Privacy Policy & Scientific Data Governance

This document outlines the privacy commitments, data governance architecture, and intellectual property safeguards established by Medhira AI for researchers, faculty, university students, and industrial scientific laboratories utilizing the Medhira Resolvent platform and applications.

1. Introduction & Data Controller Scope

This Privacy Policy governs the processing of information by Medhira AI Inc. ("Medhira", "we", "us", or "our") in connection with:

• The Medhira Resolvent Web Application hosted at https://res.medhiraai.com/;
• The Medhira Resolvent Android Mobile Application (Application ID: ai.medhira.resolvent);
• The Medhira Resolvent Desktop Workstation Client (JVM / Compose Desktop); and
• Associated cloud APIs, AWS Cognito authentication endpoints, and AppSync synchronization services.

For inquiries regarding compliance under the European Union General Data Protection Regulation (EU GDPR / UK GDPR), California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), and Family Educational Rights and Privacy Act (FERPA), the designated Data Controller is Medhira AI Legal & Data Governance Core.

2. Categories of Information Collected

We strictly limit data collection to categories necessary for provisioning the scientific operating system and enforcing per-researcher computational quotas:

3. Zero-Knowledge & Local-First Processing Architecture

Unlike conventional cloud-centric platforms, Medhira Resolvent executes intensive data analysis directly on your local device:

• Super File Converter: When converting files between CSV, JSON, Markdown, HTML, PNG, JPEG, WebP, or text formats, the entire transformation pipeline runs 100% locally on your machine via WebAssembly and HTML5 Canvas. The contents of your files are never transmitted to our backend servers, and zero conversion bytes persist in external cloud databases.
• Scientific Data Analysis Studio: All statistical summaries (Welford sample variance, mean, median, distribution histograms) and CSV visualizations are computed client-side in the browser or mobile sandbox.
• Personal Vault Isolation: Files uploaded to your 2 GB personal encrypted cloud vault are stored in private, non-public Amazon S3 buckets with Server-Side Encryption (SSE-KMS / AES-256) and tenant-specific IAM access policies.

4. Zero Model Training & Zero-Fabrication Mandate

In accordance with our Zero-Fabrication Mandate, the platform's Scientific Copilot relies exclusively on traceable citations:

1. Every scientific claim is grounded in active peer-reviewed literature with verifiable DOIs or explicitly authenticated documents in your personal vault.
2. If retrieved literature contains ambiguous or insufficient evidence, the system is hardwired to enter an explicit Abstention State (Status: ABSTAIN) rather than generating speculative or hallucinated claims.

5. Federated Scientific Literature Queries

When researchers utilize the Literature Discovery & Reference Manager:

• Search queries are dispatched to open-access public scholarly registries: OpenAlex (OurResearch), Crossref (Crossref Works API), and Europe PMC / PubMed (EMBL-EBI).
• These queries are executed purely as read-only academic lookups. We do not correlate your literature search queries with advertising profiles or commercial data brokers.

6. Security & Cryptographic Storage Safeguards

We implement rigorous technical and organizational security controls designed to meet institutional compliance standards:

• Encryption in Transit: All HTTP traffic is protected by Transport Layer Security (TLS 1.3) with Perfect Forward Secrecy. Strict HTTP Strict Transport Security (HSTS) is enforced across res.medhiraai.com.
• Hardware-Backed Android KeyStore: On mobile devices (Application ID: ai.medhira.resolvent), authentication tokens are stored in the Android hardware enclave using AES-256-GCM authenticated encryption paired with tenant-specific AAD (Authenticated Additional Data).
• Screen Protection (FLAG_SECURE): The Android application enforces window security flags to prevent unauthorized background screenshot capture and memory dumping on untrusted devices.
• Tamper-Evident Hashing: Electronic notebook ledger entries are cryptographically linked using SHA-256 hash chains, providing immutable verification of experimental chronology.

7. Data Retention & Permanent Account Deletion

We adhere to data minimization principles:

• Retention Period: Your account profile, compute allocations, and personal vault items persist for as long as your account remains active.
• Automated Quota Recycling: Compute battery balances reset to 3,000 Wh every day at 00:00 UTC without accumulating rolling historic compute liabilities.
• Self-Service Account Deletion (Google Play Compliance): You may request complete and permanent deletion of your account at any time. In the mobile application or web portal, navigate to Settings & ORCID ➔ Data Governance ➔ Delete Account & Purge Vault Data.
• Purge Timeline: Upon confirmed deletion, your user record in AWS Cognito, your encrypted S3 vault directory (vault/{userId}/), and associated tokens are permanently deleted within 0 hours (immediate hard deletion). Ephemeral database audit logs are purged within 30 days in accordance with statutory compliance schedules.

8. Researcher Rights & Regulatory Compliance

Depending on your geographical jurisdiction, you enjoy the following enforceable rights regarding your personal data:

• Right to Access & Portability: You may export a complete, machine-readable JSON dossier of your research notebook, settings, and metadata at any time.
• Right to Rectification: You may update your academic title, institution, research discipline, and password directly within platform settings.
• Right to Erasure: You possess the absolute right to have all personal information permanently deleted upon request.
• FERPA / University Compliance: Medhira Resolvent complies with institutional student privacy norms by treating student researcher identity records as confidential educational institutional records under university control.
• No Sale of Personal Data: We do not sell, rent, license, or exchange personal data or scientific findings with third parties or advertising brokers (verifiable under CCPA Section 1798.120).

9. Subprocessors & Cloud Infrastructure Providers

Medhira Resolvent utilizes vetted infrastructure providers bound by strict Data Protection Agreements (DPAs):

10. Changes to this Privacy Policy

If we introduce material modifications to this Privacy Policy, notice will be prominently broadcast across the Medhira Resolvent web portal and within mobile application release notes at least 14 days prior to implementation. Continued utilization of the platform after the effective date denotes confirmation of updated terms.

11. Contact & Data Protection Officer

For inquiries, Data Subject Access Requests (DSAR), or institutional compliance audits, please submit inquiries through the official Medhira Resolvent Platform: