Privacy Policy
MedSumAI is an independent, student-built research tool — not a large company with a dedicated legal or privacy team. This page explains, in plain language, what information MedSumAI collects, why, and how it's handled. If anything here is unclear, you're welcome to reach out through the contact link at the bottom of this page.
What information we collect
MedSumAI collects different information depending on how you use the site:
| If you... | We collect |
|---|---|
| Search a topic | The topic you typed, so a summary can be generated. This is stored anonymously as part of an aggregate usage count — it is not linked to your identity unless you're logged in and choose to save it. |
| Create an account | Your email address and password. Passwords are never stored in plain text — they're handled by our authentication provider using industry-standard hashing. |
| Save a summary | The topic and summary text, linked to your account, so you can revisit it later from "My Summaries." |
| Subscribe to the newsletter | The email address you provide. |
| Visit the site | Aggregate, anonymous analytics — page views and visit counts. No cookies and no individual tracking are used for this (see "Analytics" below). |
How summaries are generated
When you search a topic, it's sent to PubMed, the U.S. National Library of Medicine's public database, to find relevant articles. The article abstracts and your search topic are then sent to OpenAI's API to generate a plain-language summary. Your topic and the retrieved article text are processed by OpenAI for this purpose, in line with OpenAI's own privacy policy.
Third-party services we use
MedSumAI is built on top of a few external services, each handling a specific piece of the site:
- Supabase — stores account information, saved summaries, and usage data, and handles login/authentication.
- OpenAI — generates the AI summaries and follow-up chat responses.
- PubMed / NCBI — the public database MedSumAI searches for articles. No personal data is sent here, only search terms.
- Railway — hosts the backend automation (built with n8n) that connects PubMed and OpenAI to the website.
- GitHub Pages — hosts this website itself.
- Cloudflare Web Analytics — provides anonymous, cookieless visit statistics. It does not use tracking cookies or collect personally identifiable information.
Each of these providers has its own privacy practices governing the data that passes through them.
Cookies and local storage
MedSumAI does not use tracking cookies. It does use your browser's local storage (not a cookie) to remember two things on your own device: your light/dark theme preference, and your login session if you're signed in. This information stays on your device and is used only to make the site work smoothly for you.
Data retention and deletion
Saved summaries and account information are kept until you delete them or ask us to. You can delete individual saved summaries yourself from the "My Summaries" page at any time. To delete your account and all associated data entirely, contact us using the link below and we'll remove it.
Children's privacy
MedSumAI is intended to be useful for students, including those in high school. The site does not knowingly collect more information from a child than is necessary to create a basic account (an email address). If you are under 13, please get a parent or guardian's permission before creating an account. If we learn that a child has provided personal information beyond what's described here, we will delete it.
Security
We rely on established, reputable providers (Supabase, OpenAI, Cloudflare, GitHub) that follow industry-standard security practices. That said, no method of transmission or storage is ever completely secure, and we can't guarantee absolute security of your information.
Changes to this policy
This policy may be updated as MedSumAI changes. The "last updated" date at the top of this page will reflect the most recent revision. Significant changes will be noted here.
Contact
MedSumAI is an open-source student project. Questions, feedback, or data deletion requests can be sent via the project's GitHub repository.