How PDR handles your documents

What PDR stores

PDR stores the files you upload, the text extracted from them, the reports PDR writes, your Chat (up to the last 80 messages) and any feedback you send.

Who processes your documents

To answer your ask, PDR sends your documents' extracted text, any images, and your ask to its AI provider, xAI.

Under the provider's API terms, this data isn't used to train models by default.

PDR's xAI account uses zero data retention, so xAI doesn't store PDR's requests or responses after answering them.

Masking

When 'Mask sensitive identifiers' is ticked, PDR replaces some identifiers with placeholders before sending: Social Security, card, account, routing, medical record and member ID numbers, email addresses, phone numbers and labelled dates of birth.

When 'Mask names and addresses' is ticked, PDR also replaces labelled names (after Patient:, Name:, Student:, Member:, Insured: or Employee:, or after Mr., Mrs., Ms. or Dr.), US street addresses and PO boxes. It's ticked by default for Healthcare and Education, and Chat uses each domain's default.

Names in free text without a label aren't caught. ZIP codes on their own, other dates and amounts aren't masked, and images are sent as-is.

Reports show the placeholders.

In a very long Chat thread, older messages are trimmed and placeholder numbers can be reused, so the same placeholder can stand for two different values.

Masking reduces risk; it doesn't make a document anonymous.

Your workspace

Your workspace's cases and matters are visible only to you and the members you invite.

How long PDR keeps things

Cases and matters stay until an Owner deletes them. A sandbox is removed 72 hours after it starts. Chat is removed 30 days after its last message. Feedback is removed after 180 days.

Deleting

An Owner can delete a case, which removes its files, extracted text and reports from PDR. PDR's AI provider (xAI) doesn't store copies of what PDR sends (zero data retention).

You can delete your account, or a workspace you own, on your Account page. This removes its cases, files, reports and Chat. Feedback you sent stays, without your name, until it's removed after 180 days.

Health information

Don't upload protected health information (PHI) or anything that identifies a patient. PDR doesn't have a HIPAA business associate agreement (BAA) with its AI provider.

Questions

Click Feedback at the top of any page, or reply to Rob's email.