Uploading a lab report to an app is safe when the app is clear about who can see the report, which providers process it, whether it is sold or used for advertising, how long it is kept, and how you can delete it. Doctano requires an account, keeps reports private to the account and the profiles shared with it, uses named service providers to run the product, and lets you delete a report, a profile, or the whole account.
The questions to ask any health app
- Who can see my report, by default and after sharing?
- Which companies process it, and what do they receive?
- Is it sold, or shared for advertising?
- Is it used to train AI models?
- Where is it stored?
- How long is it kept, including backups?
- Can I delete it, and what exactly gets deleted?
- What happens if I stop using the app?
If an app cannot answer those in writing, the answer is not 'probably fine'. It is missing.
Doctano's answers
| Question | Answer |
|---|---|
| Who can see a report | You, and the people you give access to that profile. There are no public profiles or public report pages. |
| Which providers process it | Google Sign-In for identity, Neon Postgres for application records, Cloudflare R2 for files, and Cloudflare AI Gateway to route report content to AI models. The Privacy Policy names the current models. |
| Sold or shared for advertising | No. Doctano does not sell health data or share it for advertising. |
| Used to train models | Doctano does not use your reports to train models. Report content is sent to the AI provider only to provide the feature you asked for. |
| Where it is stored | Application records in Neon, uploaded files in Cloudflare R2, and infrastructure on Cloudflare. |
| How long it is kept | While the account is active. Backups and operational copies may temporarily retain deleted data, and limited information may be kept where required by law or for security. |
| How to delete | Delete a single report in the app, delete a profile, or delete the whole account from the Account page. Other requests can go to [email protected]. |
| What happens when I stop | You can delete the account and linked data. Access you granted to someone else ends when you remove it. |
What Doctano does not claim
The Privacy Policy describes encrypted connections, secure storage, and access controls. It does not claim certification, encryption at rest, or a specific retention period beyond what is written, and this page will not invent one.
The policy is written with India's Digital Personal Data Protection Act, 2023 in mind, and it does not claim full compliance with every provision. That is a deliberate limit, not a marketing omission.
Practical precautions, whichever app you use
- Use a strong Google account with two-factor authentication.
- Upload only your own reports, or reports you have permission to upload.
- Check which profile is selected before you upload.
- Share a profile only with someone you trust, and remove access when it is no longer needed.
- Delete reports you no longer need, and delete the account if you stop using the service.
- Read the privacy policy of any app before the first upload, not after.
What about pasting a report into an AI chatbot?
A general assistant is a different arrangement from a dedicated app. Before you paste, check what the tool does with uploaded files, whether they appear in its history, and whether you can delete them. Doctano's connector takes a narrower route: the assistant gets scoped access to structured results through an account you authorize, and you can revoke that access.
Our ChatGPT and lab reports guide goes through the trade-offs.
Is Doctano HIPAA compliant?
Doctano does not claim HIPAA compliance or certification. HIPAA applies to covered entities and their business associates in the United States, and a direct-to-consumer web app is not automatically covered. The Privacy Policy describes the safeguards and the providers involved; evaluate those against your own requirements.