Privacy

We (GPPT) do not store your chats unless you choose to save or share one.

• Chats: saved only when you save, share or continue a shared chat. Later replies are saved too.
• Scribe: audio, working transcripts and unsaved notes are temporary. Only notes you explicitly save are stored, encrypted and private to your account. Consent acknowledgements, processing routes, audio duration and costs are recorded without consultation content.
• Account records: your email address, sign-in records and sessions. Sessions expire after 30 days. We do not store your IP address or browser details in your session record; server access logs may still contain them.
• Billing and usage: payment records, model usage, token counts and costs.

Unsaved messages are still sent to your host to generate a reply. Your host may have its own retention policy.

On-device transcription: where your browser supports it, speech recognition runs on your device. Consultation audio is not sent to GPPT or a cloud transcription provider. This requires a supported browser and an on-device English language pack, which you may need to download. If local recognition is unavailable, GPPT disables this option; it does not silently switch to cloud recognition. See the browser documentation for on-device recognition.

Cloud transcription: audio is sent through GPPT to Amazon Transcribe in Sydney using its streaming service, including when you choose to transcribe after stopping. We do not upload recordings to S3 or use batch transcription. AWS states that streaming audio and transcripts are processed in memory and are not separately stored at rest beyond the session.

Before each audio segment, GPPT checks that our AWS account has an effective Amazon Transcribe opt-out policy. This prevents consultation content from being retained for service improvement, including model training. If the check fails, transcription is blocked. Our review relies on AWS’s published commitments and the account controls we can verify; we cannot independently inspect AWS’s internal systems.

Read AWS’s own documentation: Transcribe service card and streaming data handling, Transcribe improvement opt-out, and AWS AI services opt-out policies.

Generating a note still uses cloud AI: even with on-device transcription, the transcript and any context you add are sent through GPPT to your selected, reviewed zero-data retention model and host to create the draft. Sydney transcription does not mean note generation also happens in Sydney. Review the selected model’s policy below.

Temporary work and saved notes: audio awaiting cloud transcription is held in browser memory, including after-stopping recordings. Working transcripts, context and unsaved drafts are temporary; GPPT does not persist them. Discarding or leaving the consultation clears the working session. Browser and operating-system memory management is outside GPPT’s control, so this is not a guarantee of forensic memory erasure.

Only notes you explicitly save are stored, encrypted and private to your account. Deleting a saved note removes it from the live database; copies in backups remain until those backups expire. Content-free consent, processing-route, duration, usage and billing records remain outside the consultation-content retention promise. Obtain the patient’s consent and review the transcript and draft before using the note.

Yes. Stop sharing to disable the link. Delete the saved chat to remove it from your account.

A share link shows a copy of the chat at the time you shared it and stays available until you stop sharing or delete the chat. Later messages and model comparisons stay private until you update the shared copy.

People you share the chat with may save their own copy of it.

Attested means we have recorded the provider’s retention commitments and checked the settings available to us. It applies to the specific model and host labelled “Zero-data retention”, not every model on GPPT.

Zero-data retention: our backend system has reviewed and verified that the model and the host serving it have zero-data retention settings enabled. If a check fails, the request is blocked.

No label means ZDR is not enforced for that option. We have not verified its retention settings, so the host may retain content.

We do not have access to a host’s own systems. Verification relies on trusting the model provider and host, and on the settings we can confirm on our own account. The green dot shows our review; it is not independent certification.

ZDR covers the messages and replies used to generate an AI response. A few things are exempt:

• OpenRouter may hold prompts briefly in memory while a reply is generated.
• Chats you choose to save or share, and Scribe notes you explicitly save, are stored on our servers. Unsaved chats and Scribe drafts are not.
• Operational records: the route used, token counts and what we need to work out your costs. They never include the messages you exchanged.

Check the host and policy link in the model selector.

• OpenRouter: forwards messages to a serving provider. Both providers’ policies apply.
• AWS Bedrock: hosts models on AWS. Retention depends on the model and settings.

The table below lists enabled routes, policy links and recorded review dates. Availability depends on configuration and a current review.

Your conversation context goes to the newly selected host. Choosing ZDR later does not undo earlier processing.

Each model, host and privacy option has its own price. A region label alone does not guarantee where all processing happens.

OpenRouter routes:

• Pin the exact serving endpoint and require ZDR on every attempt.
• Disable response caching and apply a scoped ZDR guardrail.
• Review the endpoint and account settings, then test normal and streaming replies.

Bedrock routes:

• Review the model against AWS retention controls, including abuse-monitoring exceptions.
• Check account retention mode and invocation logging before sending.
• Models that require abuse-monitoring retention need an applicable agreement to qualify as ZDR.

OpenRouter also collects operational metadata and categorises prompts anonymously. Its content logging and sharing settings are separate from ZDR routing. See OpenRouter data collection.