BioMind Cabinet — Privacy Policy

BioMind Cabinet
Privacy Policy

BioMind Cabinet Privacy Policy Operated by: Mariam Ohanyan, operating as BioMind AI Academy, 1136 N Columbus Ave, Apt 102, Glendale, CA 91202, USA Contact for privacy questions and rights requests: biomedmariam@gmail.com Effective date: October 23, 2026

1. What BioMind Cabinet is

BioMind Cabinet ("Cabinet," "we," "us") is a private place where you — an adult account holder (18 or older) — store your own medical documents and, if you choose, documents for your children in guardian-managed profiles. Documents live in ten "drawers": 🧪 Lab Reports · 🩺 Ultrasound · 🩻 X-Ray · 🖥️ CT Scan · 🧲 MRI · 💊 Prescriptions & Medicines · 📋 Doctor's Notes & Discharge Papers · 💉 Vaccinations · ❤️ Heart · 📁 Other.

Inside your cabinet, an AI assistant called Nurse Mari can explain a stored document in plain language, in English, Russian, Armenian, or Spanish. Nurse Mari is an artificial-intelligence program, not a human being, not a nurse, and not a doctor. Section 8 explains exactly what the explanations are — and what they are never allowed to be.

This Policy describes what information we collect, why, what we will never do with it, the consents we will ask for, and the rights you can exercise at any time.

2. The short version

Your cabinet is yours alone. No other user can ever see it.
We never sell your information. We never share it for advertising. Ever.
Your documents are never used to train artificial intelligence.
You can download everything, and delete everything, at any time.
Explanations are education only. They are never a diagnosis.
If something goes wrong — a breach — we will tell you, on the fastest clock the law gives us (Section 13).

3. Our promises — the red lines, stated as commitments

These are the founder's founding rules for the Cabinet. They are promises, not aspirations, and the product is built to keep them:

A fully isolated room for every person. Your cabinet, and each child's profile, is completely separate. No person can ever access another person's documents or conversations — not another user, not a sibling, not anyone.
No distribution — ever. We will never distribute, publish, or disclose your documents, your charts, or your identity, to anyone, except (a) to the service providers listed in Section 6 who process data on our behalf under contract, and (b) when you explicitly ask us to share something, with your consent recorded (Section 5).
You hold the keys. You can download everything in your cabinet, and delete everything in your cabinet, at any time, yourself, from inside the app — no phone call, no permission needed from us.
Sharing happens only by your hand. Any sharing beyond the providers in Section 6 happens only with your explicit consent, given for that sharing, and recorded so you can see it and revoke it.
No sale of health information. We do not sell your personal or health information, and we do not share it for advertising or marketing cross-context behavioral advertising — under any consent. (Some laws would let us ask for a signed authorization to sell health data. We decline: there is nothing to authorize, because we do not sell it.)
No training. Your documents, and anything derived from them, are never used to train, fine-tune, or improve any artificial-intelligence model.

4. Information we collect, and why

We collect only what the Cabinet needs to work:

Category	Examples	Purpose
Account information	Name, email address, language choice, password credentials held by our hosted identity provider	Create and secure your account; operate the service in your language
Documents you store	Photos/scans and text of lab reports, ultrasound and imaging reports, prescriptions, discharge papers, vaccination records, and other papers you choose to upload, in the ten drawers	Store, organize, display, and — only when you tap "Explain this to me" — explain the document to you
Explanation data	The explanation generated from a document you asked about, and its sources	Show you the explanation; keep it in your cabinet with the document
Children's profile information	Child's name, date of birth, and documents you upload to that child's profile	Operate the guardian-managed profile you created (Section 9)
Payment information	Subscription or lifetime-purchase status; card data is handled by our payment processor and never stored on our servers	Charge only what you agreed to (Section 15)
Technical information	Device/app version, security and access logs, error records that do not contain document content	Keep the service secure, detect unauthorized access, fix failures
Support communications	Messages you send us	Answer you

Sources: everything above comes from you, from your device as you use the service, or from a health care provider only if you direct that provider in writing to send your records to the Cabinet under your legal right of access. We do not buy data, scrape data, or receive your information from data brokers.

Health information is sensitive. Lab values, imaging reports, prescriptions, and the explanations derived from them can identify your past, present, or future health status. We treat all of it as sensitive health information under the strictest rules that apply to us (Sections 5, 10, 14), including California's Confidentiality of Medical Information Act (CMIA) and the consumer-health-data laws of Washington, Nevada, and Connecticut.

5. Consents — what we ask, separately, before we act

We do not bundle consent into general terms. We ask, separately:

Collection consent. By creating an account and uploading a document, you consent to our collecting and storing that document to provide the Cabinet you requested. For uses beyond what the service you requested requires, we will ask for a separate, clear, opt-in consent first.
Explanation consent. A document is sent for explanation only when you tap "Explain this to me" for that document. Explaining uses the processors named in Section 6.
Sharing consent. Before we share any of your information with anyone beyond the Section 6 processors, we will obtain your explicit consent for that specific sharing, and record it. For residents of California, a disclosure of medical information will be made only under a written authorization meeting CMIA's requirements, unless a CMIA exception applies.
Separate consent for children. Before a child's document is disclosed to a third-party processor (for example, for text recognition or explanation), the verifiable parental consent described in Section 9 must specifically cover it.
Withdrawal. You may withdraw any consent at any time, as easily as you gave it, from inside the app or by contacting us. Withdrawal stops future use under that consent; it does not undo processing already lawfully done, and we will delete data you ask us to delete (Section 10).

No conditioning. We will never refuse you the Cabinet because you declined an optional consent. Consents that a law requires to be signed authorizations (such as a sale of health data) are not used: we do not sell health data (Section 3.5).

6. Who receives your information — processors, named by type

We disclose your information only to companies that process it for us, under written contracts that require them to: use it only to provide their service to the Cabinet; keep it confidential; retain it no longer than needed to process your request (our standard is no retention of document content); never use it to train their models; protect it with reasonable security; and tell us without unreasonable delay — and in all cases within 60 days — if it is breached, identifying each affected person.

Processor type	What it receives	Why
Hosted identity provider	Account credentials, email	Secure sign-in (we never run our own password system)
Cloud hosting & database	Your encrypted documents and account data	Storage and operation of the Cabinet
Text recognition (OCR)	The document image/text only when you upload or request an explanation	Read the document's text
AI explanation provider	The document's text only when you tap "Explain this to me"	Draft the explanation (Section 8)
Payment processor (Stripe)	Payment details, purchase status	Process the subscription or lifetime payment (Section 15)
Email delivery provider	Your email address, message content of notices	Send receipts, reminders, and notices you are owed

Providers at launch (October 2026). Sign-in: Google (United States). Cloud hosting, database, and document storage: Supabase (United States, East US region). Website hosting: Cloudflare (United States). The OCR, AI-explanation, payment, and email rows above describe services that are not yet active at launch — no document upload or explanation processing is live yet, and no Cabinet payment is being collected; before any of them is activated, this Policy will be updated to name the provider and its processing country.

Legal disclosures. We may disclose information if the law compels it (court order, subpoena, or a statute that requires it), and we will tell you unless the law forbids telling you. We will never voluntarily disclose your documents or identity for marketing, immigration, or general law-enforcement fishing purposes.

Providers sending records to you here. If you ask your doctor or hospital to send your records directly to your Cabinet under your right of access, that provider's duties are theirs; once the records arrive, they are yours, held under this Policy. We do not act on any provider's behalf, and no provider can see into your Cabinet.

7. Advertising, tracking, and geolocation — what we do not do

No advertising trackers on signed-in screens. No advertising or analytics SDKs, pixels, or session-replay tools receive your documents, document-derived data, or the fact that you use a health vault, on any authenticated Cabinet screen.
No sale or sharing for advertising of any personal information, including to social-media or ad platforms (Section 3.5).
No geofencing. We do not create virtual perimeters around clinics, hospitals, or any health care facility to identify, track, or message people — and we never will.
Truthfulness. Every privacy and security statement we make — in this Policy, in app-store listings, and in the app — is a commitment we are required to keep literally true, including about our subprocessors. If a statement here ever stops being true, we will change the practice or change the statement and tell you (Section 17).

8. Explanations — what they are, and what they will never be

When you tap "Explain this to me," four AI workers handle your document in sequence: 📄 the Reader (quotes your document exactly; flags words it cannot read; never guesses) → 🔬 the Scientist (drafts the explanation from published scientific information, principally PubMed/NCBI and named guidelines, in the order: what is normal → what needs attention → the most important thing) → 🛡️ the Guardian (checks every number against the Reader's quotes and removes any wording that crosses the lines below) → 💬 the Voice, Nurse Mari (presents it calmly, in your language).

Our product promises about explanations:

Education only. Explanations teach you what a document says and what its terms and values generally mean. They are general educational information, not medical advice.
Never a diagnosis. The Cabinet will never tell you that you have, or do not have, any disease or condition; never offer a list of possible diagnoses for you ("differential"); never characterize your result as a clinical conclusion about you; and never give you a severity or probability score about your own health.
Never a treatment recommendation. The Cabinet will never recommend that you start, stop, or change any medication or treatment, and never direct your personal care decisions.
Written reports only. The Cabinet reads the text of written reports. It does not analyze medical images themselves — it does not interpret your ultrasound, X-ray, CT, or MRI pictures, and it never will under this Policy. A photograph you upload is processed to read the report's words, not to examine the scan.
Your document's own ranges. Where a value is shown against a reference range, it is the range printed on your document or a named published range, shown so you can see where the number sits — reference ranges cover the central 95% of healthy people, so about 1 in 20 healthy results falls a little outside by chance. Position on a range is information, not a verdict.
General safety language, always visible. Every explanation screen carries this standing notice, whether or not your document mentions anything urgent: "This explanation was generated by artificial intelligence. It is educational only and is not medical advice. If you have emergency symptoms — such as chest pain, trouble breathing, signs of stroke, or severe bleeding — call your local emergency number (911 in the US) or seek urgent care now. For anything in your report that worries you, contact your own doctor or care team." This general language is not a document-specific instruction about you.
AI transparency. Nurse Mari is disclosed as an AI at first introduction and throughout explanation screens, with instructions for reaching a human being at our support team. Nothing in the Cabinet will ever state or imply that an explanation was written, reviewed, or approved by a licensed physician, nurse, or other licensed professional — unless a specific explanation actually was reviewed by a human licensed in the state or country where you are located, in which case it will say exactly that, and only that. Job titles in the Cabinet never imply a government license.
Human review gate. While our launch review mode is on, an explanation is held for review before it is shown to you, and the Guardian worker's veto cannot be overridden by any other worker. If a worker is uncertain, its instruction is to say so and hold — never to improvise.
Accuracy honesty. AI can misread documents and can be wrong. The Reader quotes your document so you can check the words yourself; if the quote and your paper disagree, your paper is right. Always discuss your results with the clinician who ordered them.

Marketing for the Cabinet will claim only what the Cabinet demonstrably does: stores your documents, explains terminology, and displays published reference information. We will not claim the Cabinet detects disease, spots problems early, or interprets your results for clinical use.

9. Children's profiles — guardian rules

Accounts are held only by adults. A child never holds an account; a child's profile exists inside a parent's or legal guardian's account.

Verification before activation. A child profile does not activate until we have obtained verifiable parental consent from the adult account holder — by a method the law recognizes (for example, a signed consent form, a payment transaction in the adult's name with notice, a government-ID check with the ID image deleted after verification, or an approved knowledge-based check). A simple email confirmation is not enough. We keep an audit record of each consent.
Guardian attestation. To create a child profile you must attest that you are the child's parent or legal guardian with authority to manage the child's health documents. If guardianship is disputed or changes, contact us — control follows the law and court orders, not family preference.
Direct notice. Before the profile activates, we give you a direct notice of what we collect about the child, how it is used, who processes it (Section 6), and your rights below.
Parent rights. At any time, you may: review all information in your child's profile; refuse further collection or use; and require deletion of the child's information — from inside the app or by contacting us.
Minimum necessary. We collect only the child information reasonably necessary for the profile and the features you use.
Retention limit. Children's information is retained only as long as reasonably necessary for the purpose it was collected for, per the written retention schedule in Section 12. Indefinite retention of a child's information is prohibited, and we prohibit it in our systems too.
Separate disclosure consent. We will not disclose a child's information to any third party beyond the contracted processors in Section 6 — which your verifiable parental consent must specifically cover — without separate consent, except where the law requires it.
Adolescent confidentiality. Some services for adolescents are confidential by law even from parents. Where the law gives the adolescent control over a record, we will follow the law over a guardian's request, and we will explain that to the extent the law allows.
Age 13. When a child turns 13, children's-privacy rules change. We will notify you, and the profile continues only under the consent and rights framework that then applies, including any consent the teenager must give personally under applicable law.
Age 18 — transfer. When a child reaches adulthood, the parent's access ends. The profile's contents transfer to the now-adult person's own account only with that person's consent, through a transfer flow we will present to both of you in advance. Without the adult's consent, a parent may not continue to access, download, or share the profile; the adult may instead direct us to export or delete it.

10. Your rights — and how to use them

Whatever state or country you live in, you may at any time, from inside the app or by contacting us at biomedmariam@gmail.com:

Access / know: get a copy of your information — including everything in your cabinet — and know the categories of information we hold, why, and where it came from.
List of recipients: get the list of third parties with whom your health information has been shared (beyond the processors acting for you, which are listed in Section 6).
Correct: ask us to correct inaccurate information (documents you uploaded are corrected by you directly — replace or delete them anytime).
Delete: delete any document, any profile, or your whole account, and have the deletion flowed through to our processors. Deletion is permanent (Section 12 for backup timing).
Withdraw consent: withdraw any consent in Section 5, as easily as you gave it.
Export / portability: download your cabinet in a usable format at any time — your records are never held hostage to a subscription.
Limit use (where the law provides it): limit the use and disclosure of sensitive personal information to what is necessary for the service you requested.
Non-discrimination: we will never penalize you, degrade your service, or charge you differently for exercising a right.

Mechanics. In-app controls are the fastest route and work immediately. For requests sent to us directly, we verify the requester is the account holder (or a guardian acting within Section 9), respond within the time the applicable law requires — and in all cases we aim to complete requests within 30 days — and tell you if a law requires us to refuse or delay any part, and why. Residents of Washington, Nevada, and Connecticut have the consent, access, withdrawal, and deletion rights described in their laws over their consumer health data; this Policy is also our consumer health data privacy policy for those states, and it is linked distinctly where those laws require.

11. Security — how we protect your cabinet

We maintain a reasonable, documented information-security program appropriate to the sensitivity of health information, and we review and test it regularly. Its commitments:

Encryption of your documents in transit and at rest. Information that is encrypted to recognized standards is outside the scope of most breach notification duties — we treat encryption as both a security control and a protection for you.
Per-user isolation, enforced technically: each cabinet and each child profile is separated at the data layer, so no account can reach another's contents, even by manipulating the app.
Access control: our staff access is limited to those who need it for the duty they are performing, is authenticated, logged, and reviewable. Staff never browse user cabinets for curiosity; support access to a document happens only at your request or to resolve a security incident.
Vendor flow-down: every processor in Section 6 is bound by contract to confidentiality, security, no-training, and no-retention terms, and to notify us of any breach on the clock in Section 13.
Security of children's data is maintained under the same program, in writing, as children's-privacy law requires.
Your part: protect your sign-in. Tell us immediately at biomedmariam@gmail.com if you believe your account was accessed by someone else.

We will never describe our security with words we cannot back up — we will not call the Cabinet "HIPAA compliant," "HIPAA certified," or similar, because (Section 14) HIPAA does not govern this service, and claiming its badge would mislead you.

12. Retention and deletion — the written schedule

We keep information only as long as the purpose requires:

Data	Retention
Your documents and explanations	Until you delete them or close your account. They are your records; we do not expire them on our own schedule.
Account information	While your account is open; deleted within 30 days of account closure, except records in the rows below
Children's profile information	Only as long as reasonably necessary for the profile's purpose; deleted promptly on a guardian's deletion request or at the Section 9 transfer; never retained indefinitely
Payment records and subscription consent records	At least 3 years, or 1 year after the subscription ends, whichever is longer (auto-renewal law), and as tax/accounting law requires
Security and access logs	12 months, unless needed for an open incident or legal duty
Breach/incident records	As the applicable breach laws require
Backups	Encrypted backups rotate and are overwritten within 30 days; a deletion you make reaches live systems immediately and backups within that rotation

When you delete a document, it is removed from your cabinet and our live systems, and we instruct our processors to delete their copies. Deletion of an account deletes all cabinets and profiles under it, subject only to the retention rows above.

13. If something goes wrong — breach notification

A "breach" includes more than a hacker: it includes any unauthorized acquisition of, or unauthorized disclosure of, your unsecured health information — including a disclosure made without the authorization or consent the law requires.

If a breach happens, we will — running every applicable law in parallel and obeying the strictest (fastest) clock among them:

Tell you without unreasonable delay and no later than 60 calendar days after we discover the breach (sooner where another law requires it), by first-class mail, or by email plus an in-app message or banner where you chose email notice, with a clear option to switch to mail. The notice will say, clearly: what happened and when; when we discovered it; the types of information involved (for example, lab results, medication information, or the fact of app use); any third parties known to have acquired it; what we are doing about it; and what you can do.
Tell the Federal Trade Commission through its health-breach notice process: at the same time as individual notice if 500 or more people are affected; otherwise annually, within 60 days after the end of the year.
Tell prominent media in any state where 500 or more residents are affected, within the same 60 days.
Tell state attorneys general and regulators wherever state breach laws require it, within their deadlines.
Substitute notice (a conspicuous homepage posting for 90 days plus a toll-free number) if 10 or more affected people cannot be reached by the methods above.

We maintain a written incident-response plan covering these steps, and our processors are contractually required to notify us without unreasonable delay and no later than 60 days after they discover a breach, identifying each affected individual, so our clock to you can be met.

14. Our legal status — stated honestly

HIPAA does not govern the Cabinet. We are a direct-to-consumer service. We are not a health plan, health care provider, or clearinghouse, and we do not hold your information on behalf of one, so the HIPAA Privacy and Security Rules do not apply to this service. That is why you will never see us claim to be "HIPAA compliant" or "HIPAA certified" — the claim would be false. We voluntarily adopt safeguards modeled on recognized standards, and we describe them as what they are (Section 11).
California law treats us as a health care provider for confidentiality purposes. Under the Confidentiality of Medical Information Act (CMIA), a business organized to maintain medical information so individuals can manage it is deemed a provider of health care for that Act. We accept CMIA's duties in full: confidentiality, disclosure only with compliant authorization or a legal exception, and storage that preserves confidentiality (Sections 5, 6, 11).
Other states' health-data laws apply to their residents — including Washington's My Health My Data Act, Nevada's consumer health data law, and Connecticut's health data provisions — and this Policy is written to satisfy them (Sections 4, 5, 10).
If this ever changes: if we ever offer the Cabinet on behalf of a health plan or provider, HIPAA business-associate duties would attach to that arrangement, and we would tell affected users and sign the required agreements before it began. Nothing in this Policy is a HIPAA Notice of Privacy Practices.

15. Subscriptions, the lifetime option, and payments

The Cabinet is free for the first six months. Your free six months begin on the day paid access first launches, if your account already exists then; if you join later, on the day your account is created. Testers are free from the start and are not converted to paid while they hold tester status. After the free period you may choose either door — or neither, and stop.

Door 1 — Monthly subscription: $1.11 per month, auto-renewing.

Before you give billing information, the checkout screen will state, clearly and conspicuously: the price ($1.11), the monthly frequency, that it renews automatically, the exact date of the first charge (the day your free period ends), how to cancel, and that the price may change only as described below.
You must give separate, affirmative consent to the auto-renewal itself — a distinct action naming the recurring charge. Agreeing to this Privacy Policy or our Terms is not consent to be charged, and we never charge merely for accepting a policy.
After you subscribe, we send a retainable acknowledgment restating the terms and cancellation route. We send a reminder before your free period converts to the first charge, in time for you to cancel and pay nothing, and an annual reminder while the subscription continues.
Price changes: we will notify you at least 7 and no more than 30 days before any price or fee change takes effect, with cancellation information in the same notice.
Cancel as easily as you joined: if you subscribed online, you can cancel online, at will and immediately, through a prominently placed direct cancellation button in your account settings — no phone call, no chat, no obstructing steps. If we show you a save offer while cancelling, the cancel button stays visible at the same time. Cancellation stops the next renewal; amounts already charged for the current month are not refunded except where the law requires.
Consent records: we retain proof of your subscription consent for at least 3 years, or 1 year after the subscription ends, whichever is longer.

Door 2 — Lifetime access: $35, one time.

Lifetime members are never moved behind a new paywall for the features they bought, never subjected to later price changes, and never required to convert to a subscription.
If the Cabinet service ever shuts down, we will give lifetime members — and everyone — at least [90] days' advance notice, a full export of all documents in their cabinets, and then delete the data per Section 12. Your documents are never deleted without that export opportunity.
The lifetime option and the subscription are presented side by side, neither pre-selected, so your choice is genuinely yours.

Payment processing. On the web, payments are processed by Stripe; your card details go to Stripe, not to our servers. If you buy inside a future native iPhone or Android app, the purchase will be processed by Apple's or Google's in-app billing under those platforms' rules, and the checkout screen will say so before you pay.

16. Where the Cabinet is available

The Cabinet is offered only in countries we have cleared for launch. At launch, that is the United States. Specifically:

European Union / EEA: not offered at launch. EU health-data law (GDPR Article 9) requires an explicit-consent regime, a data-protection impact assessment, an EU representative, and transfer safeguards that we will implement before — not after — offering the Cabinet there.
Russia: not offered at launch. Russian law requires Russian citizens' personal data to be collected and stored using databases located in Russia; a consent sentence cannot change that, so Russian signups are excluded until compliant infrastructure exists.
Other countries are added only after a per-country review; a language being available in the app (including Russian and Spanish) does not mean the service is offered in every country where that language is spoken, and we do not market the Cabinet into countries where it is not offered.
Signup checks (residence, location signals, and payment country) enforce this section. If you move, your data remains yours — Sections 10 and 12 still apply, and we will tell you if a move changes availability.

17. Changes to this Policy

If we change this Policy, we will post the new version in the app and on our site, note the effective date, and — for any change that reduces your privacy, expands sharing, or alters the promises in Section 3 — notify you in advance and obtain any consent the law requires before the change applies to information already collected. The Section 3 promises cannot be weakened for data already in your cabinet without your consent.

18. Contact us

Questions, rights requests, breach concerns, or guardian matters: biomedmariam@gmail.com, or by post: Mariam Ohanyan, 1136 N Columbus Ave, Apt 102, Glendale, CA 91202, USA. We answer privacy requests within the times stated in Section 10.