AI and Your Data
How TellDoug uses AI — and how you stay in control
Last updated: January 2026 · Draft — pending legal review
What turning AI on means
When you explicitly enable AI processing in your Settings, TellDoug is allowed to read your uploaded documents—such as vaccination cards, lab results, and invoices—to propose structured fields including dates, amounts, and medical details.
Documents are processed by Anthropic's AI (Claude) only when AI consent is on. Anthropic is a US-based sub-processor. Nothing is sent without your explicit opt-in. Nothing enters your permanent record until you review, optionally edit, and actively confirm the proposal.
What we store
Every AI action is transparently recorded in a secure ledger tied to your account. This ledger includes:
- A summary of what text or image was sent
- What the AI proposed in return
- The specific, pinned model version used
- Exact token usage for cost auditing
- The AI's confidence level
- What modifications you made before confirming
Abandoned proposals are permanently recorded as rejected. This complete ledger is part of your core data and is included in your full account exports.
What AI does NOT do
- AI never writes to your record directly: It proposes; you confirm.
- AI never makes flag decisions in cost audits: Those are calculated by strictly deterministic mathematical and regulatory rules.
- AI never invents clinical information: Proposals are heavily clamped to fixed vocabularies and known taxonomy lists.
- The AI model is never set to "latest": We pin the model to a specific, tested version for predictable, reproducible behaviour.
Turning it off
You can revoke consent at any time by navigating to Settings → AI Processing and switching it off. This creates a permanent, timestamped consent revocation record.
From that exact moment, absolutely no documents are sent to Anthropic. Everything continues to work—you simply fill in the fields manually. Your health record, deterministic cost audits, and ledger features remain fully operational regardless of your AI settings.
Your data stays yours
You can export everything at any time as a structured JSON archive. You can also delete everything at any time, performing a full, irreversible erasure of your records and files. Both actions are fundamental rights within the application and are never gated by payment or subscription tier. Your AI consent records and ledger are always included in exports.
Sub-processor
Our sub-processor for AI operations is Anthropic Inc., located in San Francisco, CA, USA. Data transfers are protected by appropriate international transfer safeguards, including Standard Contractual Clauses. Crucially, Anthropic's enterprise data policy guarantees that they do not use user inputs submitted via their API to train their foundational models.