Patients should own their record.

A place to keep the documents you collect across a lifetime of care — labs, imaging, prescriptions, discharge summaries, specialist notes — in a form you control. We encrypt every source document in your browser before it touches our servers. We read each document with an AI extractor to pull out the structured findings (values, units, dates, codes) and turn them into trends you can actually scan in seconds. A separate chart-level AI review looks across your whole record with today’s date in mind — flagging stale recommendations, recommendations a later record already addressed, abnormal trends, and care gaps — so you can walk into your next appointment with a curated list of things to discuss. When you need to hand a record to a new doctor, you generate an encrypted link that they open in their browser and that you can revoke when the consult is over.

• Not a substitute for clinical care. The trend charts and the extracted findings are tools for talking with your doctor, not a replacement for one.
• Not a covered entity under HIPAA on its own. If your healthcare provider wants to send records into open-chart on your behalf, that’s a separate arrangement requiring a Business Associate Agreement. Today we serve the patient directly.
• Not a place to dump records you haven’t looked at. The value of this product comes from your engagement with what it surfaces.

Every feature is judged against three questions, in order:

1. Does the user stay in control? If a change would mean we could see something we previously couldn’t, we look for a different path. When we can’t find one — as with AI extraction — we document the trade-off in plain English and surface it where the user can read it.
2. Is it useful enough to justify the data we’d touch? Features that need to read more of your data require more obvious user value to ship. Trend charts touch structured findings (we already need those for search); they ship. A feature that needs to scan all your raw documents server-side would need an extraordinary reason; we haven’t found one yet.
3. Will we still believe this in a year? We don’t ship features we’d be embarrassed to describe truthfully to a privacy researcher. If a feature requires a careful PR explanation, that’s a sign we shouldn’t build it.

• A public security page that describes our architecture in enough detail for an engineer to evaluate it.
• One-click download of any individual record you uploaded, and a FHIR-shaped read API for your structured data on the Plus tier. A “download everything as one archive” export is on the near-term roadmap; request it by email until it ships.
• A real activity log inside the app (Profile menu → Activity). You can see every sign-in, upload, extraction, chart review, and share, with timestamps and (hashed) IP indicators.
• An in-app feedback board where you can submit feature ideas, comment on others’, and vote on what we build next. We read every entry.
• Honest changelog notes when we change the security posture or how we handle data.

• Save your recovery code. Because we can’t see your password, we can’t recover your account if you forget it. The recovery code we show you at signup is your safety net. Print it. Save it in a password manager. Tape it to the inside of a filing cabinet. Just don’t lose it.
• Use real labs, not internet rumors, when making decisions. AI extraction is helpful but not infallible. The Recent observations panel marks low-confidence extractions for your review. Spot-check them, especially unusual values, and edit anything that looks wrong.
• Tell us when something is wrong. The product improves when we hear about extraction errors, confusing UI, or anything that feels off. We’d rather hear it than not.