Privacy Policy

Last updated: November 7, 2026

Information Nabad stores

Nabad may store information that you choose to provide, including:

• Account and profile information
• Emergency contact information
• Linked profile information
• Your care circle: the email addresses you invite and the people who join
• Symptoms entered into the application
• Saved symptom-check conversations and follow-up answers
• Health assistant conversations and report explanations you choose to save
• Medications and other saved health information
• Wellbeing information that you choose to save

How symptom information is used

When you submit symptoms, the symptom description is sent over an encrypted connection to Nabad's symptom-assessment service so the application can estimate how urgently you may need care.

The symptom description and resulting urgency assessment can then be stored in your Nabad account for the selected profile, together with the follow-up conversation so you can review earlier checks.

AI in the symptom check

Nabad's own safety rules check every symptom description first. They always set the minimum urgency, and the AI can only make the result more cautious, never less.

• Unless the safety rules already found an emergency, your description and any follow-up answers you choose are sent over an encrypted connection to Google's Gemini AI service to help assess urgency.
• For a non-emergency check, the My health summary of the person the check is for is sent with it: their age, sex, pregnancy, long-term conditions, allergies, current medicines and any recent water and sleep log. It is exactly the text shown under "What Nabad's guidance takes into account" on the My health page, so you can see and change it there. Nabad's safety rules also use it, so the symptom check doesn't ask again what My health already says.
• For a non-emergency check, up to three earlier saved symptom checks for the same profile may also be sent as historical context. Past symptoms are identified as history and are not assumed to be current.
• If the safety rules find an emergency, the result is shown straight away and your description is not sent to the AI.
• Your name, email, date of birth and account details are not sent with your description. The My health summary gives an age, not a date of birth.
• Nabad does not write your description or the AI's reply to its logs. They only record that a check happened and whether the AI was used.
• If the AI is unavailable, the safety rules give the result on their own.

AI in the health assistant

The health assistant answers health questions and explains written test reports. You confirm before anything is sent.

• Your question, the recent messages in the conversation and any report you attach are sent over an encrypted connection to Google's Gemini AI service to write the answer or the report review.
• Your name, email and profile details are not sent with your question.
• Nabad saves your conversation messages, AI replies, and report findings to the selected profile for later review. Uploaded files themselves are not stored. You can delete saved conversations from the health assistant.
• Nabad does not write your messages, files or the AI's reply to its logs. Logs only record that a request happened and whether it succeeded.

Who can access your information

Health information is available through an authenticated Nabad account. Linked profiles can only be accessed by the account that owns them.

Your care circle

You can invite people you trust to your care circle. When one of your symptom checks, or a check for one of your linked profiles, comes out urgent or an emergency, Nabad tells them in the app and by email.

People in your care circle can see:

• Your name, and the name of the linked profile the check was for
• How urgent the check was (urgent or emergency) and when it happened
• Your phone number, if you saved one on your profile, so they can call you

They can never see your symptoms, your follow-up answers, the advice Nabad gave, or any other health information, and they can't open your account or your linked profiles. You can remove someone from your care circle, and anyone can leave a care circle, at any time. Invitations expire after 7 days, and Nabad never tells you whether an invited email address has a Nabad account.

Provider visit feedback and corrections

If you submit visit feedback, Nabad stores your rating, visit date and optional note with your account. Only aggregate ratings and recent waiting levels are public, without author names or account identifiers. Your note and incorrect-information reports are private to you and the directory team. Do not include patient details in these submissions.

A waiting observation contributes for two hours and needs at least three reporting accounts before a level is displayed. One current review per account and facility prevents duplicate ratings. You can update or remove your feedback and withdraw correction reports from the provider page. These contributions are included in your data download and removed when you delete your account.

Services Nabad uses

Nabad currently uses the following services:

• Vercel to host the Nabad website.
• Render to host the Nabad server.
• MongoDB Atlas to store application data.
• Brevo to send account-related emails, care circle invitations and care circle alerts.
• Google for Google sign-in when that option is used.
• OpenStreetMap map data for healthcare provider maps.
• Google Gemini AI service for the symptom check, the health assistant and report review.
• Sentry to receive error reports when something goes wrong in Nabad, so the team can fix it.

Logs and health information

Nabad is designed so that symptom descriptions and other health data are not written to application logs.

Error reports

When something breaks in Nabad, an error report is sent to Sentry so the team is alerted and can fix it. Error reports never contain personal or health information.

• A report only says what kind of error happened, where in Nabad's code and on which page, the error code, and a reference number that matches Nabad's own logs.
• It never includes your symptoms or other health information, what you typed, your name, email address, IP address, cookies or sign-in details, or the full web address of the page.
• Nabad does not record your screen or your clicks and typing for error reports.

Anonymous usage statistics

Nabad counts completed symptom assessments and follow-up requests in daily totals to understand how the service is used. These counters do not contain your account or profile ID, symptoms, urgency level, location, IP address, cookies or individual activity history. They are kept for up to 90 days and are not sent to an advertising or analytics service. A resubmitted initial check is counted as another request.

Offline emergency help

After a successful online visit, a public emergency-help page may be stored on your device for connection failures. It contains no personal or medical information. Nabad does not cache your account pages, health records or API responses automatically. You can explicitly save one emergency card in this browser for offline access. It includes the displayed identity, conditions, allergies, medications and emergency contact, plus the account email used to prevent mixing accounts. Anyone using this browser can view the copy without signing in; use a trusted device. Updates are not automatic. Remove it from the emergency card or offline help page, sign out, or clear site data to delete it. Session sign-out and account changes also clear it. Internet access is required to refresh the copy or run new symptom checks.

Account security

Nabad uses a sign-in cookie to keep you signed in. The application also signs users out after 30 minutes of inactivity to reduce the risk of someone accessing health information on an unattended device.

You should still protect your password and sign out when using a shared or public device.

Emergency information

Nabad may display your saved emergency contact and emergency phone numbers when urgent help may be needed so that you can quickly contact emergency services or someone you trust.

Your choices and deleting your data

You can update information stored in your profile and remove supported health records from within Nabad.

You can also delete your account from the profile page. Account deletion removes the account and its associated stored data, including data for linked profiles, your care circle and your place in other people's care circles.

Nabad keeps encrypted nightly backups of its database with Backblaze in the EU for up to about 35 days, so data from a deleted account can remain in those backups until they expire.

Your right to a copy of your data

You have the right to download a copy of the data Nabad stores about you. Choose "Download my data" on your profile page to get one file (in JSON format) with your account details, emergency contact, linked profiles, health records for you and each linked profile, notifications, favorite providers and your care circle.

• For your security, you confirm it's you first (with your password, or your email for Google sign-in accounts), and Nabad emails you after every download.
• The file never includes your password, sign-in security details or anyone else's health information. For care circles you belong to, it only names the person who invited you.
• Nabad only records that a download happened and the size of the file, never what was in it.

Prototype notice

Nabad is currently a student software project and prototype. This privacy notice describes how information is handled in the current project and is not a substitute for a final legal privacy policy for a production healthcare system.

Back to Dashboard