Privacy Policy

1. Introduction

Chewie AI, Inc. ("Chewie," "we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Medical AI API platform and related services (collectively, the "Services").

Given the sensitive nature of healthcare data, we adhere to the highest standards of data protection, including compliance with applicable healthcare data protection regulations, GDPR principles, and industry best practices for medical AI systems.

2. Information We Collect

2.1 Account Information

We support two sign-in methods, and the data collected depends on which you choose:

• Google sign-in: name, email address, Google account ID, and profile picture URL. We request the basic email and profile scopes only — we do not access Gmail, Calendar, Drive, or any other Google service.
• GitHub sign-in: name, email address, GitHub username, and avatar URL.
• Optional profile data added by you: clinician role, organization or company name, facility membership, and (for paid plans) billing information.

2.2 API Usage Data

When you use our API, we collect:

• API request metadata (timestamps, endpoints accessed, response codes)
• Usage statistics (request counts, token usage)
• API key identifiers (not the keys themselves)
• IP addresses and request headers for security purposes

2.3 Query Data and Medical Information

Important: We process medical queries submitted through our API to provide inference responses. However:

• We do NOT store the content of your API queries after processing
• We do NOT use your query data to train our models
• We do NOT share query content with third parties
• Query processing occurs in memory and is discarded after response delivery

2.4 Technical Information

• Device information and browser type
• Log data and error reports
• Cookies and similar tracking technologies

3. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve our Services
• Process API requests and deliver medical AI inference
• Manage your account and provide customer support
• Process payments and manage subscriptions
• Monitor usage for billing and rate limiting purposes
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations
• Send important service-related communications

4. Data Retention

Different categories of data have different retention windows, sized to balance operational utility, audit-log obligations, and the data-minimisation principle:

• Account information: retained while your account is active. On account closure, profile data is deleted within 30 days; signed clinical attestations attributed to you are retained as part of the audit log (see below) but the personal identifiers attached to them are pseudonymised.
• Triage attestations (clinical audit log): retained for 7 years from the date of sign-off. This is the conservative end of the medical-record-retention norm across the African jurisdictions we serve and matches the WHO clinical-records guidance. The audit log is append-only — addenda may be added but the original sign-off is never mutated.
• API usage logs: retained for 90 days for operational purposes (rate limiting, billing, debugging). After 90 days, only aggregated counts are kept for capacity planning.
• Public-health insights / surveillance data: the live query window is 90 days; older attestations contribute only to anonymised, small-cell-suppressed aggregates used for outbreak signals. Partner exports never include identifiers below facility level.
• Medical query content (Developer API): we do not retain the content of API queries. They are processed in memory and discarded after the response is returned.
• Webhook idempotency keys: retained for 30 days, after which Paystack retransmissions are no longer expected.

You may request deletion of your account and associated data at any time by writing to [email protected]. Where retention of clinical-audit data is required by law, we will pseudonymise rather than delete.

5. Data Security

We implement robust security measures including:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• API key hashing using industry-standard algorithms
• Regular security audits and penetration testing
• SOC 2 Type II compliance (in progress)
• Access controls and authentication requirements
• 24/7 infrastructure monitoring

6. Data Sharing and Disclosure

We do NOT sell your personal information. We may share information only:

• Service Providers (sub-processors): With trusted third parties who assist in operating our Services — including authentication (Supabase), payments (Paystack), and hosting (Railway) — each under contractual confidentiality and data-protection terms. A current list is maintained at /sub-processors.
• Legal Requirements: When required by law, court order, or government request
• Safety: To protect the rights, property, or safety of Chewie, our users, or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with notice)

7. Your Rights and Choices

You have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and data
• Portability: Receive your data in a portable format
• Objection: Object to certain processing activities
• Withdrawal: Withdraw consent where applicable

To exercise these rights, contact us at [email protected].

8. International Data Transfers

Our Services are hosted in secure data centers. If you access our Services from outside our primary hosting region, your information may be transferred internationally. We ensure appropriate safeguards are in place for such transfers, including standard contractual clauses where applicable.

9. Healthcare Data Compliance

While Chewie provides medical AI inference capabilities, we are designed as a developer tool and not a covered entity under HIPAA. However, we follow HIPAA-aligned security practices. Developers integrating our API into healthcare applications are responsible for ensuring their own HIPAA compliance where applicable.

For customers requiring a Business Associate Agreement (BAA), please contact [email protected].

10. Children's Privacy

Our Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will promptly delete it.

11. Cookies and Tracking

We use essential cookies to maintain your session and preferences. We do not use advertising or third-party tracking cookies. You can control cookie preferences through your browser settings.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or through our Services. Your continued use of the Services after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at: