Ask what it collects, who processes it, whether it is sold or used for ads, whether it trains models, where it is stored, who can see it, whether you can delete one report and the whole account, whether you can export it, and what stays after deletion. Straight answers to all ten beat a long policy.
How to use this list
Read the policy looking for answers, not reassurance. If a question cannot be answered from the page, that is itself an answer. The last column below is Doctano's own, so the list is not a way of pointing at other people.
| Question | Why it matters | Doctano |
|---|---|---|
| 1. What is collected? | You cannot assess a risk you cannot see. | Account details, profile details, uploaded reports, extracted results, and session and device information needed to run the service. |
| 2. Who processes it? | "We do not share" and "we use providers" are different claims. | Google Sign-In, Neon Postgres, Cloudflare R2, Cloudflare AI Gateway, and Cloudflare hosting. Named in the policy. |
| 3. Is it sold, or used for ads? | Health data is unusually valuable to advertisers. | No selling, no ad use, and no third-party advertising scripts in the app. |
| 4. Is it used to train models? | Training use is often separate from storage. | The policy says uploaded reports are not used to train AI models, and it makes no further promise about providers. |
| 5. Where is it stored? | Country and vendor decide which law applies. | Application records in Neon Postgres, report files and profile images in Cloudflare R2. |
| 6. Who can see it? | Sharing is usually the largest exposure, not a breach. | You, people you share a profile with, and anyone who can sign in to your account. No public pages. |
| 7. Can I delete one record? | Most concerns are about one report, not everything. | Yes. Delete report from the report's options menu. |
| 8. Can I delete everything? | Deletion with no exit is not deletion. | Yes. Delete account from Account, confirmed by typing the account name. Permanent. |
| 9. Can I export it? | Portability is your protection against lock-in. | No export feature yet. A per-report original-file link is available where the file exists. |
| 10. What survives deletion? | This is where policies get vague, and where they matter. | Operational processing records, backups that clear on their normal cycle, and information kept where the law requires it. |
The three questions people forget
Who else is on the account. A shared login, a shared device, or a family member who knows the password is a bigger practical risk than most server-side questions. If an app supports separate profiles, use them, and do not share one account for two people's records.
What happens when you stop using it. An abandoned account is still an account. If you stop using a health app, delete it rather than leaving it dormant.
What the app does not claim. A policy that says "no system is completely secure" is more trustworthy than one that implies otherwise. Restraint in claims is a signal, not a weakness.
What to do with the answers
- Write down what you could not find. If the answer is not in the policy or the app, treat it as unknown.
- Upload less. The narrowest data that answers your question is the right amount.
- Test the delete button before you rely on it. Find it once, so you are not searching for it in a hurry.
- Prefer scoped access to copies. A revocable connection that answers a question beats a duplicate of the file sitting in another tool.