Privacy Policy — YourMentorDoc

1. Who we are

YourMentorDoc is operated by Your Mentor Doc LLC, an Indiana limited liability company, of 4907 Sweetwater Drive, Noblesville, IN 46062, USA (“YourMentorDoc”, “we”, “us”).

We provide educational information and self-management tools for people affected by breast cancer. We are not a healthcare provider. We do not provide medical care, diagnosis or treatment, and using YourMentorDoc does not create a doctor–patient relationship. See our Terms of Use.

You can reach us about privacy at admin@yourmentordoc.com.

If you live in Washington, Nevada or Connecticut, please also read our Consumer Health Data Privacy Policy, which describes additional rights you have over health information.

2. HIPAA, and what actually protects your information here

People reasonably assume that anything touching health data is covered by HIPAA. For a service like ours, usually it is not — and we would rather explain that clearly than imply a protection we do not owe you.

YourMentorDoc is not a HIPAA covered entity. HIPAA applies to health plans, healthcare clearinghouses, and healthcare providers who bill insurance electronically. We do none of those things: we do not provide care and we do not bill insurance. And unless your access is provided by a hospital or clinic under a written agreement with us, we are not anyone’s business associate either. So the information you give us directly is generally not protected health information under HIPAA.

What does apply:

This policy itself. Under section 5 of the FTC Act, the promises we make here are legally enforceable. If we say we do not sell your health information, that is a binding commitment, not marketing copy.
The FTC Health Breach Notification Rule, which requires us to tell you and the FTC if your health information is breached. See section 11.
State health-privacy and consumer-privacy laws, including Washington’s My Health My Data Act — which gives Washington residents a right to sue directly. See sections 8 and 9 and our Consumer Health Data Privacy Policy.

We hold ourselves to HIPAA-grade security regardless. The infrastructure your information lives on is covered by a Business Associate Agreement with Google Cloud, your uploaded reports are encrypted with keys we control, and access is limited and audited. We do that because it is the right standard for this kind of information, not because a regulator currently requires it of us.

If a hospital or clinic gave you access to YourMentorDoc, we may act as that provider’s business associate for the information they share with us, under a written agreement. In that case their Notice of Privacy Practices also applies to that information.

3. Information we collect

Information you give us

Account information. Your first and last name, email address, and a password. Your password is handled by Google Identity Platform — we never see or store it.

Risk Assessment answers. If you complete the questionnaire: age, height and weight, menopausal status, whether you have been diagnosed and with what, estimated stage, receptor subtype, treatments received or planned, family history, genetic testing results, fertility considerations, and lifestyle information such as exercise and smoking.

If you are not signed in, these answers stay in your own browser and are not sent to us unless you choose to save them to an account.

Daily Check-in entries. Mood, free-text or spoken journal notes, symptoms, medications including dose and whether you took them, step counts, water intake, protein intake, weight, blood pressure, heart rate, surgical drain output for each drain you have in place, any movement or eating habits you choose to track — including the names you give them — appointments, and any visit notes you write.

Medical reports you upload. The report files themselves — pathology, imaging, laboratory and similar documents — and the plain-language interpretation our system generates from them.

Messages you send us, including product requests and support messages, and questions you type or speak to MentorDoc-AI.

Your ZIP code, if you give it. Optional. We use it for one thing: to show you cancer centres near you. It is the only location information we hold, you type it yourself, and you can leave it blank or remove it at any time.

Your phone number, if you give it. Optional, and currently stored but unused — we do not send text messages. If that ever changes we will ask your permission first.

Payment information is handled entirely by Stripe. We never receive or store your card number. We keep only Stripe’s identifiers and your subscription status.

Information collected automatically

Sign-in records — we count sign-ins in a daily total to understand how often members return. This is an aggregate; we do not build a profile of which pages you visit.

Security and anti-fraud information — IP address, browser and device information at sign-in and signup, used to detect automated abuse and to record your acceptance of our Terms.

Essential cookies keep you signed in and remember choices such as dismissing a prompt. We do not use advertising cookies, and we do not use any third-party analytics service. Because we do not track you across other sites, there is nothing for a Global Privacy Control signal to opt you out of — but we honour it regardless.

What we do not collect

We do not collect your street address, date of birth, Social Security number, or insurance information. We do not track your location — we never read location from your device or infer it from your network, and the ZIP code above is one you type and can remove. We do not buy information about you from data brokers. We do not use facial recognition or biometrics.

4. How we use your information

To provide the service — answer your questions, personalise your journey report, keep your check-in history, and store and interpret your reports.
To personalise guidance — a short summary of your Risk Assessment answers is supplied to MentorDoc-AI so answers reflect your situation. You can view, edit or clear this summary on your Risk Snapshot page.
For your account and billing — create your account, send sign-in codes, process subscriptions, send service notices.
For safety and security — detect automated signups and abuse, protect accounts, investigate incidents.
To improve the product — understand in aggregate which features are used and which questions recur.
To comply with law and enforce our Terms.

We do not sell your information. We do not share it for advertising. We do not disclose it to data brokers, insurers or employers. We do not use it to train artificial intelligence models.

5. Automated processing and AI

MentorDoc-AI generates answers using Google Vertex AI, running inside our own Google Cloud environment under a Business Associate Agreement with Google.

Voice input. If you use the microphone on chat or your daily check-in journal, the recording is sent to this same Vertex AI environment to be transcribed into text. The audio itself is never saved — not on your device beyond the recording, and not on our servers. Only the resulting text is kept, exactly as if you had typed it, and it is used the same way a typed chat question or journal entry is used elsewhere in this policy.

Your information is not used to train Google’s models or anyone else’s.
No human reviews your entries as a matter of course. Your journal, symptoms and chat are not read by our staff in the ordinary operation of the service. Support messages are read by our team, because that is the point of sending them.
We do not make automated decisions that produce legal or similarly significant effects about you. The Service generates educational information; it does not decide anything about your care, your eligibility, or your money.
The output is educational information, not medical advice, and it can be incomplete or wrong. Always confirm anything that matters with your own clinicians.

Nobody is monitoring your entries. YourMentorDoc will not detect an emergency and will not alert anyone. If you have urgent symptoms, contact your care team or emergency services.

6. Who we share information with

We share only what each provider needs to do its job:

Google LLC / Google Cloud (hosting, authentication, database, file storage, AI) — account, health and usage data, in the United States. Covered by a Business Associate Agreement.
Stripe, Inc. (payments) — name, email, and payment details you enter directly with them. No health information.
Resend (email delivery) — your email address and the text of the message. We never put health information in email.
Vimeo, Inc. (video hosting) — playback requests when you watch a video.
Amazon — nothing from us. Clicking a product link takes you to Amazon, which applies its own privacy policy and may pay us a commission.

We may also disclose information if required by law or valid legal process, to protect someone’s safety or our rights, or in connection with a merger or sale of the business — in which case we would notify you and this policy would continue to apply until replaced.

7. How long we keep information

While you are a member, we keep your information so it is there when you need it. We do not delete your medical reports on a timer.

When a membership ends — cancelled or lapsed — your account enters a dormant period of one year. Your information is preserved and you can still export it. If you do not return within that year, it is permanently deleted.

Before any deletion we send warning notices, and the process runs behind multiple independent safety checks designed so that any uncertainty results in your data being kept, never deleted.

If you ask us to delete your account, none of the above applies: we do not wait a year. Your account closes immediately and everything in it is permanently erased within 30 days, and from backups within six months. That is described in full in our Consumer Health Data Privacy Policy.

Some records are kept longer where the law requires it — billing and tax records, your record of accepting our Terms, and a minimal record that a deletion occurred. None of them contains health data. Chat conversation history expires automatically.

8. Your choices and rights

Available in the app today, to everyone, without having to ask:

See your information — your Risk Snapshot, check-in history and uploaded reports are all visible to you.
Export it — download your Risk Assessment and wellness data from your Account page, and export reports as PDFs.
Correct it — retake the questionnaire, edit entries, and edit the summary MentorDoc-AI uses.
Close your account — Account → Delete my account cancels your membership and permanently deletes everything in it. It is immediate and cannot be undone.
Delete parts of it — from your Account page you can delete individual check-in days, all your wellness data, all your Risk Assessment data, and any uploaded report.
Close your account. Email admin@yourmentordoc.com and we will delete your account and everything in it. We act within 45 days and usually within a few days. (Self-service account closure is not built yet; until it is, email is the way, and it works.)
Cancel any time from Account → Subscription.

9. State privacy rights

We extend the following rights to everyone who uses YourMentorDoc, wherever you live, rather than only to residents of states whose laws require them:

Know and access — what we hold about you and how we use it.
Correct inaccurate information.
Delete your information.
Portability — receive a copy in a usable format.
Withdraw consent to our processing of your health information.
Non-discrimination — we will not deny service, charge a different price, or provide a lesser experience because you exercised a right.

Sale and targeted advertising. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for profiling that produces legal or similarly significant effects. There is therefore nothing to opt out of — but if that ever changed, we would obtain your consent first and provide an opt-out before doing it.

Sensitive information. Health information is sensitive personal information under several state laws. We collect it only to provide the Service you asked for, we do not use it to infer characteristics about you, and we do not disclose it for any purpose that would require an opt-out.

How to exercise a right. Most rights are self-service in your Account page. For anything else, email admin@yourmentordoc.com. We will verify your identity using the email address on your account and respond within 45 days, extendable once where the law allows. An authorised agent may act for you with written permission that we can verify.

Appeals. If we refuse your request, you may appeal by replying to our decision or emailing admin@yourmentordoc.com with “Appeal” in the subject line. We will respond in writing within 45 days with our reasons. If we deny your appeal, you may contact your state Attorney General.

California “Shine the Light”. We do not disclose personal information to third parties for their own direct marketing purposes.

Washington, Nevada and Connecticut residents have additional rights over consumer health data, including a right to a list of the specific third parties it has been shared with. See our Consumer Health Data Privacy Policy.

10. Security

Encrypted in transit and at rest. Uploaded medical reports are encrypted with keys we control, stored in per-user isolation, and reachable only through short-lived links.
Our database denies all direct access by default — your information is reachable only through our authenticated application.
Sign-in requires a password of at least 8 characters plus a one-time code sent to your email. You can mark a device as trusted, and remove it later.
Every page that displays your health information signs you out when idle.
Access to production systems is limited and audited. We do not put health information in our logs or in email.

No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for keeping your password and email account secure.

11. If there is a data breach

If your identifiable health information is acquired by someone unauthorised, we will notify you without unreasonable delay and no later than 60 calendar days after we discover it, as required by the FTC Health Breach Notification Rule. We will also notify the Federal Trade Commission, and — if the breach affects 500 or more people in a state or territory — prominent media there.

Our notice will tell you what happened, when, what information was involved, what we are doing about it, and what you can do to protect yourself. We will send it to the email address on your account, so please keep it current.

12. Children

YourMentorDoc is intended for adults. You must be at least 18 years old to hold an account. We do not knowingly collect information from children. If we learn that we have, we will delete it — tell us at admin@yourmentordoc.com.

13. Changes

If we make a material change we will notify you in the app or by email before it takes effect, and update the version and date above. Continued use after that means you accept the updated policy.

14. Contact

Your Mentor Doc LLC
4907 Sweetwater Drive, Noblesville, IN 46062, USA
General: admin@yourmentordoc.com · Privacy: admin@yourmentordoc.com