Privacy Policy

1. Information we collect

Account information

When you create an account, we collect the information needed to authenticate you and keep your cases synced across devices:

• Email and password, if you create an account with email — your password is stored only as a secure hash; we never store or have access to your plain-text password.
• Sign in with Apple, if you use that option — we receive a stable, app-specific identifier for your Apple ID, and your name and email only if Apple provides them (typically on your first sign-in only; we do not receive your real Apple ID email if you choose to hide it).
• Whether your email address has been verified.
• Account ID — regardless of how you sign in, our backend assigns your account a unique internal identifier, which it uses to link your cases to you.

Case content

The core information we store is what you provide about a case: your typed or dictated case description, your answers to the App's follow-up questions, the resulting structured report (diagnosis, indication, missing information, operative strategy, alternatives, controversies, technical considerations, postoperative concerns, and evidence/guidelines) and any edits you make to it, and the three heart-team-perspective responses generated for the case.

Technical and diagnostic information

Our backend infrastructure provider (see Data storage and security) automatically logs standard technical information needed to operate the Service securely and reliably, such as request timestamps, session identifiers, and IP address. We use AI-processing metadata (which feature was used, the AI model, token counts, response time, and estimated cost) to operate and improve the Service; this metadata is tied to your account, not to advertising identifiers.

The App does not include any third-party advertising or analytics software development kits (SDKs), and we do not use your information for advertising or ad targeting.

2. How we use information

We use the information described above to:

• Provide, maintain, and secure your account and the case-preparation workflow.
• Generate AI-assisted content for your cases — follow-up questions, structured conference reports, heart-team perspectives, and relevant literature searches.
• Sync your cases across your devices.
• Diagnose problems, prevent abuse, and keep the Service reliable.
• Communicate with you about your account, such as email verification or password reset.
• Comply with legal obligations.

We do not sell your personal information, and we do not use it to serve you advertising.

3. Dictation and speech recognition

If you dictate a case using the microphone, the App uses Apple's Speech framework to convert your speech to text. Recognition is not restricted to on-device processing: when your device has a network connection, audio may be sent to Apple's speech-recognition servers so that medical-vocabulary recognition works accurately; if no connection is available, recognition falls back to on-device processing automatically. Apple's handling of that audio is governed by Apple's own privacy practices, not this policy.

Only the resulting text — never audio — is sent onward to Heart Team Prep's backend or to any AI provider. We do not store audio recordings of your dictation.

4. AI processing and third parties

Heart Team Prep uses the following third-party service providers to operate the Service. Each processes information only as necessary to provide their service to us, under their own respective privacy and security practices:

• OpenAI — your case description, your answers to follow-up questions, and dictated text segments are sent to OpenAI's API to generate extracted case data, follow-up questions, structured reports, heart-team perspectives, and to help construct literature searches. This content is submitted through OpenAI's API, subject to OpenAI's API data-usage policies in effect at the time.
• Back4App / Parse Server — our backend hosting provider, which stores your account and case data and enforces that only you can read or modify your own cases.
• National Library of Medicine / PubMed (NCBI) — when you look up literature for a case topic, a search query derived from that topic (not your full case narrative) is sent to NCBI's public E-utilities service to retrieve relevant published abstracts.
• Apple — for Sign in with Apple, speech recognition (see above), and standard App Store/operating system services.

5. Clinical content and patient information

Heart Team Prep is an educational case-preparation tool. You must not enter real patient identifiers — names, medical record numbers, exact dates, contact information, or any other information that could identify a specific patient, staff member, or institution. Use de-identified, illustrative, or approximate details instead, as you would when presenting at conference.

As a safety net, the App screens text you dictate or type, on-device, for likely patient names, staff or institution names, and procedure dates, and removes what it finds before that text is sent anywhere. This is an automated, best-effort check for a deliberately narrow set of patterns — it is not a complete, guideline-level de-identification process (it does not, for example, catch every category of identifier a formal standard would), and it cannot screen audio already sent to a speech-recognition server before it becomes text (see Dictation and speech recognition). It is a backstop, not a substitute for not entering identifying information in the first place.

6. Data storage and security

• All network communication between the App and our backend uses encrypted transport (HTTPS/TLS).
• Your cases are stored with access controls that restrict them to your account — another user cannot read or modify your cases.
• Account passwords are stored only as secure hashes.
• Our infrastructure provider(s) may store data on servers located in the United States and other countries in which they operate.

No method of storage or transmission is completely secure. We work to protect your information but cannot guarantee absolute security.

7. Data retention

We retain your account and case data for as long as your account is active, so that your cases remain available across your devices. A local, on-device list of your recent cases is also kept on your device for quick access; deleting the App removes that local list but does not, by itself, delete your account or case data from our servers. You may delete your account and all associated case data at any time — see Your rights and choices.

8. Your rights and choices

Depending on where you live, you may have some or all of the following rights regarding your personal information: to access the information we hold about you; to correct inaccurate information; to request deletion of your information; to receive a copy of your information in a portable format; and to object to or request that we restrict certain processing.

You can exercise most of these rights directly in the App — for example, editing a report, signing out, or permanently deleting your account and case data (Account > Delete Account). For any other request, contact us using the details in Contact us; we will verify your request and respond within the time required by applicable law.

California residents (CCPA/CPRA)

We do not sell or share personal information as those terms are defined under California law, and we have not done so in the preceding 12 months. California residents have the rights described above, as well as the right not to receive discriminatory treatment for exercising them.

EEA, UK, and other regions with data protection laws

If applicable law provides a legal basis framework (such as the GDPR), we process your account and case data based on our need to perform our contract with you (providing the Service you signed up for), and technical/diagnostic information based on our legitimate interest in operating a secure and reliable Service. You may have the right to lodge a complaint with your local data protection authority.

9. International data transfers

Heart Team Prep and the service providers described in AI processing and third parties may process and store information in the United States or other countries that may have data protection laws different from those in your country. Where required, we take steps intended to ensure information transferred internationally receives an appropriate level of protection.

10. Children's privacy

Heart Team Prep is intended for cardiac surgery trainees and other adult healthcare professionals and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to delete it.

11. Not medical advice; not HIPAA compliant

Heart Team Prep is an educational preparation tool. It does not provide medical advice and does not replace clinical judgment, institutional policy, or supervision. Heart Team Prep is not represented or intended to be a HIPAA "covered entity" or "business associate," and the Service is not intended to be used to store or transmit protected health information (PHI). Do not enter real patient identifiers — see Clinical content and patient information.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice (such as an in-app notice). Your continued use of the Service after a change becomes effective constitutes acceptance of the revised policy.

13. Contact us

If you have questions about this Privacy Policy or want to exercise any of the rights described above, contact us at:

Bender Apps, LLC
Email: support@benderapps.dev