Doctor’s Journal

Privacy Policy

This policy explains where your data lives, what leaves your phone, and your rights over it.

Who we are

Doctor’s Journal is made and provided by Māhanga Technologies Limited (“we”, “us”), a New Zealand company (NZBN 9429053963871). We follow the New Zealand Privacy Act 2020.

Where your data lives

Doctor’s Journal is a local-first app. Your health records, medications, providers, documents and other personal data are stored in an encrypted database on your phone. We do not run a central database of your health records, and we cannot view or restore them for you.

Stored on your phone:

• Recordings of medical appointments, their transcripts and AI summaries
• Your symptoms diary, journal entries and notes for your doctor
• Medications: names, doses, schedules, refill dates and prescription details
• Documents and test results you upload
• Your doctors, specialists and pharmacies
• Appointments and reminder times
• Health readings from Apple Health or Health Connect, if you connect them
• Emergency contacts and medical details you choose to keep

Your account and subscription

To run your account the app uses these services. None of them receive your health records.

• Firebase Authentication (Google) stores your email address and sign-in details, so you can sign in with Apple, Google or email.
• Our Firebase server (Google) runs the AI features below and keeps a small record for your account: your name, email, sign-up date and how you sign in, how many AI requests you have used, your subscription status, and the app-use details described below.
• The App Store and Google Play handle payment. The app never sees your card details.
• RevenueCat confirms whether your subscription is active. It receives your account identifier and your purchase record.

What leaves your phone for AI features

Before any AI processing, the app asks for your consent. You can say no, and your recordings stay on your phone without a transcript or summary. You can withdraw consent in the app’s settings.

• OpenAI is the only AI provider. Whisper transcribes your audio. GPT-4o and GPT-4o-mini write summaries, explain documents, prescriptions and test results, and answer Ask DJ questions. OpenAI text-to-speech reads summaries aloud. Requests go through our Firebase Cloud Functions. Long recordings are held briefly in Firebase Storage and deleted as soon as transcription finishes, whether it worked or not.
• Google Cloud Vision reads the text in scanned documents. Google Places helps you find providers.

OpenAI does not use data sent through its API to train its models. OpenAI may keep it for up to 30 days to detect abuse, under its standard terms. OpenAI and Google may process this data outside New Zealand, including in the United States. We never sell your data or share it for advertising.

Apple Health and Health Connect

Connecting these is optional. The app only reads from them, and the readings stay on your phone.

Backups

Backups are your choice. When you turn them on:

• Your data is encrypted with AES-256 on your phone before it leaves.
• The encrypted backup goes to your own iCloud (iPhone) or Google Drive (Android) account, not ours. Apple and Google store it but cannot read it.
• So you can restore on a new phone, a copy of the backup key, sealed with a secret held on our server, is kept with your backup. Our server can open that copy only for the same signed-in account. We do not hold your backups.
• If you delete a backup from your cloud storage, it is gone and we cannot recover it.

If you turn backups off and lose or reset your phone, your data cannot be recovered.

Reminders

Reminders are local notifications from your phone. There is no push messaging service.

How we use app activity

To improve Doctor’s Journal and run Māhanga’s services, we record how the app is used:

• which screens and buttons you use, by name, and when and for how long (sessions)
• the app version, your phone type and its system version
• your email address, how you sign in, your plan, and when you signed up and were last active
• how many things you keep, for example how many recordings, doctors, medications, symptoms and documents, and how many AI requests you have made and what they cost

We never include the content of your records: no notes, transcripts, summaries, medication names, documents, Ask DJ questions or anything you type.

This goes through our Firebase Cloud Function to Māhanga’s analytics service, which runs on Cloudflare and stores it in Cloudflare’s Oceania region, with the database in Sydney, Australia. It is never sold or shared with advertisers. We keep detailed activity for 13 months and daily totals for 3 years, and we delete it when you delete your account.

You can turn off part of this in Settings → Security → Share app activity. When it is off, your phone sends no screen, button or session activity. Your account details and daily totals are still sent from our server each day, whether the switch is on or off.

If you send us feedback

Feedback you send from the app, with any screenshots you add, is stored on our Firebase server with your name and email so we can reply. Please leave out health details you do not want us to see. It is deleted when you delete your account.

Your rights

• Export: export your medical history from the app at any time, as a PDF or a JSON file.
• Access and correction: see and edit everything in your journal in the app. For information we hold, such as your account details and app activity, email us.
• Deletion: delete your account and its data in the app, in Settings → Security → Delete account. This cannot be undone.

Email dj-admin@mahanga.co.nz with any privacy question or request. You can also raise a concern with the Office of the Privacy Commissioner (privacy.org.nz).

How long we keep your data

Your journal stays on your phone for as long as you keep it. If you delete your account, the data on your phone and the data on our server are removed. Backups in your own iCloud or Google Drive are not touched, because we have no access to them, so please delete those yourself.

Security

• Backups are encrypted with AES-256 before they leave your phone, and keys are kept in your phone’s keychain or keystore.
• Information is sent over encrypted connections.
• You can sign in with Face ID or fingerprint, and app lock asks for them each time you return.
• Sessions time out after 30 minutes without activity by default. You can change this in Settings.
• An account locks for 15 minutes after 5 failed sign-in attempts.

Children

Doctor’s Journal is not intended for children under 16, and we do not knowingly collect their information. If you believe a child has given us information, please contact us.

Changes to this policy

If we change this policy we will update the date below and tell you in the app. If we make a material change to how we handle your health data, we will give clear notice in the app and may ask for your consent again.

Last updated 6 November 2026