Privacy

What Up to Speed holds about your family, and who else ever sees it. Last updated September 5, 2026.

The short version

  • Up to Speed is a private record-keeper, not a hospital system. It is not covered by HIPAA.
  • The AI features that read medical records send medical details to OpenAI. Read the details below before you connect MyChart.
  • The other AI features, meaning plain-language explanations, send what you ask them about to OpenAI too. They used to run on this machine; they no longer do.
  • Nothing is sold and there is no advertising. Google Analytics does run on these pages, and below is exactly what it sees.
  • Anyone you invite can see the records you share with them. Whoever runs this server can see everything, and the hosting company it is rented from holds the disk it all sits on.

What Up to Speed stores

  • Everything Up to Speed pulls from your hospital's MyChart when you connect it: lab results, medications, appointments, diagnoses, allergies, immunizations, visit and report text. The original record is kept as well as the tidied-up version.
  • Anything you type in: notes, symptoms, tasks, questions for the team, remarks about the patient.
  • Files you upload: documents and pathology reports.
  • Your account: name, email address, a hashed password (never the password itself), and, if you were invited, the address the invite went to and when it was used.
  • If you request an invite: your name, email address, your relationship to the patient, the hospital or health system you named, whether you use MyChart, and the network address the request came from. Nothing else is asked for, and no account or password exists until an invite is accepted.
  • If you pay for a plan: which plan it is, when your trial ends, the date a cancelled plan is due to stop, the date any months a friend gave you run out, and the customer, subscription and status identifiers Stripe sends back. No card details, which never reach this server.
  • If you buy a gift for a family: your name and email address, the name and email address of the person you are sending it to, the note you wrote them, how many months it is for, what it cost, the checkout and payment identifiers Stripe sends back, and the network address the form was submitted from. You do not need an account to buy one, and no account is made for you.
  • Access tokens for services you connect. These are encrypted in the database.

Who can see it

  • You, and anyone you invite. You choose their access level, and you can remove them at any time from the Sharing page.
  • Whoever operates this server. Up to Speed is self-hosted. The person or family running it has full database access, and there is no technical wall between them and your records. If you did not set this server up yourself, only use it if you trust the person who did. Each invite request is emailed to whoever approves them, so it can be read between hospital visits. The address you give gets one confirmation, and hears from us again only if we can offer a place.
  • Whoever a gift is sent to. If somebody buys your family a gift, the note they wrote is shown to whoever opens the link, and after it is opened it stays visible to the person who set that household up. Whoever operates this server can read it too, in the admin pages, alongside both names and both addresses. The giver's email address is never shown to the person receiving the gift.
  • The companies listed below, for the specific features described.

Where data goes outside this server

OpenAI: AI review of medical information

These features work by sending your child's medical details over the internet to OpenAI, which runs the model gpt-5.6-luna. They run automatically or on a button press, as noted.

Lab review (runs automatically when new labs arrive)
Age in years, diagnosis, current treatment cycle, and the names, values, units, reference ranges, abnormal flags and collection dates of the labs in the last 48 hours.
Rounds prep and rounds notes (on a button press)
The above, plus active medication names, recent symptoms, vitals, the text of notes you have written, the current admission’s unit and reason, which clinics you have appointments at, and open follow-up tasks. Names are deliberately left out: not the patient’s, and not any clinician you recorded a quote from or have an appointment with.
Methotrexate clearance review (on a button press)
Methotrexate levels and their timing, plus kidney and liver labs from the same infusion window.
Lab threshold suggestions (on a button press)
One lab's name, unit and normal range, and the treatment plan, meaning phase names and any protocol reference you recorded.
Pathology extraction (on a button press)
The full text of the pathology report you uploaded, as written.
Imaging findings extraction (runs automatically when new radiology reports arrive)
The full text of the radiology report, as the radiologist wrote it, plus the age and diagnosis, so the findings, measurements and follow-up recommendations can be pulled out of it as data.
Echo trend review (on a button press)
Echocardiogram measurements over time and the treatment cycles they sit alongside.

Not sent: the patient's name, their date of birth (only the age in whole years is derived from it), medical record number, insurance member ID, your email address or your password.

But note: free text is sent exactly as you wrote it. If you type a name, an address or a phone number into a note, a symptom or the remarks field, it goes along with everything else.

What we cannot promise about that

There is no Data Processing Agreement and no zero-retention arrangement in place with OpenAI. Under their standard API terms, what Up to Speed sends is retained for roughly 30 days for abuse monitoring before deletion. Up to Speed cannot verify or enforce that on your behalf.

Up to Speed does mark every request to OpenAI store: false, which asks them not to keep the request on the account or use it to improve their models. That is worth having, and it is not the same as the information staying here: it is still sent over the internet, still read on their servers, and still held for the abuse-monitoring window above. Anything that must never leave this machine must not be put through an AI feature at all.

If that is not acceptable to you, the AI features are optional. Only two run without you pressing a button: the lab review when new results arrive, and the findings extraction when a new radiology report arrives. Neither runs at all unless the operator has configured an API key. Ask whoever runs this server to switch the AI to the local model (AI_MEDICAL_PROVIDER and AI_GENERAL_PROVIDER), or to leave the key unset.

OpenAI: the other AI features

These used to run on a model on this machine. They now go over the internet to OpenAI as well, which runs the model gpt-5.6-luna. None of them run on their own. Each one happens when you press its button.

Plain-language explanation of a lab test
The test itself: its name, unit and reference range. Not your child's own results: this explains what the test is, not what theirs said.
Plain-language explanation of an imaging report
The full text of that radiology report, as the radiologist wrote it, plus the age and diagnosis.

Note the names: the medical features above are written to leave the patient's name out. The same caution as above applies to everything you type: it is sent as you wrote it.

Your hospital's MyChart (Epic)

Optional. If you connect it, you sign in on your hospital's own website, where Up to Speed never sees your MyChart password, and grant read-only access to your records. Up to Speed only reads; it can never write anything back to your chart. The access tokens are encrypted in the database. Disconnecting from the Epic connection page stops it.

Sign in with Google

Optional. Email and password still work, and always will. If you use it, Up to Speed asks Google only for your name, your email address and an account identifier. It gets no access to your Gmail, Drive, contacts or calendar. Google learns that you signed in to Up to Speed, and when. Signing in with Google is separate from Calendar sync below: using one never connects the other. You can switch to an email and password at any time using the password-reset link.

Google Calendar

Optional and off by default. If you connect it, Up to Speed creates a calendar in your Google account and pushes appointments, hospital stays and treatment cycles to it, one way only, Up to Speed to Google. Google then sees those event titles, dates and times. The tokens are encrypted. Disconnect from Settings.

Stripe: the plan and the card

Paying for a plan goes through Stripe. They get the account holder's name and email address and the card details, which are typed on Stripe's own page. A card number never reaches this server, and Up to Speed cannot store one. Nothing about any patient is sent to Stripe: no name, no diagnosis, no results, no notes, not even how many records the household holds.

What Up to Speed keeps in return is only Stripe's own identifiers: a customer id, a subscription id and the status they last reported (active, past due, cancelled), alongside which plan it is, when the trial ends, and, if you cancel, the date the plan is due to stop. If a friend gave your household months of Premium, the date those run out is kept beside all of that. It comes from the gift, not from Stripe.

Buying a gift for another family goes through Stripe the same way. They get the giver's name and email address and the card, typed on Stripe's own page as ever. Nothing about the person receiving it is sent to Stripe: not their name, not their email address, not the note. The line being paid for says how many months of Up to Speed Premium the gift is, and the only reference Stripe holds is Up to Speed's own number for that gift.

A plan that lapses never deletes anything. The record becomes read-only: MyChart sync pauses, the AI features switch off and any assistant you connected loses access, but everything already recorded stays, stays readable by everyone it is shared with, and can still be exported in full.

Assistants you connect (MCP)

Optional, off by default, and part of the Premium plan. A household on Standard, or with no active plan, cannot connect one. Up to Speed can act as an MCP server (Model Context Protocol, the standard an AI assistant uses to reach an outside source of information). If you choose to use it, you connect an assistant you already use, whether that is Claude on the web, desktop or phone, Claude Code, ChatGPT, or anything else that speaks MCP, to your own Up to Speed record, and ask it questions about what is in there.

A connected assistant is read-only. It can read the record; it cannot add, change or delete anything in it. Up to Speed runs none of its own AI features on the assistant's behalf and sends nothing to anyone for it, so a connection never uses your household's AI allowance. The assistant reads through the connection itself, and what it does with what it reads is governed by that assistant's own terms and privacy policy, not by this one. Nobody has to connect one, and nothing about Up to Speed changes if you never do.

What it can read: what you yourself can see in Up to Speed, for the patients you ticked when you connected it, so a viewer's assistant sees what a viewer sees, and a teenager's sees only the sections their membership was given. What it can never read: the stored credentials for services you have connected (MyChart and Google), invite links nobody has used yet, the raw hospital data Up to Speed keeps behind the tidied-up version, the files you uploaded, or anybody else's patients.

Up to Speed keeps a log of what a connected assistant asked for: which tool, which patient, when, and whether it worked. What came back is never logged. You can revoke any assistant instantly from your assistants page, and an owner removing someone's access to a record cuts off every assistant that person connected, for that record, at the same moment.

Google Analytics

Google Analytics runs on every page of this app, including pages that display medical records. It is not optional and there is currently no way to turn it off from inside Up to Speed.

It reports to Google which page you were on, the page you came from, your approximate location from your IP address, and details about your browser and device. It does not send the contents of your records: no lab values, no notes, no names. But the page address itself is sent, and some Up to Speed addresses contain record numbers (for example the id of a lab or a document), so Google can infer that a record was viewed and when, even though it never learns what the record says.

Besides page views, Up to Speed reports a handful of named actions to Google Analytics: asking for an invite, creating an account from an invite link, viewing the plans, and starting or completing a checkout, whether that checkout is for your own plan or for a gift you are buying somebody. A completed checkout is reported with the plan or the length of the gift, the amount paid and Stripe's checkout reference, which is an opaque id and not a card or account number. None of these events carry a name, an email address, a record, the note written on a gift, or anything you typed into Up to Speed.

A browser extension that blocks trackers, or your browser's "block third-party scripts" setting, will stop it. Nothing about Up to Speed depends on it working.

Cloudflare

Cloudflare sits in front of this site to handle traffic and HTTPS. It sees the usual things a network provider sees: your IP address, which pages you requested, and when. It does not see anything inside your records beyond that.

DigitalOcean

This server and the database underneath it both run on a virtual machine DigitalOcean rents out, so they hold the machine and the disk everything is written to. Connection tokens, portal credentials and other sensitive fields are encrypted by Up to Speed before they reach that disk, and nothing is sent to DigitalOcean on purpose. A hosting company holding the disk is still not shut out the way a network provider is, so count it as one more place your records physically sit.

Resend

Up to Speed sends its email through Resend: invites, sign-in and account mail, the notices that go to whoever approves sign-up requests, and everything to do with a gift. A gift sends one message to the person it was bought for, carrying the giver's name and their note, a receipt and a later "they opened it" note to whoever bought it, and, as the gifted months run down, the same two reminders a trial gets. Resend sees your email address, and the subject and body of every message Up to Speed sends you. Up to Speed never puts lab values or any other clinical detail in an email, so what passes through Resend is account mail and nothing out of the record itself.

Security, honestly stated

  • Traffic is over HTTPS. Connection tokens and portal credentials are encrypted at rest.
  • Passwords are stored hashed, never in readable form.
  • There is no advertising and no third-party error-reporting service in this app. Google Analytics is the one third-party script that loads, and it is described under “Where data goes outside this server” above.
  • Up to Speed has not had an independent security audit, and it is maintained by a very small number of people. Judge it accordingly.

How long we keep it

A declined invite request is deleted 30 days after the decision; an approved one 30 days after approval, once its invite is no longer open. After that only the invitation record itself is kept, for as long as that account exists: which address was invited, and which account it became. Invites nobody used are deleted 90 days after they expire. Deleting your account deletes the invitation record and any request for your address with it.

A gift nobody paid for is deleted after a day, so an abandoned form does not leave two people's names and addresses sitting here. A gift somebody did pay for is kept as the record of that purchase. While it is unopened it is kept for as long as it stays unopened, because whoever bought it can ask for their money back at any time and the link has to keep working until they do. Once it has been opened it is kept for as long as the household it landed on exists. A refund is written onto the same record rather than deleting it.

Paying for a gift for an address with no Up to Speed account also creates an invitation for that address, the same kind described above, and that one does not expire: the gift was paid for, and nobody should lose it because a fortnight went by. It is not among the invites deleted after 90 days. The recipient's account exists only once they use it.

For assistants you connect: the log of what an assistant asked for is kept for 90 days and then deleted. An assistant connection you revoke is deleted 30 days after you revoke it, and the access tokens behind a connection are deleted the day after they expire. A client registration an assistant creates for itself but never uses to connect is deleted after 30 days.

What Up to Speed is not

Up to Speed is not a medical device, not a clinical system of record, and not a substitute for your care team. Nothing in it is medical advice, including anything an AI feature writes.

Up to Speed is also not a HIPAA-covered service. It is a personal tool, not a healthcare provider, health plan or business associate, so the protections you get from your hospital's patient portal do not apply here.

See the terms for more.

Your choices

  • Disconnect MyChart or Google Calendar at any time from their pages.
  • Revoke any AI assistant you have connected, at any time, from your assistants page.
  • If you signed in with Google, you can set a password instead using the password-reset link.
  • Delete individual records, and remove anyone you have invited, from the Sharing page.
  • To have your account and its records deleted entirely, ask the operator (see below).
  • Change your mind about a request before it’s decided? Write to the address below and it will be deleted.

Questions

Write to [email protected], or see about Up to Speed.