Draft — pending legal counsel review
Privacy
Privacy policy
Meleia is built on data minimization, not on disclaimers. Below is a plain description of what actually happens to your report text in this implementation.
Anonymous by default
You can use Meleia's full analysis flow without creating an account. An anonymous session is used only to let you read back the one analysis you just created; it does not identify you. Creating an account is only needed if you choose to save a follow-up plan across visits.
What is stored, and for how long
Raw uploads (screenshots, PDFs)
Stored only in a dedicated temporary, encrypted location. Deletion target: under one hour after processing. Hard lifecycle deletion backstop: within 24 hours, regardless.
Structured, anonymous analyses
Expire automatically. Target: under 24 hours after creation. After expiry, the analysis and its access token stop working.
Saved follow-up plans
Opt-in only, and only after you sign in. Only the structured follow-up (its dates, status, and the specific evidence spans behind it) is retained — never your full report text — and it is encrypted at rest. You can delete a saved plan at any time.
Reminders and caregiver invites
Reminder messages never contain your report's findings, diagnosis, anatomy, or dates from the report — only a generic prompt to check your plan. Caregiver access is scoped to the follow-up action, its dates, and your own note, never your full report.
What Meleia does not do
- No sale of your data.
- No ad targeting or advertising pixels.
- No session replay tracking.
- No training AI models on your report content.
- No report content in URLs, filenames, cache keys, analytics events, logs, emails, or notification previews — ever, by design, not just by policy.
Your controls
You can download or delete a saved follow-up plan at any time from your account. An anonymous analysis needs no deletion request — it expires automatically on the schedule described above.
Regulatory context
Meleia's health-adjacent data practices are designed with the FTC Health Breach Notification Rule and Washington State's My Health My Data Act in mind. Operating direct-to-consumer, outside a traditional covered-entity relationship, does not remove Meleia's privacy obligations — this product is built to the more protective standard, not the narrower one.