Privacy Policy

Tom Hospital ("TomHospital.com", "we", "us") operates an AI-assisted health information platform that provides AI-generated medical consultations aligned with World Health Organization (WHO) guidelines across 15+ specialties, and AI-assisted analysis of user-uploaded health reports. This Privacy Policy explains what we collect, how we use it, and the choices you have.

Account information:

your name, email address and a securely hashed password. We never store your password in readable form.

Health information you choose to share:

the symptoms and questions you type into consultation chats, and any health or lab reports (PDF, JPG, PNG, WEBP) you upload for analysis. This is sensitive personal data and we treat it accordingly.

Technical and usage data:

session cookies required for sign-in security, and transaction records for subscription billing (provider, amount, currency, status). We do not track you across other websites.

When you send a consultation message or upload a report, the content is transmitted over encrypted connections to our AI processing engine to generate your consultation or analysis. Your health data is used solely to answer you.

Zero-training pledge: your consultations, symptoms and reports are never used to train or improve any AI model — ours or any third party's.

• We never sell your personal or health data to anyone.
• We never share your health information with advertisers or data brokers.
• We never send you medical marketing based on your symptoms or reports.

Consultations and report analyses are retained so you can access your history from your dashboard. You may request deletion of your account and all associated health data at any time by writing to privacy@tomhospital.com; we complete deletion within 30 days, except records we must keep to comply with billing laws (transaction metadata only — never health content).

Sessions use secure, httpOnly cookies; passwords are stored only as salted hashes; data in transit is protected with TLS encryption. Access to production data is restricted to essential personnel bound by confidentiality obligations.

Payments are processed by our payment gateway partners (Cashfree Payments for India, PayPal for the rest of the world). We receive only the transaction status and identifiers needed to activate your subscription — your full card or wallet credentials never touch our servers.

Depending on your jurisdiction (including the EU/UK GDPR, India's DPDP Act and US state laws), you may have rights to access, correct, export or delete your personal data, and to object to or restrict certain processing. Write to privacy@tomhospital.com and we will respond within 30 days.

The platform is not intended for children under 13 (under 18 in some jurisdictions), and we do not knowingly collect their data. Parents may use the platform on a child's behalf — for example in Pediatrics consultations — but the account holder is the adult.

We will post any changes to this policy on this page with a new "Last updated" date. For privacy questions or deletion requests: privacy@tomhospital.com.