1. Where processing happens
| Data | Where it is processed | Where it is stored |
|---|---|---|
| Original uploaded file (PDF, TXT, CSV…) | Your browser only | Never stored — held in memory for the session |
| Extracted document text | Your browser; sent to the AI model only when you send a message | Never stored by Virtual Clinic |
| Case titles and chat history | Your browser | This device's localStorage only |
| Consent record | Your browser | This device's localStorage only |
2. In-browser document parsing
PDF and text extraction runs entirely client-side using a JavaScript parser executing in your browser tab. The binary file is never transmitted: there is no upload endpoint, no object storage and no virus-scanning intermediary.
3. Transient AI processing
When you send a message, the extracted text of the documents you attached plus your conversation is transmitted over TLS 1.2+ to our server function, which immediately forwards it to the AI model and streams the answer back to you. The server keeps no database, writes no logs of message content, and retains nothing after the response is delivered. Model providers process the request to produce the completion only.
4. No accounts, no tracking
- No sign-up, no passwords, no user profiles.
- No advertising, analytics or third-party tracking cookies.
- The only browser storage used is strictly necessary: your consent record and your local case history.
5. Shared-device guidance
Because case history is stored in this browser, anyone with access to this device profile can read it. On shared or clinical workstations use a private window, and use Wipe all local data in the workspace sidebar when you finish.
6. Your responsibilities
- Pseudonymise documents before analysis.
- Confirm your organisation permits AI-assisted document review.
- Keep your device encrypted, screen-locked and patched — endpoint security is outside our control.
7. Reporting a vulnerability
If you believe you have found a security issue, stop testing, avoid accessing any data that is not yours, and report it to the platform operator through the contact channel published by your deployment. We ask for a reasonable disclosure window before public discussion.