What Talli holds, and what it does with it

Talli is built and is not yet running as a service, so this page describes how the software behaves rather than the operation of a live product. It will be re-stated as a policy before anybody's records are held.

What is held

The account: an email address, a hash of the password, and for each signed-in session its client, browser string and IP address, which you can list and revoke. A refresh token itself is stored only as a SHA-256 digest, never in the clear.
The pets: names, species, breed, dates of birth, and the clinical record built from your documents and your own entries.
The documents themselves, exactly as they were uploaded.
Household membership: who is in it and at what role.

Where the documents live

Documents and imaging are held in two private object-storage buckets. Nothing in them is public. Every key is namespaced to the household that owns it, so a misconfigured policy cannot show one family's records to another, and every key carries a random component so a URL cannot be guessed from a pet's name.

A file is reached only through a signed URL that is valid for 15 minutes and then stops working. That is deliberate: an imaging URL that never expired would be a permanent leak of a household's medical record.

Every upload is scanned for malware and has its true type checked before any byte of it is parsed, and a file that fails is quarantined and its owner is told.

What leaves the machine, and in what state

Reading a document, and answering a question about a record, both send text to a language-model provider. Before that happens, emails, telephone numbers, street addresses, owner names, card-shaped numbers and social-security-shaped numbers are replaced with placeholders.

The map from placeholder back to real value never leaves the process, is never written to a log, is never stored, and is never part of an error message.
An owner's name is never restored, because it is not a clinical fact and has no field to land in.
Card-shaped and social-security-shaped numbers are deleted rather than restored.
The only thing that leaves the process about this is a count of how many placeholders were written.
There is no setting that turns it off.

Talli also runs with no model provider configured at all, and reaches the same tables by deterministic means.

Links you send to other people

A share link is a credential and is treated as one. The link is shown to you once, and only its SHA-256 digest is stored, so neither a database dump nor the app's own list of your links can reconstruct a working one.

Every attempt to open a link is written to that link's log, including the attempts that are refused, and a link can be revoked at any time.

Email

Open tracking and link tracking are both off. Link tracking would rewrite every link in a message to route through a third party's domain, which is the shape of a phishing link, and it would hand that third party a record of who read a message about a medical account.

The delivery ledger records which template was sent, to whom, and with what subject. It never stores the body of a message. The ledger itself is kept for 90 days.

Taking everything out

You can download the whole archive of what Talli holds about you as one ZIP.

It does not ask for a password. Deleting an account is dangerous and reading your own data is not.
It is never metered and never behind a paid plan. A free account gets it.
Three requests a rolling day, and a built archive stays available for 7 days.

Deleting the account

Deletion is a request with a 30-day window, and signing in during those 30 days cancels it. The consequences are listed in the app before you confirm, and they are the same five sentences on every client:

A household you own alone is deleted. Its pets and records go with it.
Records you added to a household you share stay with that household. Your name is removed from them.
Your sign-in, sessions and devices are removed.
Security and billing logs are kept without your name, email address, or device details.

If you own a household that other people belong to, hand ownership to one of them first, so their pets' records are not deleted with your account.

What this page does not claim

Talli is not HIPAA covered, and neither is any veterinary record. HIPAA protects information about a natural person, and a dog is not one, so a veterinarian is not a covered provider under it. Anybody showing you a HIPAA badge on a pet product is telling you something that does not apply.
No certification, audit or compliance standard is claimed here, because none has been obtained.
No accessibility conformance is claimed. The app has known colour-contrast failures and has not had a screen-reader pass.

This site

This information site has no accounts and no sign-in. Nothing on it reads your Talli record, because there is no Talli record to read from here.

Asking us something

There is no published support address yet, because the service is not running yet. When Talli opens, the address will be on this page and on the support page inside the app, and it will be a real mailbox rather than a placeholder.