How this app handles your data
Privacy Policy
What Explain My Report keeps, what it sends to the AI provider, and what it never stores — in plain language.
Last updated: October 28, 2026
We don't store your report
Text and photos are used only to generate your explanation. We keep no report content — just a usage record (input type and time) so the daily limit works.
Encrypted in transit
Your browser and our server communicate over HTTPS, and the report is forwarded to Google's Gemini API over an encrypted connection.
Processed by Google Gemini
Explanations are generated by Google's Gemini API. Google's terms and privacy policy govern how it handles that request.
Educational guidance only
Explain My Report helps you understand report language. It is not a diagnosis and not medical advice.
What we collect
We keep the smallest amount of information needed to sign you in and enforce the free limit. Everything else is processed and discarded.
- Account. Your email address from Google sign-in or the emailed sign-in link, plus any basic profile details Google chooses to share (such as your name and profile picture). These identify your account; no password is created or stored.
- Session cookie. Supabase sets a sign-in cookie so you stay signed in. It is required for the service and is not used for advertising or analytics.
- Usage records. For each explanation we save the input type (text or photo) and the time. This is what powers the 3-explanations-per-24-hours limit. The report itself is not part of that record.
- Report content. Pasted text or an uploaded photo is sent to our server only to produce the explanation, then forwarded to Google's Gemini API. It is not written to our database and is not kept by the app afterwards.
- Standard server logs. Like any website, our hosting and authentication providers may record basic technical data (IP address, browser type, timestamps) to serve the site, sign you in, and keep it secure.
No advertising, no analytics trackers, and we do not sell your data.
How your report is processed
The explanation is generated on demand. It exists in your browser tab, not in a database.
Step 1 — You submit
Text (up to 20,000 characters) or a photo (PNG, JPEG or WebP, up to 4 MB) travels over an encrypted connection to our server.
Step 2 — Gemini writes it
Our server passes the report to Google's Gemini API, which returns a plain-language summary, findings and questions for your clinician.
Step 3 — Nothing is kept by us
The explanation appears in your browser. Leaving or refreshing the page discards it — we store no report content and no explanation.
Because the report is processed by a third-party AI provider, that processing is also governed by Google's Gemini API terms and Google's privacy policy. If you are not comfortable with that, please do not submit a report.
Important — free-tier AI processing. Explain My Report currently uses Google's Gemini API. Under Google's terms for unpaid API usage, Google may use the content you submit (report text or images) to improve and develop its products and services, and human reviewers may read, annotate, or process it. Google's terms also state that sensitive, confidential, or personal information should not be submitted to unpaid services. Remove names, dates of birth, and other identifiers before submitting, and do not submit a report if you are not comfortable with this. Google's terms also require paid API processing for apps made available in the EEA, UK, or Switzerland; until we enable that, please do not submit reports from those regions. We are working to move processing to a paid API plan, under which Google does not use prompts or responses to improve its products.
Third-party services
Only these services are involved in running the app:
- Google — Gemini generates the explanations, and Google sign-in authenticates you. Google processes the report content to return the explanation.
- Supabase — authentication and the usage records (input type + timestamp) are stored here.
- Vercel — hosts the website and keeps standard request logs.
These providers may process data in countries other than yours, under their own terms and privacy policies. We do not control their retention practices beyond what those policies describe, and we do not sell your data or share it for advertising.
Security
- All traffic between your browser and the app uses HTTPS, so your report is encrypted in transit.
- Database access is restricted per user, so one account cannot read another's records.
- The app does not write reports to disk or to its database, so there is no report archive to expose.
No online service can promise perfect security. Explain My Report is an educational tool, not a clinical records system, and it does not claim HIPAA compliance or any healthcare certification.
Your choices
- Sign out at any time — the session ends and any explanation on screen is discarded.
- You choose what to paste or upload. The app does not remove names, other identifiers, or photo metadata for you; if you prefer not to submit them, remove them before you press Explain.
- Your account record is your email address, basic Google profile details (if Google shares them), sign-in method, and usage timestamps, kept for as long as your account exists.
- You can ask for your account and its usage records to be deleted through the contact channel in section 7.0.
- You can stop using the service at any time.
Changes to this policy
If this policy changes, the updated version will appear here with a new date. Continuing to use the app after a change means you accept the updated policy.
Contact
Explain My Report is maintained as an independent project. Questions about this policy, or requests to delete your account and usage records, can be raised through the project's issue tracker:
github.com/Rehan-nawroz/Explain-My-Report
Please do not include report content, names, or other personal information in a public issue. Ask for a private channel and one will be arranged.