It depends on the tool, and on what you send. A pasted report sits in a chat history; a connected account grants scoped, revocable access. Doctano sends report content through a Cloudflare AI Gateway to AI providers to extract results and answer in-app questions, does not sell health data, and lets you delete a report or an account.
The three ways health data reaches an AI
The risk is not in the model. It is in the path the data takes to get there, and in what is kept at each stop.
| Route | What leaves your device | Where a copy may sit | What you can undo |
|---|---|---|---|
| Typed or pasted into a chat | The text you typed, including names and dates if you included them | That product's conversation history, under its terms | Delete the conversation, if that product allows it |
| A file attached to a chat | The whole file, including anything printed on it | Conversation history and that product's file storage | Delete the file and the conversation, if allowed |
| A connected account | Only the fields a tool call returns | Doctano keeps the data; the client receives results per call | Revoke the grant; nothing needs deleting from the model |
The third route is narrower by design. A connector does not hand over your account. It lets the assistant ask a specific question and get a specific answer, under a permission you can see and withdraw.
What Doctano actually sends
When you upload a report, Doctano processes it to extract test names, results, units, reference ranges, and dates. Relevant report content is sent through the Cloudflare AI Gateway to an AI provider to do that work. The structured result comes back and is associated with your account and profile. DoctanoAI answers in the app from the results already stored there.
The Privacy Policy names the current services: Google Sign-In for account identity, Neon Postgres for application records, Cloudflare R2 for uploaded report files and profile images, the Cloudflare AI Gateway for routing report content to AI models, and Cloudflare infrastructure for hosting. The current implementation uses a Google AI Studio Gemini model for report parsing and an OpenAI model for educational biomarker content, both through the gateway.
What Doctano says it does not do
- It does not sell health data or share it for advertising.
- It does not use report content or health data for advertising.
- It does not install Google Analytics or similar third-party web analytics in the app.
- It says it does not use uploaded reports to train AI models.
- There are no public profiles or public report pages.
That is the ceiling of what this page can claim, because the Privacy Policy is the source of truth. Where the policy is silent, this page is silent too. It does not claim encryption at rest, a certification, or a retention period that the policy does not state.
Questions to ask any AI tool
- What do I have to send? A connector that can answer from structured data is different from uploading the whole document.
- Does it keep a copy? Look for a retention or history setting, and for an option to turn training on a conversation off.
- Can I delete it? Find the delete control before you upload, not after.
- Who else can see it? A shared account or a shared device is a bigger exposure than most settings.
- Is this the narrowest access that answers my question? Read-only beats read and write for almost every question.
- What happens if the tool is breached? You cannot audit a vendor from outside, but you can decide how much data is worth handing over.
What you can control in Doctano
- One report. Open it from Reports, use the options menu, and delete it. It is removed from the timeline, and the action cannot be undone.
- One account. Delete it from Account and everything linked to it goes, including profiles you created, reports, extracted results, DoctanoAI chats, sessions, and connected-app tokens.
- One grant. Open Account, then Connected Apps, and revoke a connector without deleting your account.
- Who sees a profile. Sharing is per profile and only with an existing Doctano account, and access can be removed later.
- What an AI can upload. A read-only connection cannot add a report at all.
What nobody can promise
The Privacy Policy says it plainly: no system is completely secure, and backups and operational copies may temporarily retain deleted data. Limited information may be kept where the law requires it or where it is needed for security. A page like this one should not paper over that.
Two practical consequences follow. First, the only data that cannot leak is data you never uploaded, which is an argument for uploading fewer documents rather than more. Second, deletion is the control that matters most, so it should be easy to find and easy to use. In Doctano it is in the report menu and on the Account page.
If you only remember one thing
Prefer the route that sends the least. A connected, read-only, revocable grant beats pasting a PDF, because it answers the question without turning your report into a document somebody else stores. If you do paste, paste the two values you are asking about, not the whole page.