Rule Out is built to work without patient identifiers. This page explains what it stores, who processes your information, and how to delete it.
Do not enter patient identifiers
Rule Out is not designed to hold protected health information (PHI). We do not have business associate agreements with the vendors below. Do not enter names, dates of birth, record numbers, addresses, phone numbers, or other identifiers.
Rule Out scrubs common identifier formats from text before it reads a record or saves a case to an account. Scrubbing can miss things, especially names in free text. It cannot remove anything from a photo or scanned page, so remove identifiers before you upload one.
What stays in your browser
Your settings, plus saved cases and references, stay in this browser's storage when you are signed out. Rule Out does not send them to an account unless you sign in and choose to import them.
What we store when you sign in
- Account: your email address.
- Profile: role, unit and appearance preferences, when you accepted the disclaimer, and your display name and practice setting if you add them.
- Saved cases: an age band instead of the exact age, sex, clinical content, results, plans, and any case name or outcome you add.
- References: the links and notes you save.
- Usage: how many AI requests you make each day, by type.
What we do not store
- Audio from dictation.
- Uploaded files. Rule Out reads them and does not keep them. Items you add to a case are saved only if you save that case.
- Prompts and AI replies in logs or error reports. A reply is stored only as part of a case you save.
Vendors that process your information
| Vendor | What it does | What it receives |
|---|---|---|
| Vercel | Hosts the app and runs its server code in Oregon, US. Provides cookieless page view analytics. | Your IP address, browser type, and the pages you request. Case content passes through its servers on the way to Anthropic. We do not log it. |
| Anthropic | Provides the AI that ranks diagnoses, writes plans, and reads records. | The case content you submit: complaint, age, sex, vitals, history, symptoms, labs, scores, record text, and any photos or scanned pages. |
| Supabase | Provides sign-in and the database for accounts, in Oregon, US. | Your email address, profile, saved cases, references, and daily AI request counts. |
| Sentry | Reports errors so we can fix them. | The error message and code location, the page path, your browser type, and your role setting. We remove request bodies, query strings, typed content, and console output. |
| Resend | Sends sign-in emails. | Your email address and the sign-in email. |
Each vendor handles this information under its own terms. We do not sell your information.
Browser speech services for dictation
Dictation uses your browser's speech service, not Rule Out. When you tap the microphone, your browser handles the audio: Chrome sends it to Google, Edge sends it to Microsoft, and Safari uses Apple. These companies are third parties, and their own terms apply. Rule Out receives only the text and does not store audio. Avoid saying names or other identifiers. To avoid these services, type the complaint.
Cookies
Rule Out uses cookies to keep you signed in. Analytics do not use cookies.
Delete your account and data
- Sign in and open Settings.
- On the Account tab, select Delete my account, and then select Delete permanently.
This removes your account, profile, saved cases, references, and usage history from our database. Vendor logs, error reports, and backups can keep copies for a limited time.
Deleting your account does not clear this browser. To do that, go to Settings, open the Data tab, and select Clear data saved in this browser. The Data tab also lets you export your cases and references first.
Contact
For privacy questions or help with deletion, email jesterlloydbautista@gmail.com.