AI sharing & record privacy

What is shared with AI?

• Ask Ava: conversation messages, attachments and relevant retrieved record excerpts. Conversation messages and replies are saved in your chat history.
• Photo reading: the prepared label, lab, insurance or account photo. Visible personal details go with it. Account discovery asks AI to leave patient names, addresses, birth dates, diagnoses and payment details out of the answer—not out of the incoming photo.
• Health assistance: the information supplied to that task, such as medication details, results or selected context.

Requests go through our AI gateway to the selected model provider. Provider retention, training use and location depend on configured services and agreements; this page does not guarantee zero retention or no training.

What is removed first?

Before AI processing: there is no general automatic de-identification step. Cover or crop sensitive photo details and avoid entering unnecessary identifiers.

Before selected agent logs are saved: best-effort redaction replaces recognized emails, phone numbers, social security numbers, date patterns, long digit sequences, bearer tokens and token-like strings. Selected fields such as passwords, names, addresses, diagnoses and notes are redacted by field name.

This does not reliably recognize names or clinical details in free text, or information in images. Saved conversations are separate from redacted agent logs.

Who can see a record?

Access depends on the record, recipient, live permissions and sharing method—not simply their job title. Practitioner access, care-partner permissions, category visibility, separate child readers and share links have different controls. Authorized administration and service processing are separate.

Ordinary record links require the approved recipient’s verified account; forwarding the link does not authorize another account. Emergency and standards-based clinic exchanges have separate controls. Revocation blocks future access where enforced, but cannot erase a recipient’s downloaded or printed copy.

Your choices—and current limits

New AI requests require explicit approval in Consents. This includes messages, record excerpts, photos, recorded audio, record indexing and background assistance. Consent is checked before each new request; missing approval or a failed check blocks sending. Turning AI off cannot recall previously sent information or cancel a request already received by a provider. Previously saved replies remain available.

Photo account discovery additionally requires approval for that image and is blocked in private mode. Care-team sharing alone does not authorize AI processing. Weekly caregiver digests require the patient's explicit AI consent and current care permissions, rechecked before each send and result release; only permitted sections are included. Other delegated AI tasks remain paused. Caregiver wellbeing notes are checked locally and are not sent to AI. Live voice and live transcription remain paused because direct audio streams cannot enforce withdrawal before each disclosure. Recorded voice requests remain consent-checked.

Private mode is not a guarantee that text or photos you explicitly approve for AI remain on your device. Review the input notice before sharing.

Retention and training evidence

Checked 2026-10-27.

Lovable's published policy says app end-user data is not used to train Lovable models. Builder/workspace data has separate plan and opt-out rules. This is not a project-specific certification of every upstream provider agreement.

The authenticated gateway catalogue reports zero provider retention for the checked Gemini 2.5 Flash chat, GPT-5/GPT-5 mini chat and Responses, and text-embedding-3-small embedding endpoints. This is endpoint metadata, not proof that every app request uses those endpoints or that gateway/security logs are absent.

Project-specific upstream routing, gateway log retention, backup expiry, inference region, healthcare contracts and processor deletion receipts have not been verified. No blanket zero-retention, no-training or US-only guarantee is made.

• Lovable app end-user and workspace data policy
• Lovable provider rules
• Lovable security commitments
• Lovable subprocessor list
• Lovable data processing agreement

Deletion has a 30-day undo period. Cloud erasure is retried and verified before sign-in removal. Retained accounting, consent and audit contents, backups, other devices and external processors are not certified erased.