Privacy Policy
This policy explains what MedHall does and does not collect.
What MedHall Collects
MedHall does not require accounts and does not intentionally request or maintain names, phone numbers, addresses, institutional information, or similar profile information for normal use. It does not run its own analytics, tracking pixels, session replay, or fingerprinting, and it does not store your prompts, uploaded files, generated answers, or API keys on its servers. See the Cookies section below.
Aggregate Traffic Metrics
MedHall itself runs no analytics, no tracking pixels, no session replay and no fingerprinting, and it sets no cookies. The only measurement on the site is the anonymous, cookieless aggregate traffic count provided by our hosting provider (Cloudflare Web Analytics): it does not set cookies, does not fingerprint you, does not follow you across other websites, and cannot identify you as a person. It is used only to know roughly how many people visit and which pages are read most. You can block it with any content blocker and the site keeps working exactly the same.
What MedHall Does Not Collect
No accounts, no profiles, no databases, no user profiling, no tracking, and no payment information.
API Keys
Your API key is used only in your browser (USER → BROWSER → PROVIDER). After you connect, the key is saved ONLY in this browser's localStorage on your own device so it is restored on your next visit; your AI provider key is never sent to any MedHall server or API, never written to cookies, databases, logs, or build artifacts, and it is removed from storage the moment you press Disconnect (or clear your browser data). MedHall has no server-side AI inference: your browser connects directly to the AI provider using your key. The Cloudflare Account ID and API Token used by the image relay are separate credentials, described in the Free Engine & AI Image Data Policy, and are relayed through the site's own relay endpoint on each run. Because the key lives on your device, anyone with access to your browser can read it — it is not a server-side secret.
Prompts and Files
The material you enter, including prompts, notes, and uploaded study files, is processed directly by the AI provider you choose from your browser. It is not sent to or stored by MedHall. MedHall has no AI processing servers and no database for user content.
Hosting and Deployment Data
The site is hosted on Cloudflare Pages. Like every other web host, Cloudflare may process standard technical data, such as IP addresses, request times, and status codes, in its own logs. MedHall has no access to personal information beyond what the hosting platform records. See Cloudflare's official Privacy Policy for details: https://www.cloudflare.com/privacypolicy/.
Third-Party Provider Processing
When you connect your own key, your material is sent to the AI provider you choose and is processed under that provider's policies, including its data retention and security practices. Review the provider's privacy policy before use.
Retention and Deletion
MedHall does not intentionally retain user content or API keys on any server. The key is saved only in your browser's localStorage on your device; Disconnect removes it from storage and from the active browser state. For content sent to third-party providers, their own retention policies apply.
Security Practices
MedHall minimizes data collection, keeps your key only in your browser's localStorage on your device (removed on Disconnect), uses security headers and HTTPS, and follows a data-minimization design. No system is completely secure, so you should protect your provider credentials carefully.
Your Rights
Because MedHall does not collect personal information, there is little to access or delete. You can remove your API key from the tool at any time. For data held by a provider, contact that provider directly.
Contact and Policy Changes
For privacy or legal questions, contact: medhallofficial@gmail.com. If this policy changes, the updated version will be published on this page.
Uploaded Study Files and Images
When you upload a file or image (for example to generate questions from your study material), the file is read entirely inside your browser and is sent only to the AI provider using YOUR own API key. MedHall does not receive, store, copy, log, or share your uploads: it has no servers or databases for user content. Storage on your device: the document tool keeps your upload in your browser's on-device IndexedDB so your session can be restored after a refresh; it is wiped automatically after 12 hours without opening the tool, or immediately when you press Disconnect. Other tools keep uploads in transient browser memory only, flushed when you leave or close the page.
Voice and Microphone Data
The microphone is used only while you are actively using a voice feature on the page. Audio is captured in your browser and is either transcribed by your browser's own speech services or sent to the AI provider using YOUR own API key. MedHall does not receive, store, or log any audio recording, transcript, or voice data. Recordings and transcripts exist only in the active page session and are discarded when you stop, refresh, close, or leave the tool. The microphone never runs in the background and is automatically released the moment you leave the tool.
Voice Output (Read-Aloud)
Replies may be read aloud. The spoken audio is generated either by your browser's local text-to-speech (no internet transmission) or by the AI provider using your own key, and it is played on your device only. MedHall does not store or log generated audio.
Cookies
MedHall itself does not set cookies. The API key and tool data described in this policy are stored in browser storage (localStorage and IndexedDB on your device), which is different from cookies. You can control or delete cookies through your browser settings.
Browser Storage on Your Device
Everything MedHall saves is stored in YOUR browser on YOUR device: (1) your API key in localStorage (see the API Key Security page), (2) the document tool's current upload and session in IndexedDB for up to 12 hours for refresh-restore, and (3) a small on-device cache of repeated identical educational AI responses (localStorage, with a size cap and time-to-live) to reduce provider calls. All of these are cleared by Disconnect, and none of them are sent to MedHall.
Data Retention
MedHall-controlled data: MedHall does not intentionally retain user content or API keys on any server. On your device: the API key remains in localStorage until you disconnect or clear browser storage; the document tool's IndexedDB session is wiped after 12 hours without opening the tool or on Disconnect; the on-device AI response cache is removed on Disconnect or expires by its time-to-live. Third-party provider data: content you send to an AI provider is retained and processed under that provider's own retention policies, which MedHall does not control. Hosting infrastructure (Cloudflare) may retain standard technical logs under its own policies.
User Rights
Because MedHall does not intentionally hold your content or personal information on its servers, there is little for you to access, correct, or delete here. You can remove your API key at any time with Disconnect, and you can clear the on-device document session and AI cache with Disconnect or by clearing your browser storage. For data held by an AI provider or by hosting infrastructure, contact that provider directly — MedHall cannot delete provider-held data. For any privacy inquiry or complaint, contact the legal email below; we will respond as required by applicable law.
Age and Children
MedHall is intended for students — including medical and healthcare learners — and is not directed to children. The service does not require accounts and does not knowingly collect personal information from children. If you are below the applicable minimum age in your jurisdiction, you should not submit your own API credentials or any personal information, and you may use the service only with the involvement and consent of a parent or guardian where required by applicable law. If you believe a child has submitted personal information, contact the legal email below.
Governing Law
MedHall is operated as an independent project. Unless otherwise required by mandatory law that applies to you, these terms and this policy are governed by the laws of the Arab Republic of Egypt. This clause does not override any mandatory consumer or privacy protections that apply to you in your own jurisdiction, and nothing here limits rights that cannot be legally limited.
What Is Stored on Your Device
MedHall has no server that holds user content, so nothing of yours is relayed through one. What does persist sits on your own device: a tool may remember its last working session (the text you typed, the options you chose and the result it produced) in your browser's localStorage so a reload does not lose your work, and a local daily request counter is stored to protect against accidental overuse. That state is removed when you clear it inside the tool or clear your browser's data for this site, and none of it is transmitted to MedHall.
Complete Inventory of Browser Storage on Your Device
Everything MedHall saves lives in YOUR browser on YOUR device, and none of it is sent to MedHall. The complete inventory: (1) medhall-api-key (localStorage) — your AI provider key, kept until you press Disconnect; if you connect an alternative provider key instead, it is kept under medhall-or-key; (2) medhall_gemini_age_confirmed_v1 (localStorage) — one boolean recording that you confirmed the 18+ requirement for the Gemini features; it carries nothing else, is never sent anywhere, and disappears only when you clear this browser's storage; (3) medhall-lang (localStorage) — your language preference; (4) medhall-telegram-ok, medhall-new-tools-ok, medhall-instagram-ok and medhall-instagram-seen (localStorage) — timestamps/flags that keep the notice boxes dismissed while their cooldown lasts; and, while an announcement campaign is running, medhall_core_team_campaign_v… (localStorage) — how many times this device has seen that one campaign; (5) medhall-ai-cache-v2:* (localStorage) — the small on-device cache of identical AI responses (capped size and time-to-live); (6) per-tool progress drafts kept on your device so a tool can be resumed (localStorage, each under its own medhall-… key) — for example medpatient-session-v2, medhall-adaptive-v1 (MedRecall adaptive session), medhall-mini-osce-draft-v1, medhall:medmnemonic:v1, medhall_medtale_profile and medhall_medtale_history, medhall-pi-prefs, medhall_current_file_meta_v1, medhall-progress-calib-v1, medhall-model-good-v1 / medhall-model-health-v1, medhall-model-options-v1 and medhall-grounding-off; these hold study state only — never your file contents — and are removed when you clear your browser storage; (7) medhall:brain:gate:v1 (localStorage) — the Brain onboarding gate flag; (8) medhall-usage-v1 (localStorage) — the daily usage counter; (9) medhall-dev-bypass (sessionStorage) — a developer bypass flag set only when the page URL contains ?dev=...; (10) the IndexedDB database medhall-pi used by the Page Intelligence tool to restore your current document after a refresh, wiped automatically after 12 hours without opening the tool or immediately on Disconnect.
Your Opt-Out and Clearing Options
You may stop using the Service at any time with no consequence. To delete everything MedHall-related from your device: press Disconnect in any tool (this removes the API key and tool sessions), then clear your browser data (localStorage, IndexedDB, and sessionStorage), and delete any cookies set by third parties through your browser settings. No MedHall-side deletion is needed, because MedHall holds no user content on any server.
Do Not Track
MedHall does not track users and therefore does not change its behavior based on browser Do-Not-Track signals: there is nothing to track, profile, or share. The privacy statements in this policy apply regardless of your browser's tracking preferences.
International Data Flows
Because MedHall has no servers for user content, the prompts, files and audio you submit are sent from your browser directly to the AI provider you choose; those transfers may cross national borders and are governed by the provider's terms and privacy policy. Standard hosting logs (Cloudflare Pages) and the site's two relay endpoints, which forward lecture captions and images and perform no AI inference, are processed in those providers' own infrastructure under their policies. MedHall does not initiate or control any cross-border transfer of your content beyond what is described in this policy.
Instagram:@medhallofficialTelegram:t.me/medhalll