Changes to this privacy policy
We may update this Privacy Policy as the Services or the law change. When we do, we will update the effective date at the top of this page. If we make material changes, we will notify you before they take effect, for example through the Services or by message. We will ask for your consent before we use Google user data in a way that differs materially from what this policy describes.
Collection and use of information
We collect information to provide the Services and carry out the work you ask Leo to do, to keep the Services secure and working, to communicate with you, and to comply with our legal obligations. The sections below describe what we collect and how we use it.
We do not sell your personal information, and we do not share it for cross-context behavioral or targeted advertising. Fetch Data does not use your content, including your messages, documents, Vault items or connected-account data, to train AI models.
Information you directly provide us
- Account and contact details. When you sign up, our sign-in provider verifies your mobile phone number by text message. We receive your name, your verified phone number and, if you add one, a verified email address. We keep an internal account identifier, your account status, and the progress of your account setup.
- Communications with Leo. Messages you send to Leo through iMessage, and the replies and messages Leo sends you, including follow-ups Leo starts about your open tasks. We also keep delivery records, such as timestamps and whether a message was inbound or outbound.
- Professional records and documents. Information you share about your training, work history, licenses, DEA and other registrations, board certifications, CME, malpractice coverage, pay and contract terms, and the forms you are working on, and documents you upload, such as a CV, license or certificate.
- Vault items. Logins, phone numbers, addresses, payment cards (including the security code) and other details a site may ask for, such as a date of birth, that you enter through a secure single-use link. See Information collected through your use of the Services below.
- Communications with us. Messages you send to our contact email address, and any feedback you give us.
The Services do not currently include paid plans, and we do not collect payment information for them. A payment card you save in your Vault is used only to fill in a payment form when you ask Leo to make a purchase or pay a fee on your behalf.
Information collected through your use of the Services
What Leo can access depends on the permissions you give it and the tasks you ask it to do:
- Notes Leo keeps. To continue your work over time, Leo keeps notes about your professional context, such as deadlines, open tasks, preferences and what it has verified. Leo labels what you told it separately from what it has checked.
- Websites and portals. When you ask Leo to complete a task in a website, such as a licensing board, credentialing portal or CME provider, Leo uses a cloud browser to work in that site on your behalf. Your browser profile keeps cookies and signed-in sessions for those sites so a task can continue later. We keep records of the browser actions Leo takes.
- Vault items. Sensitive values are entered on a secure page, not in your messages. They are encrypted with AES-256-GCM under an application-level key, stored as a Vercel Sensitive environment variable, before they are stored, they are never placed in the AI model’s input or output, and they are decrypted only to fill in a form in a website you asked Leo to use. You can revoke a Vault item at any time.
- Public research. Leo may search the public web, for example for licensing requirements or job opportunities. The search queries it sends are based on your request.
- Opportunity matching. Leo indexes features from your professional profile to match you with relevant opportunities.
- Connected accounts. If you connect Google Calendar or Gmail, Leo receives the Google user data described in Information collected from Google below.
Some of this information is sensitive, including credentials, payment cards, government and professional identifiers, and information about your health or other people’s health. We use it only to provide the Services you request, keep them secure, and meet legal obligations. Leo is an administrative assistant, not a medical, legal, tax or financial professional, and its output is not professional advice.
Information collected from Google
Leo can connect to your Google Calendar and Gmail through Google’s OAuth consent screen. Calendar and Gmail are separate connections. Gmail starts with permission to send email only. Reading your inbox is a separate, optional permission that you choose to add later.
Which Google data we access and why
- openid and email: identify the Google account you connected. We store only a one-way hash of your Google account ID. We do not store your Google email address.
- calendar.freebusy: check your availability when you ask Leo to find or propose a time.
- calendar.events: check every calendar in your calendar list, including hidden and shared calendars, on a schedule for new and changed events; read events on your primary calendar within a limited time window; create events you approve and confirm they were created; and read an event Leo is helping you with.
- calendar.calendarlist.readonly: list your calendars, including hidden ones, so Leo knows which calendars to check for new and changed events.
- gmail.send: send emails you approve. This is the default Gmail permission.
- gmail.readonly (optional, separate opt-in): notice new messages relevant to your requests, reply in the correct email thread, confirm that an email Leo sent appears in your Sent mail, and read a message Leo is helping you with.
How we store and protect Google user data
- Google access and refresh tokens are encrypted at rest and are used only by our backend service. They are never sent to AI model providers.
- Before Google’s consent screen, Leo shows how it uses your Google data and asks you to agree. We keep a record of each agreement: the time, the version of the notice and the permissions requested.
- To notice changes, Leo checks your Calendar and, if you allowed inbox reading, Gmail on a schedule. It stores limited metadata and short summaries, such as an email’s sender, subject, labels and thread, or an event’s title and times. These feed items are kept for as long as your account is active and are deleted when your account is deleted. Disconnecting Calendar or Gmail stops new collection but does not by itself delete them.
- Full email bodies and event details are read from Google when a task needs them. We do not store a copy of your mailbox or calendar. Authentication material in email, such as one-time codes, is redacted.
- When you ask Leo to act on an email or event, the relevant details become part of your conversation with Leo and the notes Leo keeps. AI model providers process them to perform your request. Traces do not record them, as described under Information collected automatically.
Limited Use
LeoMD's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
In particular:
- We use Google user data only to provide and improve the user-facing features you request in Leo, such as checking your availability, creating events you approve, sending emails you approve and following up on your inbox.
- We do not sell Google user data.
- We do not use or transfer Google user data for advertising, including retargeting, personalized or interest-based advertising.
- We do not transfer, sell or use Google user data to determine credit-worthiness or for lending purposes.
- We transfer Google user data to others only as necessary to provide or improve the features you use, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets of Fetch Data after obtaining your explicit prior consent. Service providers that process it for us, including AI model providers, may use it only to perform your requests. We do not disclose it to AI model providers for training or any other secondary purpose.
- Our personnel do not read your Google user data unless you give us affirmative consent to view specific messages or events, it is necessary for security purposes such as investigating abuse or a bug, it is necessary to comply with applicable law, or the data has been aggregated and anonymized for internal operations.
- Google user data is not used to develop, improve or train generalized or non-personalized AI or machine learning models.
Revoking access and deleting Google user data
- Disconnect Calendar or Gmail at any time from the Connections page in your Leo account. Disconnecting deletes the stored tokens for that connection and revokes Leo’s access with Google, unless another of your Leo connections still uses the same Google account. In that case Google keeps listing Leo until you disconnect that connection too.
- Remove Leo’s access at any time at https://myaccount.google.com/permissions. When Google tells us access was revoked, we delete the stored tokens and stop using the connection.
- Disconnecting stops new access, but it does not by itself delete feed items Leo already collected, or details that became part of your conversation or Leo’s notes. To delete them, delete your account or contact us at benshaener@gofetchdata.com.
- When your account is deleted, we disconnect every Google connection, revoke Leo’s access with Google, and delete the stored tokens, authorization records and feed items with the rest of your data.
Information collected automatically
- Service records. Our systems record how Leo handles your requests, such as message delivery, scheduled reminders, the tools Leo used, browser actions and their outcomes.
- Traces of AI processing. To keep Leo reliable and investigate problems, we record a trace of each request Leo handles. If you have never connected Gmail or Google Calendar, traces can include prompts and outputs: the content sent to and returned by AI models, including your messages, plus the tools Leo used and their results. Once you connect Gmail or Google Calendar, traces of your requests record only metadata, such as timing, token counts, and model and tool names, and do not record the content of prompts, outputs, tool results or your Google data. This continues after you disconnect. Requests our backend sends to Google are not traced. Vault values are never included. Our tracing provider currently keeps trace data for 30 days, and only personnel who need it to operate, secure and debug the Services can access it.
- Log and device data. Like most websites, our hosting provider records standard request logs, such as IP address, browser type, requested page and time, which we use for security and troubleshooting. These logs are kept for up to 90 days.
We do not use third-party analytics, advertising pixels or session-recording tools on leomd.ai, and we do not collect your precise location.
Information from other sources
- Sign-in provider. Our authentication provider verifies your phone number and gives us your name, verified phone number and any verified email address.
- Messaging provider. Our iMessage messaging provider relays messages between you and Leo and tells us the phone number and conversation each message belongs to.
- Connected services. Google Calendar and Gmail, as described above, and the websites and portals Leo uses on your behalf, which may show Leo information about your applications, licenses, certifications and other records.
- Public sources. Public information Leo finds while researching your request, such as licensing requirements, credential verification results or job listings.
We are not responsible for the accuracy of information third parties provide. To remove information from a connected service, disconnect it and ask us to delete what Leo collected, as described under Your choices and rights.
Deidentified information
We may create deidentified or aggregated information, such as counts of tasks completed or how long Leo takes to respond, and use it to operate and improve the Services. We will not attempt to reidentify it, except to test that our deidentification works. We do not create deidentified information from Google user data except as the Limited Use requirements allow.
Disclosure of your information
We disclose information only as described below.
Service providers
We use the following service providers to run the Services. They may process your information only to provide their services to us.
- Vercel: hosting, serverless functions, scheduled jobs and the runtime for Leo’s agent sessions; private file storage for your documents and data exports; isolated sandboxes for malware scanning and running tasks; the AI gateway Leo uses to reach AI models; and Agent Runs tracing, which records prompts and outputs as described above.
- Anthropic and OpenAI: AI models, reached through Vercel’s AI gateway, that read the content needed for a task to understand your requests and produce responses, drafts and actions. [TODO: Ben — AI model providers’ retention and no-training terms, once confirmed in contracts]
- PlanetScale: our PostgreSQL database, which holds your account, conversation records, professional records, encrypted Vault values and encrypted Google tokens.
- Clerk: sign-in and phone verification.
- Photon: iMessage messaging between you and Leo.
- Kernel: the cloud browser Leo uses to work in websites on your behalf, including your browser profile, the proxy networks it routes traffic through, and automatic CAPTCHA solving.
- Pierre: private versioned storage for the notes Leo keeps about your work.
- Turbopuffer: the search index Leo uses to match your professional profile with opportunities.
- Parallel: public web search for Leo’s research.
Other disclosures
- At your direction. When you approve an email, a calendar invitation, an application, an attestation, a payment or another submission, we disclose the information it contains to the recipient you chose, such as a credentialing body, licensing board, employer or payer.
- Legal and safety. When we believe in good faith that disclosure is required by law, subpoena or other legal process, or is needed to protect the rights, property or safety of our users, the public or Fetch Data, or to investigate fraud, abuse or security problems.
- Business transfers. As part of a merger, acquisition, financing, reorganization, bankruptcy or sale of assets. We will notify you before your information becomes subject to a different privacy policy. Google user data is an exception: in any of these transactions, we will transfer it only as part of a merger, acquisition or sale of assets of Fetch Data, and only after obtaining your explicit prior consent, as described under Limited Use above.
- With your consent, in other cases you specifically authorize.
Third-party websites and links
The Services link to, and Leo works in, websites and services we do not control, such as licensing boards, credentialing portals, Google and Apple. Their own privacy policies govern the information they collect, including information Leo submits there on your behalf. We encourage you to read them.
Health information
Leo is built for clinicians’ professional and administrative work, not patient care. It is not intended for charting, patient messaging or patient information. Keep patient information out of your messages and uploads.
Fetch Data is not a HIPAA covered entity or business associate, and it does not sign business associate agreements. Leo is not designed to receive protected health information (PHI). Do not connect accounts, such as an email account or calendar, that contain PHI, and do not share messages, uploads or other content that contain PHI. You are responsible for making sure that what you connect and share with Leo does not contain PHI.
If a connected account or content you share contains information about patients or other people, including health information, Leo may read it when you ask it to work with a message or event. We process that content only to perform your request, and it is handled as this policy describes, including processing by AI model providers. Traces do not record content from Gmail or Google Calendar, and record other content only as described under Information collected automatically.
Data security
We use technical and organizational safeguards designed to protect your information. They include encryption in transit, encryption of Vault values with AES-256-GCM under an application-level key stored as a Vercel Sensitive environment variable, encryption of Google tokens, private file storage with malware scanning, single-use links for sensitive details, and access controls that limit which systems and personnel can reach your data. No system is completely secure, and we cannot guarantee the security of information sent over the internet.
An AI assistant that acts for you carries its own risks. Leo can misunderstand a request, produce incorrect output, or take an action you did not intend, such as submitting a form or sending a message. Content in a website or email can try to mislead Leo with instructions it should not follow. Leo is designed to check with you before attestations, payments and other consequential actions, and to treat website and email content as information, not instructions. Please review what Leo prepares before you approve it, and tell us at benshaener@gofetchdata.com if something looks wrong.
Retention
We keep your information while your account is active and as needed to provide the Services. Some periods are enforced by the Services:
- Secure Vault links expire 30 to 60 minutes after Leo sends them.
- Google connection requests expire after 10 minutes, and their records are deleted about an hour after that.
- Data exports you request are deleted after 7 days.
- Traces of AI processing are kept by our tracing provider for 30 days.
Other information is kept as follows:
- Account data, professional records, documents, Vault items and the notes Leo keeps: kept while your account is active, and deleted within 30 days after we verify your request to delete your account, as described under Deleting your account.
- Conversation and agent session history: kept while your account is active. The conversation and delivery records in our database are deleted with your account. Agent session history held by our hosting provider’s agent runtime is not yet removed when your account is deleted. It remains until the session ends and our hosting provider’s retention period for completed sessions passes.
- Gmail and Calendar feed items: kept for as long as your account is active and are deleted when your account is deleted. Disconnecting Calendar or Gmail stops new collection but does not by itself delete them.
- Google connection tokens: deleted when you disconnect that connection, when Google tells us access was revoked, or when your account is deleted. Disconnecting also revokes Leo’s access with Google, as described under Revoking access and deleting Google user data.
- Hosting and server logs: kept for up to 90 days.
- Backups: deleted information can remain in our database provider’s backups until those backups expire under its backup schedule.
We may keep information longer when the law requires it.
Your choices and rights
- In your Leo account you can pause Leo, revoke Vault items and disconnect connected accounts.
- You can ask us for a copy of your information, or to correct it, by contacting benshaener@gofetchdata.com.
- Depending on where you live, you may have additional rights under privacy law, such as rights to know, access, correct, delete or port your information, and to appeal our decision on a request. We will not discriminate against you for exercising them. We may need to verify your identity before acting on a request.
Deleting your account
To delete your account, email benshaener@gofetchdata.com from, or mentioning, the phone number on your account. Once we verify the request, we start deletion. Leo stops working for your account immediately. We disconnect each Google connection and revoke Leo’s access with Google, remove your entries from our search index, delete your uploaded files and data exports, delete the store that holds Leo’s notes, and then delete your records from our database. Those records include your conversation and delivery records, professional records, Vault items and their encrypted values, browser session records, reminders and schedules, Google feed items, and your phone registration. If a step is interrupted, an automated job resumes it within minutes.
Copies held by some service providers are handled separately: we do not yet automatically remove your sign-in account with our authentication provider, your registration with our messaging provider, your cloud browser profile and its saved cookies, or agent session history held by our hosting provider’s agent runtime. These copies may remain after your account is deleted. Agent session history remains until the session ends and our hosting provider’s retention period for completed sessions passes. Traces expire under the retention period above. Information may remain for a limited time in backups, or longer where the law requires us to keep it.
Children’s privacy
The Services are intended for adults and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.
Where information is processed
We and our service providers may process information in the United States and other countries where they operate. Those countries may have data protection laws different from those where you live.
How to contact us
For questions or requests about this Privacy Policy or your information, contact Fetch Data, LLC at benshaener@gofetchdata.com. Mailing address: [TODO: Ben — mailing address].