Privacy Policy

1. Who we are

Medivault is a personal health record service operated by Novus Digital Initiative (“we”, “us”, “our”). We are committed to protecting your personal data in accordance with applicable data protection laws, including Singapore’s Personal Data Protection Act 2012 (“PDPA”) and other internationally recognised data protection principles.

Data Protection Contact:
Email: hello@novusdigi.com
We will acknowledge requests within 24 hours and respond within 10 business days.

2. What data we collect and why

We collect the minimum data necessary to operate the service.

3. How your data is encrypted and stored

Medivault is built on a zero-knowledge architecture. All health records, documents, medications, lab results, and vitals are encrypted on your device before being transmitted, using:

• AES-256-GCM — industry-standard symmetric encryption.
• PBKDF2-SHA256 — for deriving your master key from your passphrase.
• A unique random 12-byte IV per encryption operation.
• Your master key never leaves your device and is never transmitted to our servers.

Encrypted data is stored on infrastructure hosted in Singapore (ap-southeast-1), operated by Supabase, Inc. Singapore is subject to the Personal Data Protection Act 2012 (PDPA), one of Asia’s strongest data protection frameworks.

4. Third-party data processors

We engage the following sub-processors to deliver the service.

We do not sell your data. We do not use your health records for advertising. We do not share your data with any party beyond the sub-processors listed above.

5. AI features — data processing notice

6. Cross-border data transfers

Your encrypted data is stored in Singapore. AI processing occurs in the United States. When we transfer data across borders, we ensure adequate safeguards are in place, including contractual protections with our sub-processors. We apply the principle of data minimisation — only the minimum necessary data is transferred for each operation.

7. Data retention

• Your data is retained for as long as your account is active.
• If you delete your account, all personal data (documents, health records, profile, vault) is permanently and irreversibly deleted within 72 hours.
• AI processing data is not retained by our AI provider after each call.
• Push notification tokens are deleted when you revoke browser permission or on account deletion.

8. Your rights

Regardless of where you are located, you have the following rights over your personal data:

9. Security measures

• End-to-end AES-256-GCM encryption — we cannot read your health data.
• Row Level Security on all database tables — no user can access another’s data.
• Per-user API rate limiting to prevent brute-force and abuse.
• Security headers: CSP, HSTS, X-Frame-Options on all responses.
• Zero-knowledge share links — decryption key never sent to our server.
• Generic error messages — no internal system details exposed in API responses.

10. Data breach notification

In the event of a personal data breach that is likely to result in significant harm, we will notify affected users and relevant authorities within 72 hours of becoming aware, in accordance with PDPA obligations. Because all health data is encrypted with keys only you hold, a breach of our servers would expose ciphertext only.

11. Children’s data

Medivault is not intended for use by persons under 18. We do not knowingly collect personal data from minors. If you believe a minor’s data has been submitted, contact hello@novusdigi.com and we will delete it promptly.

12. Changes to this policy

We will notify you of material changes by email or in-app notification at least 30 days before they take effect. Continued use after the effective date constitutes acceptance of the updated policy.

13. Governing law

This policy is governed by the laws of Singapore, including the Personal Data Protection Act 2012. Where you are located in a jurisdiction with its own data protection requirements, we comply with those requirements to the extent they apply to our service.