Privacy Policy

Who we are

PathoDiff is operated by Matthew Path, Sydney, NSW, Australia. Contact: privacy@pathodiff.com.

Information we collect

• Account: email address and sign-in details, such as a password or a one-time code, when you create or sign in to an account.
• Cases: de-identified findings, the analysis, results you add later, and earlier analysis versions. These are saved only when you are signed in and choose to save the case.
• Guests: a random identifier stored in a cookie, used only to apply the guest analysis limit. IP addresses are used only to limit abuse, such as rate limits, and are not used to count those analyses. Guest cases are not saved on our servers. A copy can remain in your browser so you can sign up and continue.
• "Missed something?" reports: the category, which part of the result you flagged, your note, an optional contact email, and a snapshot of the case and analysis. This applies to guests and signed-in users. Do not put patient names, dates of birth, medical record numbers (MRNs) or accession numbers in the note.
• Team / lab requests: institution or lab name, contact email, approximate seats, and notes.
• Billing, when paid plans are available: subscription details processed by Stripe. We never see card numbers.
• Technical data: standard request metadata needed to operate, secure, and rate-limit the service (for example session cookies and similar browser storage used for authentication).

How we use information

• Authenticate users and maintain sessions.
• Run analyses and return differentials and related decision-support output.
• Enforce usage limits and entitlements (guest, free, Pro, Team).
• Provide checkout and subscription management through Stripe when paid plans are available.
• Store saved cases for signed-in users who choose to keep them.
• Respond to support or Team / lab requests you submit.
• Review problem reports about a missed differential, ranking, test, or wording.
• Protect the service against abuse and maintain security.

Protected health information (PHI) and de-identified use

PathoDiff is intended for professional decision support with de-identified case content. Do not enter protected health information (PHI). That includes patient names, dates of birth, medical record numbers (MRNs) or accession numbers. The problem-report note follows the same rule. You are responsible for ensuring inputs comply with your institutional and legal obligations.

Processors and sharing

We use service providers to operate PathoDiff, including:

• xAI — case text is sent to xAI to generate each analysis, under xAI's data terms.
• Supabase — accounts and the database.
• Vercel — hosting.
• Stripe — payments, when paid plans are available.
• Resend — email notifications. Team / lab request details are included. "Missed something?" alerts never include the case or the note.

We do not sell personal information. We may disclose information if required by law or to protect the rights, safety, or integrity of the service and its users.

Logging practices

We design the application to avoid logging case text, protected health information, prompts, full model responses, tokens, or secrets. Operational logs are kept minimal and are not used as a product analytics platform.

Retention and deletion

Saved cases are kept until you delete them or your account is closed. We retain "Missed something?" reports and Team / lab requests for as long as needed to review and respond. There is currently no fixed retention period or automatic deletion process for these records. To ask for deletion, contact privacy@pathodiff.com. Guest cases are not saved on our servers.

Cookies and similar

We use cookies and similar technologies as needed for authentication, the guest analysis limit, and core session functionality. We do not currently operate a third-party product-analytics or advertising cookie stack on PathoDiff.

International processing

Some providers store or process information outside Australia, including in the United States. We do not sell personal information. By using PathoDiff, you acknowledge that your information may be transferred to and processed in those locations.

Your choices

You may access or update account details through the product where available, manage billing through the Stripe customer portal when subscribed, and contact us to request deletion or ask privacy questions. Related terms are in our Terms of Service.

Complaints

Contact us first at privacy@pathodiff.com. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes

We may update this policy as the product evolves. The “Last updated” date at the top reflects the latest revision. Material changes will be reflected on this page.

Contact

Privacy inquiries: privacy@pathodiff.com. Website: https://pathodiff.com.