The Platform is intended only for users who are at least eighteen (18) years of age. We do not knowingly collect data from anyone under 18. If we learn that an account has been created by a person under 18, we will terminate the account and delete the associated data. By using MelMat, you represent and warrant that you are 18 or older.

• Email address (used for magic link authentication and communication)
• Name and organization (provided during onboarding)
• Subscription tier and billing information (processed by Stripe — MelMat does not store payment card data)

• Research queries submitted to the platform
• Focus area selections, query timestamps, and session tokens
• Number of queries used and remaining cap
• AI Output results returned to your session
• M² Chat and Dig Deeper conversation messages (stored solely to provide your chat history; never used for AI model training — see Section 4)
• IP address and device fingerprint at time of TOS acceptance

• Aggregated, anonymized platform usage metrics (e.g., query volume, feature usage patterns)
• Error logs and system performance data

This Privacy Policy applies equally to the MelMat web platform and the MelMat mobile application for iOS and Android. When you use the mobile app, the following additional handling applies:

• Your authentication session token is stored locally in your device's secure storage (Apple Keychain on iOS, Android Keystore on Android) so that you remain signed in. This token does not leave your device except when transmitted over an encrypted connection to authenticate your requests, and it is cleared from your device when you sign out.
• The mobile app does not access your contacts, photos, location, microphone, or camera.
• We do not use advertising identifiers (such as Apple's IDFA) and we do not track you across other companies' apps or websites.

MelMat may use de-identified, anonymized synthesis outputs from completed research briefs — stripped of all query content, uploaded documents, identifiers, and personally identifiable information — to train and improve MelMat's proprietary synthesis engine. This permitted use applies only to research brief outputs. It does not apply to your queries, your source documents, or any chat content.

Your M² Chat conversations and Dig Deeper conversations are never used to train any machine learning model, large language model, or AI system, by us or by any third-party provider. Chat content is processed solely to generate your responses and is stored solely to provide your chat history feature. Chat content is deleted upon your deletion of the chat or upon account termination.

To deliver multi-engine synthesis, MelMat routes your queries to multiple third-party AI providers, which may include Anthropic, OpenAI, Google (via Vertex AI), Perplexity, Mistral, Fireworks AI, Together.ai, and xAI. None of these providers use Customer Data to train their AI models on the API tiers used by MelMat. Each provider may briefly retain inputs and outputs (typically up to thirty (30) days) for abuse monitoring under their own service terms.

Aggregated, de-identified Derived Data — such as anonymized query volume statistics, latency metrics, and feature-usage counts — is not subject to the restrictions above and may be used for platform improvement and operational reporting purposes only. Derived Data does not include your query content, brief content, or chat content.

The Platform is not HIPAA-compliant. Company has not executed Business Associate Agreements (BAAs) with the third-party AI providers that process queries (which may include Anthropic, OpenAI, Google, Perplexity, Mistral, Fireworks AI, Together.ai, and xAI). The Platform is not designed for, configured for, or eligible for use as a HIPAA-covered platform. The Platform's data processing routes queries through multiple third-party AI providers operating in non-HIPAA-compliant infrastructure, with retention practices governed by each provider's service terms rather than HIPAA's privacy and security rules. Users in HIPAA-regulated roles (covered entities, business associates, and their workforce members) must not submit Protected Health Information (PHI) to the Platform under any circumstance.

For purposes of this Privacy Policy and Section 11 of the AUP, Protected Health Information (PHI) means individually identifiable health information as defined under 45 C.F.R. § 160.103, including any information that: (a) relates to the past, present, or future physical or mental health or condition of an individual; (b) relates to the provision of healthcare to an individual; or (c) relates to the past, present, or future payment for healthcare. PHI includes the eighteen identifier categories enumerated in 45 C.F.R. § 164.514(b)(2)(i): names; geographic subdivisions smaller than a state; dates (other than year) directly related to an individual, including birth date, admission date, discharge date, and date of death; ages over 89; telephone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate/license numbers; vehicle identifiers; device identifiers; web URLs; IP addresses; biometric identifiers; full-face photographs; and any other unique identifying number, characteristic, or code.

Submission of any of the foregoing — alone or in combination — constitutes a prohibited submission under Section 8 of this Privacy Policy and Section 11 of the AUP.

Selection of the Clinical Research Focus does not change the data-handling practices that apply to your query. Clinical queries are routed to the same third-party AI providers, retained under the same retention practices, processed with the same security controls, and stored with the same architecture as queries in any other focus mode. Selecting "Clinical Research" does not invoke any enhanced privacy protection, additional encryption, restricted routing, HIPAA-compliant processing pathway, or special data-handling regime. If you require HIPAA-compliant processing for a query, the Platform is not the appropriate tool and you must use a HIPAA-compliant service instead.

Clinical queries are processed by the same third-party AI providers identified in Section 5 of this Privacy Policy and disclosed in the First-Login Acceptance Screen. Each such provider operates under its own service terms, retention practices, and abuse-monitoring practices. None of these providers use Platform queries to train their AI models, but providers may briefly retain inputs and outputs (typically up to 30 days) for abuse monitoring under their own terms. None of these providers has executed a Business Associate Agreement with Company. None of these providers is HIPAA-compliant for purposes of receiving PHI. By submitting a clinical query, you acknowledge and accept that your query will be transmitted to, processed by, and briefly retained by these third-party providers.

You bear sole responsibility for ensuring that every clinical query submitted to the Platform is de-identified to the safe-harbor standard under 45 C.F.R. § 164.514(b)(2), or, where applicable, has been subject to expert determination under 45 C.F.R. § 164.514(b)(1). Company does not screen, de-identify, anonymize, or otherwise modify your submissions. Your submission of identifiable content — whether intentional, accidental, or arising from inadequate de-identification — is your responsibility and may constitute a privacy breach under the laws governing your practice, including HIPAA's Breach Notification Rule (45 C.F.R. §§ 164.400–414) where applicable.

For users subject to the EU General Data Protection Regulation, UK GDPR, or any other data-protection regime that designates "special categories of personal data" (including health data, mental-health data, or data concerning the health of an identifiable person), the Platform is not configured for processing of such special-category data. You must not submit special-category data to the Platform. Where applicable law requires explicit consent, a documented lawful basis, or specific safeguards for special-category data processing, the Platform's data-processing practices do not satisfy those requirements.

If you have submitted, or become aware that you may have submitted, PHI or other prohibited clinical content to the Platform in violation of Section 8 of this Privacy Policy and Section 11 of the AUP, you must notify Company immediately at [email protected] with the subject line "CLINICAL CONTENT INCIDENT." Upon receipt of such notice, Company will: (a) attempt, on a reasonable-efforts basis, to identify and purge the submission from Company's systems; (b) coordinate with relevant third-party AI providers regarding their retention of the submission, recognizing that Company cannot guarantee deletion from third-party systems; (c) provide you with available logs and records to assist with any breach-notification obligation you may have under HIPAA's Breach Notification Rule, state privacy law, or your licensing body's rules; and (d) cooperate with your independent counsel as reasonably required. Such cooperation does not constitute admission by Company that any breach has occurred and does not modify the allocation of responsibility set forth in the Terms of Service or the AUP.

If your clinical practice triggers a mandatory reporting obligation (including reports of suspected child abuse, elder abuse, dependent-adult abuse, or threats to identifiable third parties), the Platform is not the appropriate venue for compiling, storing, or generating the content of such a report. Submission of mandatory-reporting content to the Platform may result in the content being transmitted to and briefly retained by third-party AI providers in non-confidential, non-privileged form, with attendant exposure to subpoena, discovery, and other legal process. Use a confidential and appropriate-purpose system for mandatory-reporting workflows.

Company may, at its sole discretion and without obligation, develop in the future a HIPAA-compliant tier of the Platform that would involve executed Business Associate Agreements with appropriate third-party providers, audited data-handling practices, and additional safeguards. References to such future capabilities, whether in marketing materials, sales conversations, or otherwise, do not modify the current scope of this Privacy Policy, do not create any present right to submit PHI to the Platform, and do not constitute a representation or warranty that such future capabilities will be developed, released, or made available on any specific timeline.