Privacy notice
Updated November 10, 2026
Medical records you authorize are stored on your iPhone, not on Saaya’s servers. Saaya has no user accounts, no analytics, and no advertising. AI summaries are optional: if you turn them on, record text is sent to a cloud AI provider to produce them.
Who is responsible
Akiff Premjee develops Saaya under the FullStackMD brand. Questions and requests: akiff.premjee@gmail.com.
Whose records
You can connect your own chart. You can also connect the chart of someone you help care for, if that person has given you proxy access at their health system. In both cases you sign in to MyChart with your own account. Saaya shows you whose chart was returned and asks you to confirm before importing it. If you connect another person’s chart, you are responsible for having their permission to view it in Saaya and, separately, to use AI summaries on it.
Information used
With your authorization, Saaya reads patient details, conditions, medications, allergies, laboratory and vital-sign results, reports, visits, procedures, immunizations, care plans, care team, insurance coverage, and clinical notes. These can include names, dates, identifiers, clinical narratives, and information about clinicians or others. Saaya is read-only: it cannot change or delete anything in the health system’s record. A health system may return less than what was requested.
Saaya also keeps what you add yourself, such as the people you set up, the status of a next step, and who is handling it.
How it is used
Records are used to show you an organized view of each person’s care: what changed, the documented plan, next steps, and the original records. Saaya does not sell records or use them for advertising, research, or model training.
Where records are kept
Imported records and the information you add are stored in the app on your iPhone and protected by the device’s built-in encryption when it is locked. They are excluded from iCloud backup. Saaya does not copy your records to a FullStackMD server or database. Anyone who can unlock your device can see what the app shows, so keep it locked and up to date.
Ongoing access to your health system
So that you do not have to sign in every time, Saaya asks MyChart for ongoing read-only access. You choose how long that access lasts on the MyChart consent screen, which shows the end date. Saaya shows that date when the health system provides it, and otherwise tells you when access has ended and asks you to sign in again. The app keeps the resulting access credentials in the iPhone Keychain on your device only.
To obtain and renew access, the app sends your one-time sign-in code or renewal credential over HTTPS to a FullStackMD server hosted on Vercel, which signs the request and passes it to your health system. That server does not store or log these credentials and never receives your MyChart password or your medical records.
Optional AI summaries
AI summaries are off unless you turn them on. Saaya asks when you set it up, explains what is sent, and you can change your choice at any time in the app. While they are on, Saaya sends record text, titles, dates, and statuses from the charts you have connected over HTTPS to FullStackMD’s server on Vercel and then to third-party AI model providers, to generate summaries, next steps, and answers with links to their sources. This happens as needed without asking again each time. Notes can contain names and identifiers; this text is not anonymized.
FullStackMD’s server does not save or log record content or summaries, and it asks AI providers not to store requests where they offer that option. This is not a guarantee of zero retention: a provider may keep request content for a limited period, for example to monitor for abuse, under its own policies. Saaya uses only providers whose terms say that content sent through their API is not used to train their models by default. Saaya does not claim a business associate agreement, HIPAA certification, or a zero-retention arrangement with any provider. The providers in use can change; you can ask which are currently used at the contact address above. See also Vercel’s privacy policy. Turning AI summaries off stops further sending and leaves everything else available.
Your choices
You decide whether to connect a chart and for how long. In the app you can remove a connection or a person, which deletes their imported records and access credentials from your device. Deleting the app removes everything it stored. To end access at the source, revoke Saaya in the health system’s MyChart settings. Removing data from Saaya never changes the health system’s record.
Website and hosting
Saaya’s public pages and servers are hosted on Vercel. Visiting or calling them exposes normal web-request metadata, such as IP address, browser user agent, requested URL, and time, to the hosting provider under its own retention practices. The public pages have no analytics or tracking cookies.
Security and limitations
Saaya uses the health system’s own sign-in, proof-key and state checks on every sign-in, signed requests for ongoing access, and restricts record requests to the health system you chose. No measure guarantees security. Saaya does not claim independent security certification. Do not email medical records, passwords, or access codes to the developer.
Changes
If Saaya begins storing records off your device, sharing them with other people or services, or materially changes its AI processing, this notice will be updated before the change takes effect.