Privacy Notice
Draft for review. Not yet reviewed by a lawyer. Any item in [brackets] has not yet been confirmed against the deployed system.
We process the app details and answers you submit to generate an assessment through Groq. We do not intentionally store case text or generated reports in our application database. The browser holds the case temporarily. Redis stores short-lived session, integrity, acceptance, and abuse-prevention records. Our hosting and challenge providers may process connection and operational metadata. Downloaded reports and records held by third parties are outside the Clear case function.
What is stored, and for how long
- Your intake, answers and report: in your browser tab's memory until you clear them or leave the page.
- Session and accepted policy versions: Redis (Upstash), at most 24 hours.
- Case state and integrity hashes (not your text): Redis, about 30 minutes.
- Rate-limit counters keyed by a keyed hash of your IP address and your session: Redis, for the limit window plus a short cleanup period. A keyed hash is pseudonymous, not anonymous.
- Aggregate daily and monthly usage counters with no case content: Redis, until shortly after the period ends.
- Operational logs hold a request ID, stage, outcome, latency and token totals only, never your text, cookies or IP address. [Host log retention period to be confirmed.]
Cookies and browser storage
This site uses no analytics, advertising or tracking cookies, so there is no cookie banner. What it does use:
__Host-hospital-session: one strictly necessary cookie, set only when you start a live assessment. It links the steps of your assessment together and enforces the abuse limits; assessments cannot work without it. It is secure-only, cannot be read by page scripts, is sent only to this site, and expires after at most 24 hours. Browsing the sample patients sets no cookie.hh:saved-case:v1: browser session storage, used only if you tick Remember in this tab (off by default). It keeps your case in this tab so a refresh does not lose it. It stays on your device and is removed by Clear case or by turning the option off.- Cloudflare Turnstile, the human check on the admissions page, runs Cloudflare's own script. What it collects and stores is described in Cloudflare's Turnstile privacy addendum.
Providers
- Vercel: hosting and connection metadata. Privacy notice.
- Groq: receives the text you submit to produce the assessment. Zero Data Retention is enabled for inference on our Groq account (checked in the account on 14 October 2026), so Groq is configured not to store the inputs and outputs. Groq still collects usage metadata, such as token counts. Privacy policy.
- Upstash: Redis for the short-lived records above. Privacy policy (PDF).
- Cloudflare Turnstile: human check; processes connection and browser signals. Privacy policy.
These providers may process data outside your country. Their own policies describe how they handle data; they can change, so check them for the current terms.