record: your name stays in their history, because that history belongs to them.
If you say nothing, we keep holding it. It stays yours. You can claim it, move it, or have it deleted at any point later.
When a connection is revoked. If you disconnect a source (Medicare, a hospital, a health plan) we stop receiving new information from them immediately. What we already received stays in your record, because it is your record and removing history would damage the thing you are keeping. If you want it gone, say so and it is gone.
Accounts that go quiet
Records outlive attention. Someone may not open this for two years and still own everything in it.
Quiet does not mean abandoned and it never triggers deletion. We do not clear out records because nobody visited. We hold a quiet record, and everything in it, until you ask us to delete it. There is no time limit.
About once a year, we check in, confirming that the phone number still reaches you and asking whether your instructions have changed. If we cannot reach you, we keep holding the record. Property does not stop being yours because a phone number changed.
What happens when you die
Your record passes the way your other property passes. You tell us who should receive it, and we honour that. If you have told us nothing, we release it to the person with legal authority over your estate, on proof of that authority.
We do not delete a record because someone died. A complete medical history is often most valuable to the people who come after you: your children, who share your genes and your risks.
If we are breached
If your information is exposed in a way that puts you at risk, we tell you. Directly, in plain language, as fast as we can confirm what happened.
What we tell you: what was taken, when it happened, when we found out, what we have done about it, and what you should do.
How fast: without unreasonable delay, and no later than sixty days after we discover it. If we can tell you sooner, we do. We also notify the regulators and, where the law requires it, the public.
We do not wait for a complete investigation before telling you something happened. You get a first notice with what we know and follow-up notices as we learn more.
If the company is sold or closes
A buyer would acquire the business of holding records. They would not acquire the records, because those are not ours to sell.
What that means for you. Your record stays yours. We tell you if the company changes hands. The commitments in this policy travel with your record, and a new owner must keep them. A new owner may want to change the terms going forward, and if that happens you are told first, in plain language, before anything changes.
Your choices if that happens. You can take a complete copy of your record, have it sent where you choose, have it permanently deleted, or close your account. Any of them, at no cost.
If the company closes. You are told well ahead of time and given the same choices. Your record does not disappear because a company stops operating.
What would not happen. Your record being treated as an asset of the company, sold on, merged into somebody else's database, or quietly re-purposed under new terms you were not shown.
Changes to this policy
We will change this document as the service grows. When we do, you are told, by text message or email, and with a notice when you next sign in. We do not change it quietly.
For changes that meaningfully affect how your information is handled, the notice comes before the change takes effect, not after.
Agreeing to this policy
You are asked to agree to this policy, and to our Terms of Service, when you create your account. Nothing is pre-checked. You are asked to read and agree, and you can decline.
You can withdraw your agreement at any time by closing your account.
About Medicare
If you connect your Medicare information, you are using the Blue Button service operated by the Centers for Medicare and Medicaid Services. You authorize that connection yourself and you can revoke it at any time, either here or through your Medicare account.
MedSay is not affiliated with, endorsed by, or connected to CMS, Medicare, or any other government agency.
About the VA
If you connect your VA health record, you sign in on the VA's own page and you authorize that connection yourself. You can revoke it at any time, here or through your VA account.
MedSay is not affiliated with or endorsed by the U.S. Department of Veterans Affairs.
Reaching us
Questions about this policy, your record, or anything in it: privacy@medsay.app
Read alongside our Terms of Service.