For GMTek AI products — including Chartwright (clinical documentation for human medicine) and VetWright (veterinary documentation). Written so doctors and compliance officers can read it once and know where they stand.
GMTek AI is a sole proprietorship operated by Joshua Moody from Whidbey Island, Washington, USA. We build small, focused software products. There is one person making decisions about your data — and you can email him at josh@gmtek.ai.
This policy covers our marketing site (gmtek.ai) and our paid products, including Chartwright (clinical documentation for licensed physicians) and VetWright (veterinary documentation for licensed veterinarians). Both products run on the customer's own machine.
Chartwright and VetWright are local-first desktop applications. They install on the clinician's laptop and serve a browser interface at localhost:7432. The customer pastes (or dictates) chart text and the software returns an AI-generated documentation draft.
The software talks to a chat model in one of two ways:
From paying customers, our license server records a small, specific set of operational data:
From visitors to gmtek.ai, we collect standard Cloudflare Pages access logs (IP address, referrer, user-agent, requested path, timestamp). These logs are aggregated for analytics and anti-abuse only. We do not run third-party analytics scripts on the marketing site.
This list is the point of the whole product. We are deliberate about it.
GMTek AI is not a HIPAA covered entity and is not your business associate. We do not handle PHI. We do not sign Business Associate Agreements (BAAs). The product architecture is the reason: PHI never enters our systems.
If you are a covered entity using Chartwright with a cloud provider (Anthropic Claude or OpenAI GPT) for charts containing real PHI, the BAA you need is the one between you and that provider. Both Anthropic and OpenAI offer BAAs to qualifying customers. Chartwright's job is to make the request architecture clean enough that the BAA you sign with them is the only BAA you need.
If you use Chartwright with a local Ollama model, no BAA is needed — there is no third party involved. The chart never leaves your hardware.
The de-identifier preprocessor (Safe Harbor stripper for the 18 HIPAA identifiers) that runs before any cloud request is defense-in-depth, not a substitute for a BAA. We say this clearly inside the product, too.
We never see your charts. If you use a cloud LLM, your BAA is with that LLM vendor. If you use Ollama, you don't need a BAA at all. We are not in the privileged-data path either way.
License and install records are retained while your subscription is active. After cancellation, we retain billing-adjacent records for seven (7) years to comply with US tax and accounting recordkeeping rules, then delete them.
Cloudflare access logs roll off on Cloudflare's standard retention (typically days to weeks).
If you ask us to delete your records earlier, we will do so to the extent we are not legally required to retain them — see the next section.
The full list of services that touch any of your data — short on purpose:
That is the entire third-party list. We do not sell, share, or otherwise hand customer data to data brokers, advertising networks, or "AI training" pipelines.
You can ask us, at any time, to:
Email josh@gmtek.ai with the request. We respond within 30 days, usually faster. There is no automated portal — it is one person reading the email — which we think is appropriate at our scale.
Chartwright and VetWright are professional tools licensed to credentialed clinicians and veterinarians. They are not designed for, marketed to, or licensed for use by minors directly. We do not knowingly collect data from anyone under 18.
Pediatric chart text processed by a licensed clinician on behalf of a pediatric patient is the customer's responsibility under their own privacy framework (HIPAA, state law, parental consent rules, etc.). Our products do not treat pediatric data differently from any other chart text — because, again, we never see any chart text in the first place.
We will post material changes to this page and update the date at the top. If a change meaningfully reduces your privacy protections, we will email active customers at the address on file before the change takes effect.
This is a living document, but the core promise — we don't see your charts — is not on the table.
Questions about this policy, your data, a specific privacy concern, or a compliance-officer review: ask Josh directly. One person, real reply, usually same day.
josh@gmtek.ai