1. Who we are
GoldRock Health is operated by Eldest AI LLC dba GoldRock AI, 1035 Pearl St, Suite 205, Boulder, CO 80302, United States. Contact us at ryan@moonshineai.com about this notice or your information.
This notice covers GoldRock's handling of information in its website, account service, and private-workspace features. Independent services you choose to visit have their own privacy practices. Our Data & saving explanation describes the product controls in more detail.
2. Accounts and Google sign-in
We use Clerk to authenticate accounts. If you choose Google sign-in when it is available, Google and Clerk handle the sign-in exchange. The basic identity information involved can include your Google account identifier, name, email address, email verification status, and profile image if provided. We request basic identity access for sign-in; we do not request access to your Gmail messages, Google Drive files, contacts, or calendar.
We use sign-in information to establish and secure your account, display your account identity, support account recovery and deletion, and check access to the service. A verified email address is required. If you add a work email for an employer benefit, Clerk verifies that address and our server checks verified addresses against the employer's eligibility settings. An Apple private relay address or a personal Google address is not by itself proof of employment.
GoldRock stores an encrypted email address and display name, a keyed account-identifier mapping, and account, session, and eligibility records in its server database. When you explicitly accept the service terms, we record your account reference, terms version and acceptance time; this does not authorize a payment. Clerk separately handles provider identity and authentication records. GoldRock does not need your Google password. We do not use Google sign-in data for advertising, sell it, or send it to a model for training or medical-bill analysis. We request only the identity access needed for these user-facing account functions.
You can manage Google connections in your Google Account. Disconnecting Google does not automatically delete a GoldRock account or its records; use GoldRock's account-deletion control or contact us as described below. Deleting GoldRock does not delete your Google or Apple account.
3. Medical documents and local saving
In the current public deployment, medical-document processing and case analysis use the local-only path; cloud case analysis is disabled. Selected images, document text extraction, local checks, and any downloaded model used for this path run on your device. GoldRock does not upload original medical documents or case content to its server through this path.
Local detection and removal tools can miss names, identifiers, or other details. Extracted facts, handwritten notes, and exported responses can still identify someone. We do not guarantee that any document or output is anonymous, free of all personal information, or safe to share without your review.
A one-time workspace keeps case content in temporary application memory. If you choose protected saving in the web app, cases and selected health-notebook and insurance-wallet information are encrypted in a browser-local vault. The vault has a separate passphrase; it is not the same as your sign-in password. GoldRock's account recovery cannot recover that passphrase. Local saving is specific to that device and browser origin and is not automatic cloud synchronization.
Encrypted backup and restore: the web app can create a separate encrypted backup that you deliberately download and protect with its own passphrase. It can contain cases, drafts, notebook and plan records, with the account reference inside the encrypted content. Restore decrypts and validates that file locally for the same account, shows a preview and requires an explicit merge or replace choice. It opens records in a temporary tab; it does not automatically overwrite a saved vault or synchronize devices. GoldRock cannot recover the backup passphrase. This browser backup format does not claim compatibility with the native iPhone vault.
Recorded-date reminders: optional web reminders run only while that tab remains open, use generic notification wording and can be delayed by the browser. They do not calculate or verify deadlines. They are cleared when the workspace changes. Native reminders use the device notification system when you explicitly enable them. Calendar exports and system notifications have separate device or calendar settings.
The document workflow does not keep original source images as saved case attachments. Original files, camera images, operating-system previews, device backups, downloaded exports, and copies you made elsewhere are separate from the workspace. Local model files and application resources may remain cached. Signing out locks the workspace but does not necessarily remove its encrypted local copy. Shared devices require particular care.
4. Searches, support, and deliberate sharing
Public provider search: when you run a provider-directory search, the selected specialty, practice city or ZIP, state, and result-page information are sent to the NIH/NLM public directory service. That service also receives ordinary network information, such as your IP address. Your private care-plan notes and case documents are not part of that search request.
Model downloads: downloading a local model or runtime requests files from the relevant hosting service or model repository. Those providers can receive your IP address and the requested asset or model name. Downloading these files does not send the contents of your case with the request.
Product help: the in-app guide uses local product guidance by default. If you deliberately choose an already loaded device model, it receives your typed product question and fixed public product instructions locally, without case or account context. Its instructions may be wrong; verify the actual screen. It does not silently download a model or send that typed question to the cloud. If the separately offered live product-help option is available and you consent, it sends a selected, predefined product topic and product documentation to OpenAI. It does not send your typed question, chat transcript, case, document, or account identity. The integration requests that responses not be stored using the API's response-storage setting; that is not a promise of zero provider retention. Typed support conversation in the app is temporary. Do not put medical details or credentials into a support request.
Exports and outside services: when you export a letter, summary, form, or other file, it may contain the private details you selected. Review it before sharing. Official insurance-portal links open independent services; GoldRock does not acquire your insurer password or connect to your personal claims by providing those links. Emailing us or another recipient sends the information you include to that recipient and their email service. Please contact us without medical documents, account passwords, or payment-card information.
5. Employer benefits and family accounts
Employer access uses verified identity, employer eligibility records, and an active benefit with available capacity. Relevant account information can include a verified work email, organization membership, invitation and enrollment status, role, and billing or benefit references. Employers and authorized organization administrators can administer their roster, eligibility, invitations, benefit capacity, and enrollment information. They may therefore know who is eligible or enrolled.
Employer enrollment directory: authorized administrators can record employee work email, optional name, employee reference and department, eligibility/offboarding status, and enrollment status. Email and optional HR profile fields are encrypted in our service database. We keep code hashes, expiry and redemption limits, account references and administrative event timestamps; the reusable code itself is shown only when created. An employee marked inactive is blocked from employer eligibility even if their email matches an approved domain. Changing enrollment does not delete private records saved on that employee’s device.
Testing access: GoldRock administrators can issue reusable, limited-account evaluation codes for up to 14 days. Redemption requires a registered account with verified email and records the code/account reference and time. Evaluation access is separate from employer benefits, paid subscriptions and administrator roles. It expires or can be revoked, and does not authorize server-side medical processing.
Employer administration does not provide access to an employee's medical documents, case notes, letters, health questions, or individual clinical activity. Platform administration is also separate from your local clinical workspace. We do not send your private cases to an employer as part of administering the benefit.
Where family-account setup is offered, household membership and invitation records support access administration. Each person uses their own account. Being a household member does not automatically share another person's cases. Creating a draft household does not itself activate a paid family entitlement.
Invitation email: an authorized organizer or owner can explicitly request delivery to the intended email address. If this option is configured, Resend receives the recipient address, invitation code, expiry and fixed setup instructions. No medical case content is included. Pending delivery payloads are encrypted on the service. They are removed on acceptance, cancellation, terminal failure, or the next worker run after the retry window expires. Retry eligibility is bounded to 20 hours; scheduled cleanup is not a promise of physical deletion at exactly that time. Transport acceptance does not establish inbox delivery. Invitations can also be shared deliberately without requesting email.
6. Service providers and other disclosures
Clerk provides authentication, Vercel hosts the website and server functions, and Neon provides the server database. They process information needed to operate those services, including identity, account, security, and technical records as applicable. Server-side encryption protects selected account fields at rest, but GoldRock operates the service and holds the server encryption keys; this is not end-to-end encryption of account data.
Other services are involved only in the relevant feature: Resend for explicitly requested invitation emails when configured, public directory providers for searches, model repositories for downloads, and OpenAI for the optional product-help request described above. If a payment option is offered, its payment provider handles the payment information you submit and GoldRock can retain payment identifiers, subscription status, and related administrative records. The current public deployment does not offer live checkout.
We may disclose necessary information to comply with a valid legal requirement, address fraud or security incidents, protect rights and safety, or support a business transfer subject to applicable obligations. We do not sell Google sign-in information or use your local medical workspace for advertising. Providers' own processing is governed by their applicable service terms and agreements; local processing does not eliminate the network metadata they receive.
7. Cookies, logs, and safeguards
Authentication uses cookies and SDK storage to maintain sign-in and protect requests. The app also uses browser storage for the optional encrypted vault, preferences, and cached resources. Blocking or clearing this storage can sign you out, remove local information, or stop features from working. Clearing your local vault without a separate copy can permanently remove that workspace.
Hosting and security systems can process request times, URLs, response status, IP addresses, and browser or device information. GoldRock's application error handling is designed to record diagnostic categories and request identifiers rather than medical documents or full request bodies. Support messages contain whatever information you send us.
We use access controls, verified identities, encrypted account fields, and local vault encryption where described. No service or redaction tool is infallible. These safeguards are not a guarantee of anonymity or a claim that the service has HIPAA, SOC 2, or other certification.
8. Retention and deletion
Account and benefit records are retained while needed to operate access and administration, resolve security issues, and meet applicable recordkeeping obligations. There is no single fixed retention period for every record or provider. Local vaults remain on the device until removed through the app or browser controls. Temporary workspaces are lost when their application memory is cleared, such as on a reload or close, unless you saved a protected copy.
The account page provides account deletion after the required identity verification. A last remaining organization owner must transfer ownership or close the organization first. Deletion disables access and attempts to delete the managed authentication identity and associated GoldRock user records. If a provider step fails, deletion can remain pending while cleanup is retried. We retain a keyed deletion marker to prevent the same deleted provider identity from being silently recreated. Organization, payment, legal, or security records not removed with the user record, and providers' backups, can remain subject to their applicable purposes and retention arrangements.
The web deletion flow also attempts to remove the account's local vault in the current browser. It cannot remotely erase another device, browser origin, original document, downloaded export, recipient copy, or system backup. If local removal fails, clear the relevant site data. Logical deletion is not a guarantee of immediate physical erasure from every backup.
Deleting an account does not delete an outside Google or Apple account or necessarily remove an outside payment provider's records. Manage any subscription with its payment provider as well; do not assume every outside subscription is canceled by deleting GoldRock. Contact us if you cannot access the deletion control or need help with a pending request.
9. Your choices, questions, and requests
You can use the local-saving controls, review exports before sharing, manage sign-in connections, and request account deletion. You may also contact us to request access, correction, deletion, or information about our handling of your personal information. Available rights depend on applicable law and the relevant records. We may need to verify your identity and authority to act; please do not send identity documents or medical records in an initial email.
Contact ryan@moonshineai.com or write to Eldest AI LLC dba GoldRock AI, 1035 Pearl St, Suite 205, Boulder, CO 80302. If you are asking about an employer benefit, your employer can address its own roster and employment records; GoldRock can address the account and service information it controls.
We will update this notice when our handling changes and show the updated date here. Enabling a new medical-content cloud path would require a clear explanation of that path and its choices before use. This notice describes current behavior; it does not represent an independent legal review or a guarantee that every legal requirement has been satisfied.