Qwery Health Technologies Inc. Privacy Policy
1. What this policy covers
This Privacy Policy explains what information Qwery Health Technologies Inc. ("Qwery," "we," "us") collects when you use our services (the "Services"), how we use it, who we share it with, how long we keep it, and what control you have over it.
Definitions in our Terms of Service apply here. Where the two documents address the same subject, this policy governs as to our data practices.
We wrote this to be read. Where something is genuinely a limitation of our product rather than a legal formality, we say so plainly.
2. HIPAA, and why it probably doesn't apply here
Most people arrive at Qwery from a patient portal and assume the protections that applied there follow their records here. They generally do not, and you should understand why before you decide to use Qwery.
HIPAA governs healthcare providers, health plans, and healthcare clearinghouses, and the vendors that handle data on their behalf. It protects the records your doctor's office and your insurer hold.
Qwery is none of those things. We are not a healthcare provider, not a health plan, and not a business associate of yours. When you use your own credentials to bring a copy of your records into Qwery, you are exercising your right of access to your data, and the copy you create here is governed by this Privacy Policy and by applicable federal and state privacy law, not by HIPAA.
That is a real difference, and we would rather you learn it from us than discover it later. What we commit to instead is written into this document: we do not sell your identifiable information, we do not run advertising or third-party tracking inside the Services, we encrypt identifying data, we log access to it, and we delete it when you tell us to.
We do enter into agreements with some of our vendors, including AI providers, that impose HIPAA-grade handling obligations on them. We do that because those agreements come with technical and contractual controls we want. It does not mean HIPAA covers your relationship with us, and we will not imply otherwise.
3. The information we process
3.1 Your health information
Health records and related information you upload, import, connect, or enter. This includes clinical records retrieved from healthcare providers and health plans, uploaded documents and images, and information you type in.
3.2 Health information about other people
Qwery is built for people managing healthcare for a family, including children, parents, and a spouse, and each of those people has a profile in the account holder's account.
When you add another person's health information, we process it on your instruction and on your representation that you are authorized to provide it (see Terms of Service, Section 4). We do not independently verify that authorization and we do not contact the person whose information it is.
If your information is in someone else's Qwery account and you want to know what we hold or ask us to remove it, contact us at [email protected].
3.3 Conversation information
What you write to the AI companion, the responses it generates, the tool results it retrieves to answer you, and summaries of long conversations.
3.4 Account and technical information
Your email address, name, and sign-in identifiers from Google or Apple, your display name, your date of birth if you provide it, records of which agreement versions you accepted and when (including the IP address at acceptance), authentication tokens for the sources you connect, and server logs of requests to the Services.
3.5 Derived information
Information our systems generate from the above in order to make the product work, including normalized clinical records, de-duplicated records, clinical summaries, and generated reports.
3.6 De-identified and aggregated information
Information processed to remove identifiers, as described in Section 9.
4. Where information comes from
- From you, through account creation, uploads, and what you type.
- From sources you connect, meaning healthcare providers and health plans (currently Epic-based systems, Cerner-based systems, and CMS Blue Button for Medicare), which return clinical records and attached documents.
- From your device, within the Qwery iOS application, health information from Apple HealthKit, with your permission.
- Automatically, through server and security logs generated as you use the Services.
We do not buy personal information, and we do not obtain your health information from data brokers.
5. How we use information
We use information to:
- operate the Services and show you your health information;
- retrieve, normalize, de-duplicate, and organize records from the sources you connect;
- generate summaries, answers, and reports through AI-assisted features (Section 7);
- keep the Services secure, investigate misuse, and maintain audit records of access to health information;
- provide support when you ask for it;
- meet legal obligations.
We do not use your health information for advertising, and we do not allow anyone else to. There is no advertising in the Services and no third-party advertising or behavioral tracking technology in the authenticated product.
We do not sell your identifiable personal information or identifiable health information.
6. How your information is stored
Your information is encrypted both in transit and at rest. Information that directly identifies you, such as your name, your profile details, and the credentials that connect you to your healthcare providers, receives an additional layer of encryption using a key unique to your account.
Qwery is designed to keep your identity separate from your health content, so that the two are not stored together and are not unnecessarily linked. Your name is attached to your records only when a page is displayed to you.
Each profile's information is kept isolated from every other profile, and access is checked on every request.
7. AI processing
The Services use AI models, some operated by us and some by third-party providers, to read your documents, extract structured records, answer your questions, and generate summaries and reports.
What each path sends matters, and it is not the same in every case. Being specific:
| Path | What is sent to a third-party AI provider |
|---|---|
| AI companion (chat) | Clinical records relevant to your question, including descriptions, codes, values, and full dates; a clinical summary; the conversation so far; and a demographic snapshot. Your date of birth is deliberately never sent; age is sent instead. |
| Extracting records from documents | The text of the document, including clinical note text as written. Our automated scrubber removes direct identifiers it can detect before sending, but this path carries clinical narrative. |
| External AI connector (Claude, ChatGPT) | See Section 8. |
Our scrubber removes direct identifiers, including names, dates of birth, addresses, contact details, and identifier numbers, using pattern matching and machine-learning detection, with safeguards to avoid stripping clinical terms that resemble names. It is automated and imperfect. It reduces identifying information; it does not guarantee removal. And note that clinical content itself, even with names removed, can be identifying.
We may change AI providers, models, or techniques. AI-generated output may be inaccurate or incomplete. See Terms of Service, Sections 8 and 9.
8. Connecting Qwery to an external AI client
You can authorize an AI client such as Claude or ChatGPT to query your Qwery data directly.
What is shared. Conditions, medications, lab results, vital signs, observations, procedures, immunizations, allergies, encounters, health summaries, and generated lab reports, with full clinical dates. Demographics are reduced before they leave: only sex and an age band are shared (under 2 years, whole years, or "90+" for ages over 89). Direct identifiers, including name, date of birth, address, contact details, and identifier numbers, are removed, and free-text fields are re-scrubbed on the way out.
Full dates are retained deliberately, because a clinical timeline without dates is not clinically useful. This means the data leaving through this connector is identifier-reduced, not de-identified under HIPAA's Safe Harbor standard, and we will not describe it as de-identified. Section 9 explains where the Safe Harbor standard is applied.
The authorization covers your whole account. An AI client you connect can retrieve data for every profile in your account, including your children's and your parents'. There is currently no way to grant access to some profiles but not others. If that is not what you want, do not connect an AI client to an account that holds other people's information.
A connected client can read your records and can generate lab reports for you. It cannot change or delete anything, and it cannot connect new data sources or alter your account.
Once data reaches the client, that provider's privacy policy governs it. How it is stored, logged, retained, or used for their own purposes is outside our control and outside this policy. Read the privacy policy of any client you connect.
Every access is logged. We record each tool call an external client makes against your data.
Revoking. Disconnect from your Qwery account settings at any time, or from within the AI client. Disconnecting stops any further access immediately; a session already in progress may continue for up to 15 minutes before it expires. Deleting your account revokes all authorizations. Unused authorizations lapse after 30 days, and any single authorization expires after 180 days.
9. De-identified and aggregated information
We may create de-identified and aggregated datasets from information in the Services, and may use them to improve the Services, develop features, and generate statistical insights. We may commercialize such datasets, and we own the models, analytics, and datasets derived from them.
Because that is a meaningful claim, here is exactly what constrains it:
The standard. Before de-identified information is disclosed outside Qwery or used for any commercial purpose, we apply the HIPAA Safe Harbor method, removing the eighteen categories of identifiers it specifies, including generalizing dates to the year and ages over 89, or obtain a formal expert determination that the re-identification risk is very small. Our export path implements Safe Harbor transformations today.
Your control. Each profile has a setting that governs whether that profile's information may be used for de-identified research. You can change it at any time.
What this means for deletion. Once information has been de-identified to the standard above, it can no longer be connected back to you, which also means we cannot find it to delete it. De-identified datasets created before your deletion request are not deleted.
10. Sharing
We share information:
- with service providers who operate infrastructure on our behalf, including cloud hosting, storage, and the AI providers in Section 7, under contracts limiting their use to providing those services;
- with AI clients you connect, as described in Section 8;
- with sources you connect, to the extent needed to authenticate and retrieve your records;
- when required by law, such as a subpoena, court order, or lawful regulatory request. Where we are permitted to notify you, we will;
- to protect people, where we reasonably believe disclosure is necessary to prevent serious harm, or to protect the security and rights of Qwery, our users, or others;
- in a merger, acquisition, financing, or sale of assets. If your information would transfer, we will notify you before it becomes subject to a materially different privacy policy, and you will have the opportunity to delete your account first.
We do not sell identifiable personal information or identifiable health information, and we do not share it for cross-context behavioral advertising.
11. Retention and deletion
11.1 We keep your data until you delete it
We retain your information until you ask us to delete it. We do not expire your records on a schedule. This includes data retrieved from a source you later disconnect. Disconnecting a provider stops future syncing but does not remove records already imported. If you want that data gone, delete it.
11.2 What you can delete, and how
- A profile's data, meaning the clinical records, source documents, chats, and reports for one profile.
- A profile, entirely.
- An individual chat.
- Your whole account, from within the Services.
11.3 What happens when you delete your account
Your data is immediately removed from the live Services. It is held in an encrypted archive for 30 days, so that an accidental deletion can be reversed on request. After 30 days, the archive is permanently purged, and the encryption key protecting your data is destroyed. Because that key is unique to you, any ciphertext that survives anywhere, including in backups, becomes permanently unreadable. This is deliberate: it is how we make deletion effective against backups rather than merely promising to overwrite them.
What remains after the purge is a record containing no health information, noting that an account existed and was deleted.
12. Security
We use administrative, technical, and physical safeguards to protect information in the Services, including:
- encryption in transit and at rest, with an additional layer of encryption for identifying information;
- authentication and access controls, with per-profile isolation enforced on every request;
- a permanent audit log of access to health information;
- restricted employee and contractor access;
- monitoring and security review.
No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the appropriate authorities as required by law, without unreasonable delay.
13. Cookies and similar technologies
We use first-party cookies for authentication, security, and preferences. Signing in sets a session cookie; the Services do not work without it.
There is no third-party advertising, behavioral tracking, or third-party analytics technology anywhere in the Services. We verified this rather than reserving the right to it. If that changes, we will update this section and notify you before it takes effect.
Our public website is separate. www.qweryhealth.com, where we describe Qwery and publish this policy, is not part of the Services. It uses Cloudflare Web Analytics to count visits and see which pages people read. According to Cloudflare, it uses no cookies or other browser storage for analytics and does not track you across visits or across other websites. We see only aggregate reports, such as pages viewed, referring sites, browser and device types, and countries. They do not identify you and are not linked to your Qwery account or your health information.
Most browsers let you block or remove cookies, though blocking ours will prevent you from signing in.
14. Your rights and choices
Regardless of where you live, you can:
- access and view everything in your account;
- request an export of your data;
- correct account information;
- delete a chat, a profile, a profile's data, or your entire account (Section 11);
- control the de-identified research setting for each profile (Section 9);
- revoke AI client authorizations and disconnect sources (Section 8);
- manage optional communications.
To make a request you cannot complete in the product, contact [email protected]. We may need to verify your identity first.
15. Communications
We send communications about your account, including security notices, service and billing notices, and operational notices.
We send marketing communications only where permitted by law and, where required, only with your consent. You can opt out of those at any time.
16. Changes to this policy
We may update this policy.
- Ordinary changes. We post the updated policy with a new version date and notify you through the Services or by email. Continued use after the effective date constitutes acceptance.
- Material changes to how we use or share health information. This includes any expansion of the de-identified commercialization described in Section 9, any new category of third-party recipient, and any change to Section 8. These require your affirmative acceptance. We will not apply such a change to your existing data until you accept it.
17. Contact
Qwery Health Technologies Inc.
Privacy: [email protected]
Security: [email protected]
General: [email protected]
If you are not satisfied with our response to a privacy request, you may contact your state Attorney General or, where applicable, your data protection authority.