Anesto — Privacy Policy

Anesto ("the App") is operated by Pierogi Labs LLC ("we," "us," or "our"). This privacy policy explains what data Anesto collects, how it is used, and who it is shared with.

We built Anesto with privacy as a core design principle. The App does not collect or store protected health information (PHI). Using Anesto requires an account (Sign in with Apple or email), so your cases can be backed up and restored.

1. Information We Collect

1a. Information You Provide

1b. Information Collected Automatically

1c. Information We Do NOT Collect

Anesto is designed to avoid collecting sensitive patient data. We do not collect or store:

• Patient names, medical record numbers (MRNs), or dates of birth
• Any data that identifies a specific patient
• Your phone's location (GPS)
• Advertising identifiers or cross-site tracking data
• Contacts, photos (other than one you choose to send in the support chat), browsing history, or financial information
• Your ACGME password

2. How We Use Your Information

We use the information described above to:

• Parse your case descriptions into structured records using AI
• Improve how Anesto parses cases, using the case description text you enter (see Section 6)
• Transcribe voice recordings into text
• Store and display your case log
• Generate PDF reports for credentialing
• Track training progress against ACGME case log requirements (residents and fellows)
• Send cases to your ACGME Case Log when you ask it to (residents and fellows; see Section 4)
• Back up your data and restore it when you sign in on a new device
• Authenticate your account
• Understand which features are used, and find and fix crashes
• Answer your support requests, send new accounts a few getting-started emails, and from time to time email you about new versions of Anesto (see 3h)

We do not use your data for advertising, profiling, or any purpose other than providing Anesto's features.

3. Third-Party Services

Anesto uses a small number of third-party services to power its core features and to provide customer support. The data shared with each, and your control over it, is described below.

3a. Anthropic (Claude API) — Text Parsing

When you submit a case description (text or transcribed voice), it is sent to Anthropic's Claude API to parse the description into structured medical descriptors. Anthropic's data policies state that API inputs are not used to train their models. See Anthropic's Privacy Policy.

If you paste a reply from a surgeon or attending into a Case Card and tap Read it, the App sends that reply, together with the procedure names and the questions on the cards it concerns, to Anthropic's Claude API through our server, to suggest answers, preferences and notes for those cards. Before the reply leaves your device, the App replaces numbers that look like identifiers, dates, phone numbers, email addresses, room and bed numbers, and names that follow a title such as "Mr." with placeholders. It cannot recognize other names, so please remove patient names before you send a reply. Our server records only counts and timings for these requests, never the text, and the pasted reply is not stored. A suggestion is added to a card only when you tap it.

3b. Groq (Whisper API) — Voice Transcription

When you use voice input, your audio recording is sent to Groq's Whisper API for transcription into text. The transcribed text is then sent to Anthropic for parsing (see 3a). Groq's API terms state that API inputs are not used to train their models. See Groq's Privacy Policy.

3c. What This Means for You

3d. Data Sent to Third-Party Services

The following data is sent to third-party services:

The following data is NOT sent to AI services: your email address, account credentials, hospital site names, or any previously saved case records.

3e. Your Control Over AI Data Sharing

3f. Crisp — In-App Support Chat

Anesto includes an optional in-app support chat (the "Message Leo" card on the Account screen) powered by Crisp (Crisp IM SARL). When you open the support chat, we share limited account information with Crisp to route and identify your conversation: your email address, your Anesto user ID, and your display name. We do not send any case data, procedure information, patient information, or health information to Crisp. Anything you choose to send in the chat, such as messages, photos or files, and a video call if you join one, goes through Crisp so that we can see and answer it; the App asks for camera access only if you choose to take a photo or join a video call there. Please don't send patient information, or photos of patient records, in the chat. You can use Anesto fully without ever opening the support chat, in which case no information is shared with Crisp. See Crisp's Privacy Policy.

3g. This Website

anesto.app counts visits with Cloudflare Web Analytics, which uses no cookies and collects no personal information.

We also keep our own simple record of how people move around the site: which pages are opened during a visit, in what order, which "Get the app" buttons are clicked, and the name of the website that sent you here, if any. To link the pages of one visit, your browser holds a random number for that tab only, and it is erased when you close the tab. We don't use cookies for this. We don't store your IP address or your browser's details, we record page addresses without anything after a "?", and we never combine this with your Anesto account or any other information. Besides the pages, we record the time, whether you're on a phone or a computer, and the approximate place and network your connection comes from: your country, state or province, and city, and the name of the network you're on (for example, your internet or mobile provider, or a hospital or university network). Cloudflare works these out from your connection when you visit. We don't store your IP address, and we never record a street address, postal code or precise location. We use this to understand which places and institutions are finding Anesto. We keep these records for 90 days; after that, only daily totals. If your browser sends a Global Privacy Control or Do Not Track signal, or you're visiting from the European Economic Area (which includes the European Union), the United Kingdom or Switzerland, nothing is recorded.

3h. Brevo — Email

Email from Anesto, such as replies to your support requests, a few getting-started emails for new accounts, and occasional news about new versions, is sent through Brevo, an email delivery service. To deliver a message, Brevo receives your email address, your name if we have it, and the message itself. Brevo records whether each message was delivered and may record whether it was opened. Getting-started and product-update emails never include your cases. Which getting-started email you get, and when, depends on when you signed up, the kind of account you have (for example, resident or attending), and whether you have logged a case yet (a yes or no, never the case itself). You can stop getting-started and product-update emails at any time, with the unsubscribe link in the email or by writing to support@anesto.app; replies to your own support requests are not affected. See Brevo's Privacy Policy.

4. Sending Cases to ACGME (iPhone app)

Residents and cardiac fellows can send cases to their ACGME Case Log from the app.

• You sign in on ACGME's own page inside the app. We never see or store your ACGME password. You stay signed in on your phone until you choose Account > Sign out of ACGME on this phone.
• When you send, your phone fills in and submits ACGME's form directly. It doesn't go through our servers. What's sent is what you logged for that case, including your case description as the comment.
• If you ask for your ACGME totals, your phone reads your minimums report on ACGME to show your progress, and reads it again when you connect or send so it stays current. It only reads. Your numbers stay on your phone; we only record whether the read worked.
• We keep:
  • your ACGME program's name, and when you connect to ACGME;
  • your ACGME attendings, sites and training-year lists, and the case-type choices on your ACGME form;
  • for each hospital site: which ACGME site it matches, and whether you marked it "not my program";
  • for each entry on your ACGME list: ACGME's reference number, its date, and whether it matches something you logged in Anesto — never what's in the entry;
  • for each case you send: ACGME's reference number, whether it was confirmed, and a record of whether the send worked. The Case ID you sent it under, and the ACGME attending and site you chose, are kept with your case, so they come back if you reinstall. Nothing else from ACGME's entry is kept.
• Anesto only adds cases to ACGME. It never changes or deletes anything there.

Anesto is not affiliated with or endorsed by ACGME.

5. Cloud Backup and Storage

Every Anesto account is backed up automatically. Your case records and hospital sites are stored in our cloud database hosted on Supabase (built on Amazon Web Services), so they come back when you sign in on a new device. Your data is:

• Encrypted in transit (TLS) and at rest
• Isolated by user — you can only access your own data (enforced by row-level security)
• Not shared with other users or third parties
• Not used for advertising or to train AI models (your case description text is used only to improve Anesto's own parsing, as described in Section 6)

6. Data Retention

• On-device data: Stored until you uninstall the App.
• Cloud backup data: Stored until you delete your account.
• Deleted cases: When you delete a case, it moves to Recently Deleted, where you can restore it for 30 days. After that it no longer appears in the App, but we keep a record of the deleted case in your account so it stays deleted on all your devices, until you delete your account.
• Case description text: The text you type or dictate is kept with your case — on your device and in your own account — for up to 12 months, to improve how Anesto parses cases. After 12 months it is removed from our cloud; the structured case record is kept as described above.
• ACGME connection data: Stored until you delete your account.
• AI processing: Anthropic and Groq process your input to return results and may retain data per their own published policies.
• Voice recordings: Audio files are held in temporary device memory during transcription and are not saved to your device storage or our servers after processing is complete.

7. Data Security

We use the following measures to protect your data:

• On-device storage using SQLite with iOS device encryption
• Authentication tokens stored in the operating system's secure keychain (Keychain Services on iOS)
• All network communication over HTTPS/TLS
• Row-level security on cloud database (each user can only access their own data)
• No AI service keys are stored in the App; AI requests go through our own server

8. Payments and Financial Data

Subscriptions are processed entirely by Apple through the App Store. We never collect, see, or store your credit card number, billing address, or other payment information. Subscription management (including cancellation) is handled through your Apple Account settings.

9. HIPAA Disclaimer

Anesto is not a HIPAA-covered entity and is not designed to store, transmit, or process protected health information (PHI) as defined by HIPAA. The App is a personal productivity tool for tracking case summaries. Supervisor names stored for residents and fellows are professional data (not patient data) and are not considered PHI. You are responsible for ensuring that you do not enter patient-identifying information into the App. We do not enter into Business Associate Agreements (BAAs).

10. Children's Privacy

Anesto is designed for use by medical professionals and is not directed at children under 13. We do not knowingly collect information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly.

11. Your Rights

You have the right to:

• Access your data — All your case records are visible in the App at all times.
• Export your data — Use the PDF or CSV export features to download your records.
• Delete your data — Delete individual cases in the App, or delete your account and all its cloud data in Account > Data & privacy > Delete account. You can also email us and we'll do it for you.

To exercise any of these rights, contact us at support@anesto.app. We will respond within 30 days.

12. California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA). We do not sell personal information. You may request deletion of your data by contacting us at support@anesto.app.

13. International Users

Anesto is currently available in the United States and Canada. If you access the App from outside these regions, your data may be transferred to and processed in the United States.

14. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you through the App or by updating the "Last Updated" date above. Continued use of the App after changes constitutes acceptance of the updated policy.

15. Contact

If you have questions about this privacy policy or your data, contact us at:

Email: support@anesto.app

Website: anesto.app