AI Training & Research Data Notice

This is the single, prominent place where we explain — in detail — how ChongCheck uses data from your usage to improve our AI models and to produce research. If you have read only one legal document on this site, please make it this one.

---

0. The 60-Second Version

1. We use de-identified, pseudonymized, bucketed derivatives of what you submit to train our AI models and to build aggregated, k-anonymous reports that we share with pharmaceutical and academic partners.

1. We do not put your raw personal data (name, email, pet's name, photos, free text, payment data, IP) into that training set or those reports — ever.

1. On the Free Plan, your contribution of this de-identified data is part of the deal and is consented to at signup. This is what allows the Free Plan to exist.

1. On the Paid Plan (ChongCheck Pro), this contribution is opt-in only and you can toggle it any time in Settings → Privacy without losing any features.

1. You can stop future contributions at any time (Settings → Privacy). You can also delete past contributions (Settings → Delete Account → "Full erasure including research contribution"), in which case all your pseudonymized rows are removed from the research corpus within 30 days.

If any of that is unclear, the rest of this document expands each point. If it is still unclear after reading the rest, please email privacy@chongcheck.app.

---

1. Why We Do This

ChongCheck is built on a feedback loop:

• You submit data;
• Our AI consilium produces an analysis;
• You (sometimes) tell us what the vet actually said;
• We learn — both at the individual-model level (better predictions) and at the population level (better breed baselines, better outcome predictors, better safety filters).

Without this loop, the Service stagnates. With it, every consilium gets better for the next pet. That is the entire reason ChongCheck exists as a category, and it is why we feel comfortable offering a Free Plan: the contribution is mutual.

---

2. What is in the Research Corpus

The research corpus is a separate dataset, in a separate cloud bucket (chongcheck-research-corpus), with separate access controls from production. It contains, for each completed consilium:

2.1 Pseudonyms

• hashed_owner_id — v1:<64-character hexadecimal> (HMAC-SHA256 of your user ID with a secret only we hold).
• hashed_pet_id — same construction.
• hashed_case_id — same construction.

Without the HMAC key, these strings are meaningless.

2.2 Bucketed pet attributes

• breed_slug (e.g., golden_retriever, domestic_shorthair).
• age_bucket (one of seven categories: 0-3mo, 3-6mo, 6-12mo, 12-24mo, 24-60mo, 60-120mo, 120-180mo).
• weight_bucket (one of seven categories: <5kg, 5-10kg, 10-15kg, 15-25kg, 25-40kg, 40-60kg, >60kg).
• country (ISO-2 country code, e.g., US, RU, DE).
• sex (one of male_intact, male_neutered, female_intact, female_spayed).

Notice what is not here: exact date of birth, exact weight, name, microchip ID, address.

2.3 Lab markers

For each marker submitted to the consilium:

• Marker code (ALT, AST, ALP, BUN, CREA, SDMA, etc. — 89 codes total);
• Numeric value;
• Unit of measurement;
• z-score (normalized against breed and age-band reference);
• Range flag (low, normal, high, critical_low, critical_high);
• Measurement quarter (e.g., 2026-Q2 — quarterly granularity, not exact date).

2.4 AI consilium outputs

• Each specialist's findings (text, redacted of any PII that slipped through Pass 1 and Pass 2);
• Each specialist's differential diagnoses with confidence scores;
• Each specialist's evidence citations;
• Chief's verdict, confidence, and synthesis;
• Cross-Validator agreement;
• Adversary findings (counter-arguments, biases flagged);
• Consensus Validator output (safety flags, policy decisions);
• Tokens in/out and latency per call;
• Total cost of the case in USD;
• Total duration in seconds;
• Policy (quick / standard / deep).

2.5 Real-world outcome (if you complete the Outcome Wizard)

• Whether you visited the vet (yes/no);
• Vet's diagnosis code(s) from our 66-code reference list, plus optional free-text (redacted twice);
• Severity reported by the vet (none / mild / moderate / severe / life_threatening);
• Treatment categories (monitoring_only / dietary_change / oral_medication / injectable / iv_fluids / hospitalization / surgery / other);
• 14-day outcome (fully_recovered / improving / same / worse / pet_passed);
• Your rating of ChongCheck's helpfulness (1-5);
• Your rating of ChongCheck's accuracy compared to the vet.

2.6 k-Anonymity snapshot

• k_anon_key (the combination of breed × age band × weight band × country);
• k_anon_safe (boolean — whether this record falls in a group of ≥5 at the time of writing).

---

3. What is NOT in the Research Corpus

We list this explicitly because trust depends on what we do not do.

The research corpus does not contain, in any form (raw, encoded, hashed, or transformed for reversibility):

• Your name, email, phone number, address, or any contact information;
• Your pet's name;
• Your pet's exact date of birth;
• Your pet's exact weight;
• Your IP address;
• Your device identifier or browser fingerprint;
• Cookies;
• Your photographs of your pet or any photos;
• Your raw scanned PDFs of lab reports;
• Your payment data, card number, billing address, or transaction history;
• Your free-text inputs (these go through two passes of redaction — regex Pass 1 over 19 PII categories, then LLM Pass 2 — before any portion enters the corpus);
• Audio recordings (if you used voice input);
• Any data about a human (the Service is for pets only; if a human medical detail is mistakenly submitted, it is redacted by our pipelines, never written to the corpus, and our staff are trained to escalate accidental human-data submissions for deletion).

---

4. How De-Identification Works

4.1 Pseudonymization of identifiers (HMAC-SHA256)

Your user ID, pet ID, and case ID are each transformed into a deterministic pseudonym of the form v<N>:<64-character lowercase hexadecimal> using HMAC-SHA256 with a 64-byte secret key. The key is:

• Stored in a dedicated secret-management vault (Doppler / Infisical / 1Password), never in environment variables, source code, container images, logs, or backups;
• Read only by the single service that writes to the corpus, only at application startup;
• Audit-logged on every read (a Sentry alert fires if it is read more than once per app boot);
• Not shared with any subprocessor;
• Not rotated by default. Rotation would invalidate joins between past and future records, so we rotate only on confirmed breach.

Per GDPR Recital 26, this qualifies as pseudonymization rather than full anonymization, which allows us to (a) respect your right to erasure of the pseudonymized record, while (b) using the Article 89 scientific-research exception for indefinite retention with valid consent.

4.2 Bucketing of attributes

We never store your pet's exact date of birth or exact weight in the corpus — only age band and weight band. This makes statistical comparison possible while breaking any "datapoint matches one specific pet" link.

4.3 Two-pass redaction of free text

• Pass 1 — Deterministic regex stripping over 19 categories of personal data. Each match is replaced with a neutral placeholder ([EMAIL], [PHONE], [NAME], etc.). Pass 1 is idempotent: applying it twice yields the same result.
• Pass 2 — LLM follow-up using Anthropic Claude Haiku. The redacted text is given to a small, fast model with the single instruction "find and redact any residual personal data missed by Pass 1." Pass 2 catches non-standard formats, contextual hints, and language quirks that regex misses.

The original text is discarded after Pass 2. Only the redacted variant enters the corpus.

4.4 k-Anonymity at export time

Before any aggregated report leaves our perimeter (e.g., a quarterly statistics report to a pharmaceutical partner), the export pipeline groups records by (breed × age band × weight band × country) and drops or coarsens any group with fewer than 5 records. The threshold rises to 10 before our first commercial DPA with a pharmaceutical partner.

This means a partner receives statements like "for Cocker Spaniels aged 60-120 months, ALT > 100 U/L was observed in 14.2% of cases in 2026-Q2 (n=327)," never "Cocker Spaniel, age 84 months, ALT = 128 — and here's their de-identified record."

---

5. Free Plan vs. Paid Plan — The Trade-Off Explained

5.1 Free Plan

The Free Plan exists because de-identified contributions allow us to keep improving the model and to defray operating costs through aggregated commercial reports. Data sharing is part of the Free Plan, consented to at signup. You will see a clearly labelled checkbox at registration explaining exactly what you are agreeing to, with a link to this Notice.

If you change your mind:

• To stop future contributions: Settings → Privacy → toggle off. Past pseudonymized data remains in the corpus under GDPR Art. 89.
• To remove past contributions too: Settings → Delete Account → choose "Full erasure including research contribution." All your pseudonymized rows are removed from the corpus within 30 days. Your account is also deleted (this is not an option to stay on the Free Plan minus the corpus).

If you want both privacy maximization and full features, the Paid Plan is the appropriate choice.

5.2 Paid Plan

On the Paid Plan, research-data sharing is fully opt-in and toggleable with no impact on features or pricing. We invite the contribution (it genuinely helps), but the Paid Plan does not require it.

This separation is intentional and ethical: free users contribute data; paying users buy features. Neither subsidizes the other under false pretenses.

---

6. Who Receives What

---

7. How Long We Keep Research Data

The audit log of erasure events is kept for 7 years (compliance requirement) but contains only deletion metadata, not the deleted records.

---

8. Inference vs. Training

ChongCheck uses external AI model providers (Anthropic, OpenAI, Google AI, Groq) for inference — i.e., running the consilium on your submitted data. Those calls are governed by per-provider Data Processing Agreements with zero or short retention configurations. Your data is not used by those providers to train their own models.

ChongCheck does train and fine-tune its own ancillary models (e.g., Bayesian breed-baseline, outcome predictor, readiness score) using the research corpus described in this Notice. Our own models stay within our infrastructure.

---

9. Your Controls

9.1 Initial signup

A clearly labelled checkbox at signup, with a link to this Notice and to the Privacy Policy. You can toggle the consent at that moment.

9.2 Ongoing settings

Settings → Privacy → toggles for:

• "Share de-identified data for research" — primary research-corpus toggle.
• "Email reminders about vet visits" — outcome wizard nudges.
• "Marketing emails" — newsletter (off by default).

Toggle changes are logged in our audit log (settings.consent.research_toggled event in PostHog and in our internal audit log).

9.3 Export

Settings → Export My Data → ZIP archive within 30 days, including a list of records held under your pseudonym in the research corpus.

9.4 Erasure

Settings → Delete Account → two scopes (personal-data-only / full erasure). 24-hour cancellation grace, 30-day SLA.

9.5 Per-case override

You can mark any individual case as "exclude from research" before submission (from the new-case screen). This excludes that single case from the corpus regardless of your general setting.

---

10. Changes to This Notice

Material changes — e.g., adding a new category of recipient, expanding what is included in the corpus, changing retention rules — are announced by email and in-app banner at least 30 days before they take effect. If a change expands the purposes of processing or the categories of recipients for already-collected data, we will obtain fresh consent (re-consent) rather than rely on the old one.

This Notice is versioned. Version history: chongcheck.app/legal/ai-research-notice/versions.

---

11. Legal Bases (for the technically inclined)

• Free Plan research sharing: GDPR Article 6(1)(a) — consent (signup checkbox), backed by Article 9(2)(a) for any sensitive data and Article 89 safeguards for pseudonymized research data.
• Paid Plan optional research sharing: same as above, but consent is independent of plan benefits.
• Pseudonymization technique: Article 4(5) GDPR; Recital 26.
• k-Anonymity export filter: Article 32 GDPR (security by design), Article 89 GDPR (research safeguards).
• Russian users: 152-FZ Articles 9 (consent), 10 (special categories), 11 (biometric — not applicable here).
• CCPA / CPRA: aggregated, de-identified data is exempt; no "sale" or "share" of personal information.

---

12. Contacts

• General questions: support@chongcheck.app
• Privacy & research: privacy@chongcheck.app
• Data Protection Officer: dpo@chongcheck.app
• Research partnerships: research@chongcheck.app

---

This Notice is a draft pending review by qualified counsel. The Privacy Policy and Terms of Service are the binding documents; this Notice expands and clarifies the AI-training and research-data sections of both.