How we protect your information

Accounts use email and password or Google sign-in. Passwords are stored as one-way cryptographic hashes by our authentication provider — we never see or store the plain-text value. Email changes require confirmation from both the current and the new mailbox.

You can change your password, change your email, and sign out of every device you've ever signed in on from Settings → Security.

Authentication, profile, uploaded reports, generated reports and tracker entries are stored in distinct tables. Every table is protected by row-level security policies that allow access only when the request carries your authenticated user identity.

A user can never read, list or modify another user's profile, uploads, reports or tracker data. These rules are enforced on the server — not in the browser — so they cannot be bypassed by editing client-side code.

All traffic between your device and Detectives Health is encrypted using TLS. Sensitive information is never placed in URLs or shared links. Database backups and storage are encrypted at rest by our managed infrastructure provider.

We accept PDF, JPG, JPEG and PNG files only. Executables and unsupported file types are rejected. Uploaded files are stored in a private bucket scoped to your account and are accessed through short-lived signed URLs — there are no public links to your reports.

Temporary files created during processing are deleted automatically once your educational report is ready.

When a report is ready we notify you in-app and (optionally) by email. Notifications contain only a generic message such as "Your Detectives Health report is ready."They never contain laboratory values, medical information, diagnoses or personal identifiers. You must sign in to view the report itself.

• Access: see what we hold about you.
• Portability: download every record we hold about you as a single JSON file from Settings.
• Rectification: change your email, password and profile from Settings.
• Erasure: permanently delete your account and all associated data from Settings → Danger zone.
• Data minimisation: we only ask for what is needed to give you a useful educational interpretation.

Analytics that identify you are opt-in and disabled by default. You can change your preference at any time. We never sell your information.

A small number of authorised administrators can review flagged content and operate the platform. Administrative access to user health information is restricted to what is strictly necessary for technical support, is governed by internal procedure and is recorded in an audit log.

If you believe you've found a security issue, please contact us via the contact page with the subject "Security". We take all reports seriously and will respond promptly.