1. The Zero-Retention & Privacy-First Manifesto

MedicoQZ was founded upon a core clinical conviction: medical documentation, clinical analysis, and healthcare research must be entirely sovereign to the practitioner. In an era where clinical data is routinely mined, packaged, and monetized, MedicoQZ operates under an absolute, technologically enforced zero-retention architecture.

Unlike traditional Software-as-a-Service (SaaS) medical utilities, MedicoQZ does not maintain application databases, user profiles, server-side indexing nodes, or persistence layers. The platform acts as a passive, transient processing utility. When you load files, analyze clinical drafts, or synthesize patient-facing documentation, all compute tasks run directly in your local browser sandbox.

1.1 Absolute Guarantees

• No Server-Side Interception: We do not operate secondary parsing databases. Your uploads are never cached on our web servers.
• No User Account Profiling: We do not ask for, collect, or store personal identifiers, email addresses, professional credentials, or institutional affiliations.
• No Telemetry Selling: We do not partner with pharmaceutical brokers, insurance entities, or third-party academic aggregators. No metrics leave your device except direct, secure API calls required to synthesize text.

2. Client-Side Architecture & Local Storage Sandboxing

The architectural security of MedicoQZ relies on the isolative properties of modern browser sandboxing. Understanding how your data traverses your device is essential to verifying our zero-data footprint posture.

When a manuscript, research note, or clinical summary is uploaded via the interface, the file is processed strictly via your browser's File API. The binary payload is translated into memory strings inside your local runtime context. It is never transferred to intermediate "helper" nodes or background indexers.

2.1 Use of Browser Storage

MedicoQZ utilizes client-side storage mechanisms (such as localStorage or local session memory) strictly to preserve user settings. The API key supplied in the Settings tab, along with your preferred output style (e.g., Short, Extensive, Indepth) and tone parameters, remain local to your browser profile. These strings can be wiped permanently at any point by clearing your browser cache or executing a browser storage reset.

3. Third-Party API Transmissions & Owlly AI Gateway Security

To compile complicated clinical workflows, generate formatted charts, and evaluate scientific notation, MedicoQZ links client-side requests with large language models powered by Owlly AI. Your data path during synthesis is direct and secured via standard transport encryption protocols.

When you input your API key and execute a generation command, your browser establishes a secure, TLS-encrypted connection directly with the Owlly AI secure API endpoint. There is no middleman. Your request bypasses MedicoQZ entirely, sending the document text and selected formatting variables directly to Owlly AI's high-speed inference engines.

3.1 API Key Sovereignty

Our Owlly AI API key acts as an authorization token that is stored securely within your browser session. At no point is the API key transmitted to any server controlled by MedicoQZ. Users retain total sovereignty over their information; you can revoke, modify, or rotate files instantly via your browser's console, guaranteeing complete access control over your infrastructure usage.

3.2 Zero-Data Preservation Protocols

Because MedicoQZ links users directly to their API providers, the data handling of the underlying AI models falls under the developer terms of your chosen provider. When using Owlly AI with specialized medical parameters, data payloads are processed over encrypted channels and are subject to commercial API policies that typically guarantee zero-training retention over enterprise calls.

4. GDPR (General Data Protection Regulation) Compliance Framework

For practitioners and researchers operating within the European Economic Area (EEA), MedicoQZ aligns completely with the strict mandates established by the General Data Protection Regulation (Regulation EU 2016/679).

Because MedicoQZ does not collect, index, transfer, or maintain personal data, the platform is inherently compliant with the fundamental tenets of GDPR through Data Protection by Design and by Default (Article 25).

4.1 Data Processor vs. Data Controller Roles

Under GDPR definitions, the practitioner utilizing MedicoQZ remains the sole **Data Controller** of all clinical inputs, maintaining absolute authority over how data is processed and generated. MedicoQZ does not act as a **Data Processor** since we do not process personal data on our servers. Your local browser environment acts as your secure workstation.

5. HIPAA Equivalency, Cookieless Operation, & Independent Auditing

In the United States, patient clinical documentation is protected under the Health Insurance Portability and Accountability Act (HIPAA). MedicoQZ’s client-side runtime model guarantees that Protected Health Information (PHI) is never uploaded, stored, or processed by an unauthorized third-party SaaS host.

Because all analysis remains in your local system sandbox, using MedicoQZ to compile, format, and structure clinical notes does not result in the exposure, leakage, or external warehousing of PHI. It represents the equivalent of typing notes in a local, air-gapped text editor, ensuring compliance with local HIPAA rules.

5.1 Cookieless Workspace Architecture

We reject tracking mechanisms. MedicoQZ does not use tracking cookies, analytics pixels, browser fingerprinting scripts, or session recording utilities (such as Hotjar or Microsoft Clarity). Your clinical environment is a clean slate, shielded from commercial trackers, data profiling, and visual session logging.

5.2 Independent Verification & Auditable Code

Trust in clinical tools must be absolute. To verify these claims, MedicoQZ is built as an open, auditable front-end platform. All source code running in your browser is fully readable and inspectable via standard developer tools. Practitioners are encouraged to open their browser consoles (F12) to inspect active network requests and confirm that no analytical or telemetry pings are transmitted to MedicoQZ servers during any phase of generation.