Privacy Policy

Gentle Pills is a clinical workspace built for qualified homeopathic doctors, plus a public library of classical Materia Medica monographs and technical articles. This policy covers both: the clinical workspace a registered clinic uses (patients, cases, prescriptions, AI-assisted tools) and the public marketing site (home page, Materia Medica, articles, docs).

We do not sell personal data, and we do not use clinic or patient data to train external AI models.

When you register a clinic or sign in, we collect:

• Name, email address and (for password accounts) a securely hashed password — we never store passwords in plain text.
• If you sign in with Google, we receive your name, email address and profile picture from your Google account (via standard OAuth 2.0 scopes: openid, email, profile). We do not receive your Google password, and we never post to your Google account or access other Google services on your behalf.
• Clinic/organisation name and your role within it (owner, doctor, staff).
• A session identifier stored in a secure, httpOnly cookie so you stay signed in.

Data a clinic enters — patient demographics, case notes, structured symptoms, prescriptions, documents and appointments — belongs to that clinic. It is isolated at the server layer: one clinic's data is never visible to another clinic, enforced on every database query, not just in the interface.

Sensitive clinical actions (viewing, editing, prescribing) are audit-logged so a clinic owner can review what happened and when.

AI-assisted tools (symptom structuring, rubric suggestion, knowledge research and others) send relevant case context to our AI provider (Azure OpenAI) to generate a suggestion. That suggestion is stored, labeled as AI-generated, and never applied to a patient record until a doctor explicitly reviews and confirms it.

We do not use clinic or patient data to train AI models, ours or anyone else's. Our Azure OpenAI configuration uses Microsoft's enterprise terms, under which prompts and completions are not used to train or improve Microsoft's models.

The public marketing site (home page, Materia Medica, articles, docs — not the authenticated clinical workspace) uses Google Analytics 4 and Microsoft Clarity to understand how visitors use the site, so we can improve it. These tools:

• Never run on the authenticated clinical workspace — patient and case data is never visible to them.
• Collect aggregate, de-identified usage data (pages visited, approximate location, device type, session recordings of public-page interactions).
• Microsoft Clarity masks input fields and sensitive content by default.

You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on.

We use a small number of cookies, all functional (no third-party advertising cookies):

• gp_session — httpOnly, secure session cookie identifying a signed-in user. Expires after 14 days of inactivity.
• gp_oauth_state — short-lived (10 minute) cookie used only during Google sign-in to prevent cross-site request forgery.
• Google Analytics and Microsoft Clarity set their own cookies on the public site to distinguish visitors across a session.

We share data only with the service providers needed to run Gentle Pills:

• Microsoft Azure — hosts our AI (Azure OpenAI) and receives case context only when a doctor triggers an AI action.
• Google — processes sign-in when you choose "Continue with Google", and Google Analytics processes public-site usage data.
• Microsoft Clarity — processes public-site usage data.
• Our hosting provider, which stores the application and database.

We do not sell personal data to anyone, and we do not share clinic or patient data for advertising purposes.

Clinical data is retained for as long as a clinic's account is active, so doctors retain their patients' full history. A clinic owner can request deletion of their clinic's data by contacting us (see below); we will confirm and process deletion requests, subject to any applicable legal record-keeping requirements for medical records in your jurisdiction.

• Passwords are hashed with scrypt; we never store them in plain text.
• Sessions use secure, httpOnly cookies — inaccessible to JavaScript, reducing exposure to cross-site scripting.
• Sign-in attempts are rate-limited.
• Each clinic's data is isolated at the server layer, enforced on every query.
• Traffic to the site is encrypted in transit (HTTPS).

Depending on your location, you may have rights to access, correct, export or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us using the details below — we will respond within a reasonable time.

Gentle Pills is a professional tool for qualified doctors and is not directed at, or knowingly used by, children. We do not knowingly collect personal data from children.

We may update this policy as the product evolves. Material changes will be reflected by the "Last updated" date above; continued use of Gentle Pills after a change constitutes acceptance of the updated policy.

Questions about this policy, or requests regarding your data, can be sent to siddhamruth@gmail.com.

See also our Terms of Service.