ScrubChat Privacy Policy

Version: privacy-2026-08-01

Effective: 1 August 2026

Applies to: everyone who uses ScrubChat

This is a template, not legal advice. It is written to be accurate to what

the code in this repository actually does, and to align with the Digital

Personal Data Protection Act 2023 (India) and the UK/EU GDPR. Before you

operate this platform commercially, have a qualified lawyer in your

jurisdiction review it and adapt it. Placeholders in [SQUARE BRACKETS] must

be filled in.

1. The short version

• We collect the minimum we need to run a social platform safely.
• We do not sell your data. We do not run ads. We never will under this policy.
• We never store your date of birth, your raw IP address, or your password.
• Your posts are scanned for patient identifiers before they publish. That is the

entire point of this platform.

• Direct messages are scanned too, but only for patient data and illegal

content — never for rudeness. Section 6 explains exactly what that means.

• You can download everything we hold, or delete all of it, from Settings. Both

work immediately, without emailing anyone.

If any part of this document contradicts that summary, the detailed section wins

and we have made a drafting error. Please tell us.

2. Who we are

Data Fiduciary / Controller: [LEGAL ENTITY NAME], [REGISTERED ADDRESS]

Data Protection Officer: dpo@scrubchat.app

Grievance Officer (DPDP Act s.13): grievance@scrubchat.app

Response commitment: 30 days, and usually far sooner.

3. Who may use ScrubChat

ScrubChat is for people aged 18 and over who are medical students, interns,

residents, doctors or allied health professionals.

We do not knowingly permit accounts for anyone under 18. This is not a

convenience choice: the platform hosts clinical images, discussion of death and

gore, and frank talk about burnout and mental health. It is not an appropriate

environment for a minor, and processing a minor's data at this sensitivity level

under the DPDP Act would require verifiable parental consent that we are not

equipped to obtain.

If we learn that an account belongs to someone under 18, we close it and delete

the data.

4. What we collect, and why

4.1 You give us this directly

We do not store your date of birth. We ask for the year, derive an "is 18 or

over" flag, and keep the year only. A full DOB is one of the strongest

re-identification keys that exists and we have no use for it.

4.2 We generate this about you

4.3 We collect this automatically

4.4 We do NOT collect

• Your precise location. We never request it and the app has no code to.
• Contacts, calendar or device identifiers.
• Advertising or cross-site tracking identifiers. There are no third-party

trackers, pixels or advertising SDKs in this codebase.

• Any special-category health data about you — your specialty is a

professional interest, not a health record.

5. Patient data — the rule that matters most

You must never post identifiable patient information to ScrubChat.

This is a Community Guidelines rule, a Terms of Service term, and a technical

control all at once. Our systems actively scan for and block:

• Names, initials in combination with other identifiers
• Hospital, record, UHID, IP/OP, admission, lab or accession numbers
• Government IDs (Aadhaar, PAN, SSN, NHS number), insurance and scheme numbers
• Dates of birth, admission, discharge or procedure
• Phone numbers, email addresses, postal addresses, postcodes
• Device and implant serial numbers
• Face photographs and other biometric identifiers
• Image metadata, including GPS coordinates — stripped before upload completes

Where ScrubChat sits legally. We are not a healthcare provider and we are not

a HIPAA-covered entity or business associate. We do not process patient data on

any hospital's behalf. If you post patient data here, you have disclosed it — we

have not. Our design goal is to make that as hard as possible to do by accident,

and we treat any such disclosure as a serious violation regardless of intent.

Our controls are strong but not perfect. They do not transfer your professional

and legal obligations to us.

6. Automated moderation — exactly what happens

You have a right to know how automated decisions about you are made

(GDPR Art. 15(1)(h) and Art. 22; DPDP Act s.11). Here it is in full.

6.1 What is scanned

On direct messages specifically. We scan them. We are telling you plainly

rather than burying it, because a moderation behaviour you do not know about is a

betrayal whatever it catches. Two limits apply:

• Only the categories listed above act. An argument between two people who chose

to talk to each other is not our business.

• When we detect an identifier, we redact it and deliver the message rather

than blocking it. The conversation continues; the leak does not.

We do not read your messages. No human sees a message unless it is reported, or

unless an automated hard-block is appealed.

6.2 How a decision is made

• Normalisation. Text is canonicalised to defeat evasion (homoglyphs,

zero-width characters, leetspeak, separator injection).

• Rules. Deterministic detectors for patient data, abuse, hate speech,

illegal activity, misinformation, spam and self-harm.

• Model adjudication. Grey-zone content only, and the text sent has already

had identifiers removed. The model can *clear* content freely; it can escalate

only as far as "hold for a human", never straight to removal.

• Scoring. Signals are combined; severity dominates and volume aggravates.
• Action. One of: allow, label, blur, limit reach, hold for review, block.

6.3 What the automated system may and may not do

It may: remove content, reduce its reach, hold it for review, apply a strike,

suspend an account temporarily.

It may never: permanently ban an account. That requires a human moderator,

and the rule is enforced in code, not by convention.

6.4 Content about your own distress is never actioned

If you post that you are struggling, suicidal, or want to hurt yourself, our

system publishes your post normally, records nothing against your account, and

attaches crisis support information. We do not remove it, hide it, limit it or

count it against you.

We do act on content that *encourages* another person to self-harm, or that

shares specific method detail — because that causes measurable harm to others.

6.5 Your rights over automated decisions

• See the reason. Settings → Moderation history shows every decision and the

exact rules that fired.

• Appeal it. Every automated action is appealable and **a human decides every

appeal.** The automated system never reviews its own work.

• Get it reversed. If an appeal succeeds, the strike is removed and the trust

penalty refunded — not merely stopped from counting.

6a. Personas — pseudonymous, not anonymous

If you post under a persona, this is the whole of the promise. Nothing is

buried, and the word "anonymous" does not appear because it would not be true.

What a persona does

• Other members never see your account, handle, college, year or specialty on a

persona post. The server does not send those fields — they are absent from

the payload, not hidden by the app.

• Persona posts do not appear on your profile, and are not selected into your

followers' timelines. Both would link the persona to you in one step.

• Persona posts are excluded from your public post count. A count that ticks up

with no visible post is a timing correlation.

• Only a coarse "verified medic / verified student / unverified" badge is shown.

The exact tier is withheld: a pseudonymous *faculty* member posting about one

department narrows to a handful of people.

• The persona's avatar is seeded randomly, never derived from your account, so

it is not a fingerprint across personas.

• Its creation date is shown to the month, not the second.

What a persona does not do

• ScrubChat knows. Persona.userId is not nullable and never will be. A

moderator reviewing a report about your post sees your real account — and

that view writes an audit event naming the moderator, so "who looked, and

when" is a question with an answer.

• Strikes land on you, not on the persona. Retiring it clears nothing.
• A valid legal order reaches your real account. Under India's IT Rules 2021

we are an intermediary; "we do not know who posted it" is not a defence, it is

an admission that we built an untraceable system. We did not.

• Blocking is a confirmation oracle. If you block someone you suspect, their

persona's posts disappear from your feed — which confirms a guess. We keep it

that way because a block that silently failed to block would be worse, and

because it only helps someone who already had a suspect.

• Your writing style is not disguised. We do not rewrite what you say.

Someone who reads your identified posts can often recognise your pseudonymous

ones.

• The content is usually the leak. "My HOD in pathology keeps making me redo

slides" is unidentifiable in Delhi and completely obvious to the twelve people

in that department. We warn you about this as you type — see the deanon

detector in docs/MODERATION_POLICY.md — but the warning is a net, not a

seal.

• Case discussions and direct messages are always under your real account.

In a clinical thread the reader is entitled to know whether the person

recommending a dose is a verified consultant; in a DM, one-sided pseudonymity

is the exact asymmetry harassment needs.

Personas unlock three days after you join and are paused while you have an

active strike. Both exist because the throwaway account created to harass

someone under cover is always used the same day it is made.

7. Who we share data with

We share personal data with no one for marketing purposes, ever.

We publish a transparency report at /transparency showing action volumes,

appeal counts and — most importantly — the appeal overturn rate.

8. How long we keep things

What survives a full deletion, and why. Moderation case records survive with

the link to you removed. This lets us report "we removed N pieces of content for

patient-data violations" without being able to say whose they were. We consider

this the minimum necessary for platform safety and legal defence, and we are

telling you about it rather than hiding it in a definition.

9. Your rights

Under the DPDP Act 2023 (ss. 11–13) and GDPR (Arts. 15–22) you may:

We never charge for these and we never make you jump through hoops.

10. Security

• Passwords: Argon2id, OWASP 2024 parameters. We cannot read them.
• Transport: TLS everywhere; HSTS with preload in production.
• Sessions: short-lived access tokens, rotating refresh tokens with **reuse

detection** — a stolen token invalidates the whole session family.

• Identity documents: AES-256-GCM encrypted; searchable only via HMAC blind

index, so no plaintext registration-number column exists.

• Logs: aggressive central redaction of tokens, passwords and identifiers.
• Media: EXIF and GPS stripped before storage. Uploads that fail this are refused.
• Access: role-based, with an append-only audit trail on every privileged action.

Breach notification. If a breach is likely to affect you, we will tell you and

the Data Protection Board without undue delay, and within 72 hours where the GDPR

requires it. We will tell you what happened, what we know, and what to do — not

a euphemism about "an incident".

11. International transfers

Data may be processed outside your country. Where it is, we rely on Standard

Contractual Clauses or an adequacy decision. Contact the DPO for the current

processor list.

12. Cookies

We use exactly three, all strictly necessary:

No analytics cookies, no advertising cookies, no third-party cookies. There is no

consent banner because there is nothing to consent to.

13. Changes

We will tell you in-app before any material change takes effect, and the consent

ledger records which version you agreed to. Continued use after a change means

you accept it; if you do not, you can export and close your account at any time.

*Last reviewed: 1 August 2026*