Additional Disclosures
Contents
1. AI providers
Up to Speed's AI features fall into two groups. As uptospeed.health is configured today, both groups send data over the internet to OpenAI, which runs the model gpt-5.6-luna. Every AI call is logged to your private audit trail inside Up to Speed (Section 4), with the exact payload, so you can see what was sent and what came back.
1.1 Everyday text features
Plain-language explanations of lab tests and imaging reports. Each of these runs only when you press its button. Until recently they ran on an open-weights model hosted on the same machine as the rest of the application. They now go to OpenAI as well.
What gets sent: the one thing you asked about. For a lab explanation, the test's name, unit and reference range, and not your own results. For an imaging explanation, the text of that radiology report plus the age and diagnosis.
1.2 Clinical-style review
Lab reviews, rounds preparation, methotrexate clearance checks, lab threshold suggestions, pathology and imaging findings extraction, and echo trend reviews. Most of these wait for a button press. Two do not: the lab review runs when new results arrive, and the imaging findings extraction runs when a new radiology report arrives.
What gets sent: a curated subset of your data tailored to the task. For a lab review, that's the lab panel itself, recent prior values for the same tests, your patient summary (diagnosis, current treatment phase), and active medications. Up to Speed never sends your full record, your raw FHIR resources, or anything not directly needed for the specific task. These prompts are written to leave the patient's name out and to send the age in whole years rather than a date of birth. Free text you have typed is sent exactly as you wrote it. The full payload is visible to you in the audit trail.
1.3 What OpenAI does with it, and what we cannot promise
Up to Speed marks every request to OpenAI store: false, which asks OpenAI not to keep the request on the account and not to use it to improve their models. Under OpenAI's standard API terms, what Up to Speed sends may still be held for roughly 30 days for abuse monitoring before deletion. There is no Data Processing Agreement and no zero-retention arrangement behind that, and Up to Speed cannot verify or enforce it on your behalf. Anything that must never leave your record should not be put through an AI feature at all.
An Up to Speed server can run its AI on the server itself. The operator can point either group at a local model, and then nothing is sent to OpenAI. uptospeed.health is not run that way today. The privacy page inside the application, at app.uptospeed.health/privacy, always describes the configuration actually in force, and it governs wherever the two pages differ.
The provider can change. We may swap or add hosted AI providers as the clinical-AI landscape evolves. If we change providers, we will update this page before the change goes live and notify connected users by email.
2. Optional outbound integrations
The integrations below are off by default. You enable them in Settings and can disconnect at any time.
2.1 Google Calendar (one-way sync)
When enabled, Up to Speed writes a feed of your appointments, treatment cycles, infusion days, and hospital stays to a dedicated Google calendar you select during setup.
What we request from Google: the narrowest OAuth scope that lets us create and update events on the calendar you pick, and nothing covering the rest of your Google account. Up to Speed cannot read your other calendars, your Gmail, your Drive, or any other Google data. The integration is write-only from Up to Speed's perspective; nothing in your Up to Speed record updates when you edit the event in Google.
What gets sent to Google: the event title (e.g., "Oncology clinic visit"), start and end times, the treatment phase or cycle name where applicable, and a link back to the relevant Up to Speed page. Lab results, medication doses, vital signs, and notes are never written to Google Calendar.
Disabling: turn the integration off in Settings to stop new writes. Existing events stay on your Google calendar until you delete them there.
2.2 Web push notifications
When enabled, Up to Speed can deliver push notifications to your phone or desktop when a new lab draw lands and when an AI review is ready.
How they're delivered: Up to Speed uses the standard Web Push protocol with VAPID authentication. The push payload routes through your browser vendor's push service: Apple Push Notification service, Google Firebase Cloud Messaging, or Mozilla AutoPush, depending on which browser and operating system you use.
What's in the payload: a short, generic message ("New lab results are in" or "AI review ready") plus a link that opens Up to Speed. No clinical detail is ever included in the push payload: no lab values, no diagnoses, no medication names, so the push services that route the notification cannot see your health data.
Disabling: turn notifications off in Up to Speed's Settings, or block them in your browser. Either stops new pushes immediately.
3. Third parties involved in your data flow
Different parties play different roles when you use Up to Speed. Some are vendors we engage to deliver the service. Others are services you already use, where Up to Speed acts on your behalf with your authorization. Others are the sources of your record. They're worth separating because the relationship determines what protections apply.
3.1 Subprocessors
Vendors we engage to deliver the Up to Speed service. We have agreements with each governing how they handle data on our behalf.
| Vendor | Role | What they see |
|---|---|---|
| Cloudflare | Edge proxy, TLS termination, and DNS for uptospeed.health | Encrypted TLS traffic and request metadata (IP, path, status, timestamp). They cannot decrypt the traffic. |
| DigitalOcean | Hosting. The server and its database run on a virtual machine they provide. | They hold the machine and its disk. Connection tokens, portal credentials and other sensitive fields are encrypted at the application layer on top of that, and DigitalOcean never receives a copy of anything on purpose, but a hosting provider with the disk is not shut out the way a network proxy is. |
| OpenAI | Every AI feature (see Section 1) | Only the payload each task sends. Not your full record. Held for roughly 30 days for abuse monitoring under their standard API terms. |
| Resend | Transactional email (invites, sign-in and account mail, admin notices). | Your email address and the subject and body of each message Up to Speed sends you. Up to Speed never emails lab values or other clinical detail. |
Up to Speed is run by its operator on a rented virtual machine rather than on a managed platform, and none of the vendors above is deliberately given access to the application or the data inside it. What each one necessarily sees in the course of its job is the column above.
3.2 User-authorized integrations
Services you have your own account with, where Up to Speed acts as a client on your behalf after you authorize it in Settings. Up to Speed is not the controller of the data on the third party's side, so their privacy policy governs what they do with it.
| Service | Role | What flows when enabled |
|---|---|---|
| Google (Calendar) | You authorize Up to Speed to write events to a dedicated Google calendar in your Google account (see Section 2.1) | Event titles, start/end times, treatment phase or cycle names, and a link back to Up to Speed. No clinical detail. Up to Speed writes only; never reads from Google. |
| Apple, Google FCM, Mozilla AutoPush (Web Push) | The push service your browser vendor runs to deliver browser notifications to your device (see Section 2.2) | A short generic message ("New lab results are in") and a link back to Up to Speed. Never any clinical detail. |
3.3 Source of your medical record
Your hospital is the controller of your medical record. Epic Systems is the EHR vendor whose software your hospital runs. When you authorize the connection through SMART on FHIR, Up to Speed becomes a downstream reader of your hospital's chart. Your hospital's privacy practices apply on their side, and Up to Speed's apply to the copy of the data we receive.
4. Your audit trail
Every AI call Up to Speed makes on your data is recorded to an append-only audit log visible inside the application. Each entry includes the AI task name, the provider and model, the exact input snapshot sent, the output returned, and the timestamp. You can see what was sent and when, the same way an enterprise compliance team would.
This audit is per-account and private to you (and any caregiver you've granted access through Up to Speed's sharing feature). Up to Speed does not aggregate audit data across users for any purpose.
5. What we never share
- We do not sell your data, ever, to anyone.
- We do not share or license your data to data brokers, marketing platforms, or advertising networks.
- We do not use your data to train any AI model, and every request Up to Speed sends asks the AI provider not to either (see Section 1.3 for what that does and does not cover).
- We do not include health information in push notification payloads, email content, or any third-party-visible URL.
- We use Google Analytics on uptospeed.health and the application (see the privacy policy for what it sees). We do not embed any advertising, session-replay, or social-media trackers in the Service.
- We do not share data between Up to Speed user accounts. Each account's data is isolated; the only cross-account sharing happens when you explicitly invite a caregiver through Up to Speed's sharing feature.
6. Updates to this page
We will update this page when our integrations or subprocessors change, for example if we swap AI providers or add a new optional integration. Material changes are announced by email to connected users at least 30 days before they take effect. The "Last updated" date at the top reflects the most recent revision.
7. Contact
If anything on this page is unclear, surprising, or seems incomplete, please tell us:
Privacy questions: privacy@uptospeed.health
Security questions: security@uptospeed.health
General support: support@uptospeed.health