Privacy
Docuroutine handles photographs of prescriptions, which are health information about a named person. This page describes exactly what happens to them. Where a claim can be checked in the source, it is linked.
What is stored, and where
Your original photograph is stored in a private bucket in this project’s Supabase instance, under a key beginning with your own account id. Access is enforced by a row-level security policy in the database — split_part(name, '/', 1) = auth.uid()::text — not by the application asking politely. Reading it requires a signed link that expires in five minutes.
Alongside the original, a second image is stored: the covered copy, with the personal details blacked out. This is the only version that is ever sent anywhere.
We also store what the two readers returned for each field, the crop coordinates those readings came from, which of them you confirmed, and the schedule you approved. We do not store your name — the app asks for a label like “Ma” or “Baba”, and never for a patient’s real name.
Who else sees your prescription
To read the page, a copy of it is sent to two model providers: Anthropic (Claude Sonnet 5) and Google (Gemini 3.1 Pro). Both receive the covered copy, with the name and phone number destroyed at the pixel level on your device before upload. Neither receives the original.
They receive deliberately different images: Anthropic gets the page as captured, Google gets a straightened and contrast-adjusted version. Neither is told what the other returned.
If you skip the covering step, the page is sent as it is, and that choice is recorded in the audit trail. The step is never a gate — but skipping it means an uncovered page reaches both providers.
Their handling of what they receive is governed by their own terms. This project sends no account identifier, no email address and no label with the image.
The audit trail
Every meaningful action writes a row: a document created, stored or deleted, a reading run, a field escalated or resolved, a schedule approved, a share link created, opened or revoked, a person added or erased.
The trail is append-only at the database level, not by convention. Rows are inserted through a single SECURITY DEFINER function and there are no UPDATE or DELETE policies on the table at all — so a client holding the service-role key still cannot rewrite history.
The trail records that something happened and to which record. It holds no picture of your page and no medicine name from it.
Deleting your data
You can delete a single document, or a person and everything belonging to them, from inside the app.
delete_document() removes the document row and every reading, field and confirmation that cascades from it. delete_patient() removes the person, all their documents, schedules and share links.
Neither function deletes the image by removing a database row, because that would remove only the metadata and leave the file in the storage bucket — reachable by nobody, visible to nobody, and still there. Both return the storage keys to the app, which calls the storage API and then re-reads the object with caching defeated to confirm it is actually gone. Only then is the deletion recorded as complete. A deletion entry with no matching purge entry beside it means the erasure did not finish, and that gap is deliberately visible.
What is kept is the audit trail: that a document existed and was deleted, and when. India’s Digital Personal Data Protection Act requires that record to be retained; it contains no image and no medicine.
Share links
A share link lets the person taking the medicines open their schedule with no account and no password. The link contains a random token; only a hash of it is stored, so the link cannot be reconstructed from the database.
You can revoke a link at any time. Revoking stops the page and the audio together. A recording link already issued to a browser stays valid for up to five minutes after revocation, because that is how long a signed storage link lives; nothing new is issued after that.
Every time a share link is opened it is recorded in the audit trail as an anonymous access.
Analytics and cookies
This site sets no analytics cookies and loads no third-party scripts. The Content-Security-Policy served with every page blocks scripts from any origin but this one, including the host’s own analytics beacon.
The application stores a session token in your browser so you stay signed in. That is the only thing it keeps on your device beyond ordinary caching.
What this is
Docuroutine is a student capstone project, not a company. There is no data-processing agreement to sign and no support contract. Documents used to evaluate it are not published, and consent for them was given for a capstone rather than for open release.
If you want your data removed and cannot do it in the app, write to us and it will be done by hand.