Introduction
Welcome to HYMS Max. VijayRenga LLC ("we", "us") respects your privacy and the privacy of your
patients. This policy explains what HYMS Max, our clinical documentation and strength assessment application for iPhone, iPad and Android, does with information, and what
leaves your device.
The Short Version
- Audio never leaves your device. Recording and speech-to-text run on your phone.
Recordings are deleted from your device automatically after 7 days.
- Your patient data stays on your device. HYMS Max does not use iCloud or any
cloud backup or sync for your records.
- Claude is the default AI for writing notes. After you agree once, the text of
the visit transcript and the details you entered are sent over an encrypted connection to
our AI service on Amazon Web Services. We do not log or store that text. You can switch to
on-device AI at any time and nothing is sent.
- We keep very little: a device or subscription identifier and usage counts, so
we can run the free trial and monthly limits. See “What Our AI Service Keeps” below.
- We do not sell your data, and HYMS Max has no advertising or third-party analytics.
Information on Your Device
- Audio recordings: recorded and transcribed on your device. Audio is never
uploaded to us or to any AI service. Recordings are removed automatically after 7 days;
transcripts and notes are kept until you delete them.
- Clinical content: strength assessments, notes, transcripts and patient records are stored only in the app’s private storage on your device.
We cannot see them. Cloud backup is turned off for the app, so your records are not copied
to iCloud or Google backup.
- Secrets: any credentials you enter for optional features are kept in your
device’s secure storage and are not synced.
How AI Note Writing Works
Claude (the default)
When Claude writes a note, HYMS Max sends the AI service:
- the text transcript of your visit (created on your device),
- the clinical details you entered for that note, and your note instructions or template.
It does not send audio, and it does not send your name, email or contact details.
Please follow the best practice below and avoid typing direct patient identifiers.
The request goes over HTTPS (TLS) to a service we run on Amazon Web Services in the United States
(US East, Ohio). The service passes it to Claude, a model by Anthropic, through Amazon Bedrock, and
returns the note to your device. We do not log or store the transcript or the note.
According to AWS documentation, Amazon Bedrock does not store your prompts or responses, does not use
them to train models, and does not share them with the model provider.
On-device AI
You can choose on-device AI instead. On iPhone and iPad this is Apple’s on-device model; on Android
it is a model that runs on your phone. On-device AI writes a standard SOAP note, works offline, and
sends no audio or text anywhere.
Model downloads
The app may download speech and AI model files (for example from Hugging Face or GitHub) the first
time you use a feature. These downloads are ordinary file requests and do not include your data.
Your Consent and Choices
- One-time consent: before any text is sent to Claude, the app asks you to allow it.
If you decline, notes are written on-device and nothing is sent.
- Change your mind any time: turn Claude off, or switch to on-device AI, in the
app’s Settings or model menu. Nothing is sent after you do.
- Free trial: your first 2 Claude notes are free (once per device). After that,
notes use on-device AI until you subscribe.
- Subscription: HYMS Max Pro unlocks Claude for every note format and the Pro-only
tools. Monthly fair-use limits apply to Claude.
What Our AI Service Keeps
To run the free trial, check subscriptions and stop abuse, the service keeps only:
- An identifier: a random device identifier (on Android, derived from the Android ID)
for free-trial users, or your App Store / Google Play subscription identifier for subscribers.
- Usage counts: how many requests and how much AI usage per day and per month, and
whether the free trial has been used. The free-trial record is kept so the trial can be used
only once.
- A one-way hash of your network address, kept for a few days, to limit abuse.
- Operational logs (an abbreviated identifier, the type of request, amounts of AI
usage and timing), kept for up to 30 days. These contain no transcripts or notes.
- Subscription checks: we send your Apple signed transaction or Google Play
purchase token to Apple or Google to confirm that your subscription is active.
None of this is used for advertising or sold.
Where Cloud AI Is Not Offered
In mainland China, HYMS Max uses on-device AI only. Claude and our AI service are not available there,
and the app sends nothing to them.
Optional Features You Control
These send data only when you start them, to services you choose. Their own privacy policies apply,
and you are responsible for having the right agreements (for example a Business Associate
Agreement) with them:
- Export features: when you choose to export or send a note (for example to Microsoft OneNote), the note is sent to the destination you select.
How We Use Information
- To write the notes you ask for and run the features you use
- To verify subscriptions and run the free trial and fair-use limits
- To prevent abuse and keep the service secure
- To respond to support requests
Data Storage and Security
- On your device: your clinical content is stored locally, protected by your
device’s encryption and passcode.
- In transit: everything sent to our AI service uses HTTPS (TLS).
- On our service: only the small records described above. We do not store patient
records, recordings or notes.
HIPAA Considerations
HYMS Max is a documentation tool. We do not claim that using it makes you HIPAA compliant; you are
responsible for using it in line with HIPAA and your organization’s policies.
- With on-device AI, protected health information (PHI) stays on your device.
- Our AI service runs on Amazon Web Services under an AWS Business Associate Agreement and uses
HTTPS. We do not log or store the text you send.
- If your organization needs a Business Associate Agreement for the cloud AI features, please
contact us before using them with patient information.
Third-Party Services
- Amazon Web Services (Lambda, DynamoDB, Amazon Bedrock): hosts our AI service
(AWS Privacy Notice).
- Anthropic (Claude, accessed through Amazon Bedrock)
(Anthropic Privacy Policy).
- Apple (StoreKit purchases and on-device AI on iPhone and iPad)
(Apple Privacy Policy).
- Google Play (billing and subscriptions on Android)
(Google Privacy Policy).
- Microsoft (OneNote) or other export destinations: only if you use them. They are independent services with their own privacy policies.
Data Sharing
We do not sell, trade or rent your personal information or patient data. The only parties that handle
the text of a note are the AWS service and Claude, acting on our behalf to write that note, and only
after you have agreed. We may disclose information if the law requires it.
Subscriptions
HYMS Max Pro is a monthly auto-renewable subscription sold through the App Store or Google Play. The
price is shown in the store before you buy. Payment is charged to your store account at
confirmation, and the subscription renews automatically unless you cancel at least 24 hours
before the end of the current period. Manage or cancel it in your App Store or Google Play account
settings.
Best Practice for Privacy
When using Claude, we recommend using only the device-generated Subject ID and the patient’s age
as identifiers. Avoid typing real names, dates of birth, medical record numbers or other direct
identifiers into dictations or notes. This minimizes the personal information in anything that
is sent.
Your Rights and Choices
- Access and delete your records: your clinical data is on your device, where you can
view, export or delete it, or remove it all by uninstalling the app.
- Choose your AI: use on-device AI or Claude at any time.
- Cancel your subscription at any time in the App Store or Google Play.
- Ask us: to see or delete the identifier and usage records our service holds
for you, email info@vijayrenga.com. Deleting a
free-trial record means that device can use the free trial again.
Data Retention
- Audio recordings: deleted from your device after 7 days.
- Notes, transcripts and records: kept on your device until you delete them or
uninstall the app.
- Our service: usage counts for a limited period (about 100 days), the free-trial
record for as long as needed to enforce the one-time trial, abuse-limiting records for a few
days, and operational logs for up to 30 days.
- Purchase history: kept by Apple or Google under their policies.
Children’s Privacy
HYMS Max is intended for licensed healthcare professionals and is not directed to children under 13. We do
not knowingly collect personal information from children under 13.
International Users
HYMS Max can be used worldwide. Your clinical data stays on your device. If you use Claude, the text of
the note request is processed in the United States. Cloud AI is not offered in mainland China.
California Privacy Rights
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):
- Right to know what personal information is collected (described above)
- Right to delete personal information
- Right to opt out of the sale of personal information (we do not sell personal information)
European Privacy Rights
If you are in the European Economic Area, you have rights under the General Data Protection
Regulation (GDPR): access, rectification, erasure, restriction, portability and objection. Your
clinical content is on your device, under your control. For the limited identifier and usage records
our service holds, contact us at the address below to exercise these rights. When you use Claude,
data is transferred to the United States.
Changes to This Policy
We may update this policy from time to time. We will tell you about significant changes through the
app or an app-store update, and the effective date above shows when it was last revised.
Contact Us
If you have questions or requests about this policy, contact us:
Your Consent
By using HYMS Max, you agree to this privacy policy. Sending text to Claude additionally requires the
separate consent described above.
Compliance
This policy is written to follow:
- Apple App Store and Google Play policies
- General Data Protection Regulation (GDPR)
- California Consumer Privacy Act (CCPA)
- Children’s Online Privacy Protection Act (COPPA)