Ark Medical — Privacy Policy

Effective 27 September 2026

Operator: David Tran

Privacy contact: davidmdtran@gmail.com

1. About this policy

This policy explains how Ark Medical handles information when you create an account, use its medical information workspace or contact us. It covers account information and material submitted to Ark, including clinical narratives, questions, saved conversations, notes and optional audio.

Use fictional or appropriately de-identified clinical material during the beta. Do not enter identifiable patient information. Names are not the only identifiers: exact dates, rare combinations of facts, images, document metadata and recorded voices may also identify someone. Ark does not guarantee automatic removal of identifying details.

2. What we collect and why

• Account information: your sign-in identifier, email address, display name, verification status and relevant login times. We use this to identify your account, maintain access and provide support.
• Membership information: your access or plan status, beta arrangements, acceptance of Ark's conditions and related administrative records. Where billing applies, we also keep customer, subscription and transaction references and payment status.
• Material you submit: clinical text, questions, selected findings, follow-up messages, uploaded material or audio when you use those features. We process this to provide the analysis, research, transcription or other feature you request.
• Generated and saved material: responses, source references, saved conversations and structured account memory. These let you revisit conversations and continue work across sessions.
• Technical information: connection and request information, timestamps, status and error records, service usage and processing information. We use these to operate, secure and troubleshoot Ark. Some diagnostic records and result caches can contain portions of submitted or generated content.
• Correspondence and feedback: the information you choose to send by email or through feedback tools. We use it to respond, resolve issues and evaluate improvements.

Providing account information is necessary to use an account. Optional features require the material they process; for example, transcription requires audio. You can choose not to use a feature or not to send voluntary feedback.

3. Google, Microsoft and email sign-in

Ark uses Auth0 to manage authentication. If you choose Google or Microsoft, that provider authenticates you and supplies permitted identity information through Auth0. This can include an account identifier, name, email address, verification status and basic profile information such as a profile image. Ark stores the identity fields needed for its account and membership features.

Google sign-in requests basic identity, email and profile permissions. It does not request access to your Gmail messages, Google Drive files, contacts or calendar. Ark does not receive your Google or Microsoft password. For email-and-password accounts, password entry and password resets are handled by the authentication service.

We use Google sign-in information for account access, membership administration, support and billing where applicable. It is not supplied as clinical case content to the AI analysis features. We do not sell Google account information, use it for targeted advertising, or use it to train AI models. Our use and transfer of information received from Google must follow the Google API Services User Data Policy, including its Limited Use requirements where applicable.

You can review or revoke Google's connection in your Google Account. Revocation stops future authorised access through that connection; it does not by itself erase account information or conversations already held by Ark. Contact us separately for account closure or deletion requests.

4. AI, research and other service providers

Ark sends relevant submitted material to external services to perform the features you request. Depending on the feature, this can include the full case narrative, earlier conversation, selected findings, research questions, source passages or text to be reformatted. It is not limited to anonymous usage statistics.

The current service integrates OpenRouter and model services including OpenAI, Google, Meta and DeepSeek. The route depends on the feature and configuration; not every provider receives every request. Literature services such as NCBI/PubMed and Europe PMC receive search queries derived from your case. Article-retrieval services may receive article identifiers or URLs. Derived search terms can still contain information from your input.

If you use audio transcription, your recording is sent to Together AI's transcription service. Do not record a patient or other person without an appropriate basis or include identifying details. A voice recording may itself identify a speaker. Text used for spoken playback is also processed by the speech feature; its current default runs on Ark's own service infrastructure.

Other providers support authentication, website delivery and network protection, hosting and communications. These include Auth0 and Cloudflare. Where you choose a paid service, Square processes payment information and receives the necessary account and transaction details. Ark's billing records use payment references and status information; the billing integration does not send your clinical narrative to Square.

Service providers may process information outside Australia. We do not promise that all processing stays in Australia or that every provider has zero retention. Supplier handling depends on the relevant service and account configuration.

5. Storage, cookies and saved conversations

Ark automatically saves conversations to your account on its server. A saved conversation may include the narrative, findings, conversation text, results and references. Structured account memory is also stored on the server. These records can persist after you close the browser or sign out.

Your browser also stores some preferences and working material, including notes drafts. On a shared device, another person with access to the same browser profile may be able to see locally stored material.

Ark uses cookies to keep you signed in and complete sign-in safely. Its current account-session cookie lasts up to seven days, and its temporary sign-in cookie lasts up to ten minutes. Authentication providers may set their own cookies. Blocking necessary cookies can prevent sign-in from working.

6. Retention and deletion

The current conversation history keeps the latest 50 saved conversations per account. That is a count limit, not a time-based deletion promise. Account memory, notes, logs, temporary result caches, support correspondence and billing records have separate lifecycles. There is currently no single automatic age-based deletion period across all of these records.

You can delete individual conversations and clear account memory using Ark's available controls. Notes can also be cleared in the Notes feature. These actions do not necessarily remove separate exports, support messages, diagnostic logs, backups or copies already processed by external providers. Clearing your browser or signing out does not delete server-side account records.

For account closure or a broader deletion request, email the privacy contact. We will verify the requester's identity in a proportionate way and explain what can be deleted and any records that must be retained, for example to meet a legal obligation or resolve a dispute.

7. Access, correction and complaints

Email davidmdtran@gmail.com to request access to or correction of your personal information, ask about deletion, or make a privacy complaint. Describe the issue and the account email involved, but do not send passwords or identifiable clinical details in the initial message. We may need further information to verify identity or locate the relevant records.

We will consider the request, respond with the outcome or next steps, and explain any applicable reason that a request cannot be met. If more time is needed, we will explain why. You may also contact an applicable privacy regulator, including the Office of the Australian Information Commissioner where it has jurisdiction.

8. Security and policy changes

Ark uses authenticated accounts, protected sign-in cookies and encrypted web connections. These safeguards do not make any online service risk-free. Contact us promptly if you suspect unauthorised access or have accidentally submitted identifying information.

We will update this policy when our practices materially change, show the effective date and provide appropriate notice. A new use of information is not authorised merely by silently changing the wording of this policy. Where additional consent or another legal basis is required, we will obtain it before that new use.