Legal
Last updated: June 25, 2026
Privacy PolicyTerms of ServiceMedical Disclaimer

Privacy Policy

Effective Date: July 4, 2026

Doctilio (“we,” “our,” or “us”) provides a medical dictation application (“App”) that allows healthcare professionals to record voice dictations, transcribe them into text, and manage medical reports. This Privacy Policy explains how we collect, use, store, and protect your information when you use our App.

By using Doctilio, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

What we collect, in plain terms: Your speech is transcribed into text entirely on your device, so we do not store your audio recordings. We store the transcribed report text so you can access it across your devices, and we process that text, including through Together AI (a third-party AI provider), to correct its grammar and spelling and to format it. We also retain that text to review quality and to improve our transcription-correction models. We are designed to minimise patient-identifying data: your custom vocabulary (such as names) stays on your device, we redact patient identifiers before report text is shared with Together AI, and we do not run third-party advertising or tracking.

1. Information We Collect

1.1 Account Information

When you sign in using Google Sign-In or Sign in with Apple, we receive and store:

  • Name
  • Email address (for Sign in with Apple, this may be a private-relay address ending in @privaterelay.appleid.com)
  • Profile picture (Google Sign-In only)
  • A stable provider account identifier, and a user ID we assign to you

1.2 Profile Information

During onboarding, we may collect additional information you voluntarily provide:

  • Phone number

1.3 Transcription Data

  • Voice recordings: Audio is captured temporarily on your device for real-time transcription. Voice data is processed on-device and is not retained, stored, or transmitted to our servers.
  • Transcribed text: The report text generated from your dictations is uploaded to our cloud servers, where it is processed by AI to correct and format it and stored so you can access your reports across devices. We retain this text and may use it to review quality and to improve and train our transcription-correction models. When you use our AI text-improvement feature, this text is also processed by Together AI, a third-party AI provider (see Section 4), for grammar and spelling correction, and recorded in our internal logs.
  • Custom vocabulary: Your custom vocabulary (such as drug names, referring physicians, and patient surnames) is stored and used only on your device and is never sent to us.
  • Patient identifiers: Doctilio is a documentation aid designed to minimise patient-identifying data. You are responsible for avoiding directly identifying patient data in your reports; the report text you choose to save is uploaded and stored as described above. Before report text is shared with Together AI for grammar and spelling correction, we redact patient identifiers from it.

1.4 Usage and Subscription Data

We collect information related to your subscription status, plan type, and free-trial eligibility to manage access to App features. Payments are processed by the app stores; see Section 4.

1.5 Device and Technical Data

We may automatically collect limited technical data required for the App to function and to keep your account secure, including:

  • Device type and operating system version
  • For the desktop app, a device identifier and device name used to manage your active session
  • Your IP address and your app or device User-Agent, recorded in our security and audit logs
  • Authentication tokens (stored locally on your device)

1.6 Anonymous Operational Data

We collect a small amount of anonymous, aggregated operational data so the App keeps running reliably. This data is not linked to your identity, never includes the content of your dictations, and is never used to train or improve our AI models. Examples include:

  • Aggregate counts of features used (e.g. how often the desktop widget is opened)
  • Approximate session duration and frequency of use
  • Crash reports and performance metrics
  • Anonymized error logs that help us diagnose bugs

We do not use this operational data to identify individual users, and we do not sell or share it with advertisers.

2. How We Use Your Information

  • Authentication: To verify your identity and manage your account via Google Sign-In or Sign in with Apple.
  • Transcription services: To provide on-device speech-to-text transcription and sync your transcribed reports across your devices.
  • AI text correction and formatting: To process your transcribed text (using a correction model we host ourselves and Together AI) for grammar, punctuation, and clinical formatting, and to review quality and to improve and train our correction models.
  • Account management: To manage your subscription, free trial, profile, and preferences.
  • Security and operations: To secure your account, prevent abuse (including enforcing our one-time free-trial limit), maintain audit logs, and keep the App running using only the anonymous operational data and crash reports described in section 1.6.

3. How We Store and Protect Your Information

  • On-device storage: Authentication tokens, cached reports, and preferences are stored locally on your device in your device’s secure storage (such as the iOS Keychain or Android’s SharedPreferences), accessible only to the App.
  • Cloud storage: Transcription text and account information are stored on our managed cloud servers, protected by the encryption-at-rest our hosting providers offer.
  • Encryption in transit: Data transmitted between the App and our servers is encrypted using HTTPS/TLS.
  • Application controls: We use parameterised database queries, input sanitisation, row-level database access controls, and audit logging.
  • Access tokens: We use short-lived access tokens (valid for 60 minutes) and refresh tokens (valid for 30 days) to secure your sessions. Expired sessions are automatically logged out.

We do not provide end-to-end encryption: your transcribed text is processed and stored in readable form on our servers and, for the AI text-improvement feature, by Together AI. We implement reasonable security measures and limit what we collect to what is strictly needed to run the service.

4. Third-Party Services

We use the following third-party services (sub-processors) to operate the App:

  • Google Sign-In and Sign in with Apple: For authentication. The provider’s privacy policy applies to data it processes.
  • Together AI (United States): A hosted large-language-model service we use for grammar and spelling correction of your dictated text. When you use the AI text-improvement feature, your report text is transmitted to Together AI to correct and improve it, after we redact patient identifiers from it. Together AI provides the same or equal protection of this data as described in this Privacy Policy.
  • Cloud hosting providers: Managed database hosting, backend compute, our self-hosted correction model, file storage, and secrets management for your account and report data.
  • Apple App Store and Google Play: Process all subscription payments and provide store receipts and subscription status.

We do not use third-party analytics, advertising, or tracking services within the App.

5. Data Sharing and Disclosure

Beyond the sub-processors listed in Section 4, we do not sell, rent, or trade your personal information. We may share your information only in the following circumstances:

  • Service providers: With trusted service providers who assist in operating our backend infrastructure, subject to confidentiality obligations.
  • Legal requirements: When required by law, regulation, legal process, or governmental request.
  • Safety: To protect the rights, safety, or property of Doctilio, our users, or the public.

6. Data Retention and Account Deletion

  • Account data: We retain your account information for as long as your account is active.
  • Transcription data: Your report text is retained on our servers for as long as your account exists, unless you delete it. When you delete a report, it is removed from your account view but may be retained in our systems (marked as deleted) and is not immediately purged.
  • Local data: Data stored on your device is removed when you log out or uninstall the App.
  • Account deletion: You can delete your account in the App or by contacting us. We immediately deactivate and anonymise your account (we remove your name, phone number, profile picture, email, and Google/Apple identifiers), but your saved report text and per-utterance dictation text are retained in de-identified form, and certain audit records (including your former email and IP address) and the identifiers we use to enforce our one-time free-trial limit are retained. We do not currently perform a complete erasure of all of this data after a fixed period. Deleting your account does not cancel any active App Store or Google Play subscription; you must cancel that separately with Apple or Google.

To request deletion or ask questions about retention, please contact us at support@doctilio.com.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete data, or update your profile in the App.
  • Deletion: Request deletion of your personal data and account, subject to the retention described in Section 6.
  • Portability: Request a copy of your data in a portable format. You can also export individual reports to PDF or Word from within the App.
  • Withdraw consent: You can stop using the App at any time and request account deletion.

To exercise any of these rights, contact us at support@doctilio.com. Please note that some data (de-identified report text, audit records, and the identifiers used to enforce trial eligibility) may be retained as described in this policy, so a request for complete erasure may be limited.

8. Children’s Privacy

Doctilio is designed for use by healthcare professionals and is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will take steps to delete such information promptly.

9. International Data Transfers

Our servers are located in India, and your account and report data are stored with our cloud hosting providers. When you use the AI text-improvement feature, your report text, with patient identifiers redacted, is transferred to Together AI in the United States. If you use the App from another country, your information will be transferred to, processed, and stored in these locations, which may have different data-protection laws than your country of residence. By using the App, you consent to these transfers.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the “Effective Date” at the top of this page. Your continued use of the App after changes are posted constitutes your acceptance of the revised policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Doctilio
Email: support@doctilio.com