Privacy Policy

MedLiam is an email service operated by Medtra Inc. (Quebec, Canada). We take your privacy seriously: your inbox belongs to you, not a product we resell. This policy explains, in plain terms, what we collect and why.

What we collect

• Your account: username, @medliam.com address, password (stored encrypted, never in plain text) and, if you provide one, a recovery email.
• Your phone number, name and date of birth: used to sign you in with an SMS code, to confirm you are 14 or older, and to recover your account. Your MedLiam account is also your Medtra account: it is the same across the Medtra Inc. family of apps.
• Your help requests: what you send us from the Help screen, so we can reply.
• Diagnostics and usage: when the app crashes, the error message; and the name of the screens you open (for example "inbox"). Never the content of your emails, nor your address. This data is not linked to your identity and is deleted after 30 days.
• Your emails: the contents of your inbox (messages received and sent), kept on our own servers to provide you the service.
• Minimal technical data: connection and delivery logs, required to operate and secure the service.

What we don't do

• We do not sell, rent or trade your data.
• We do not read your emails to target you with ads (there are no ads).
• Assistance features (summaries, drafts, sorting) run on our servers, on the email concerned, solely to provide the requested service.

External accounts (Gmail, Outlook, Yahoo, iCloud…)

You can add an inbox you have elsewhere to MedLiam. With Google or Microsoft, you sign in on their page: we never see your password. We receive an access token used only to display, send, sort and delete your emails in MedLiam, when you ask.

• Sealed by your device: from the app, this token (or another inbox's app password) is encrypted with a key that stays on your phone. Without it, our servers cannot open it. While you use the inbox, it is held in memory only, never written in plain text.
• No copy of your inbox: your emails stay with Google or Microsoft; we read them when you open them. We only keep, in your own space: the names and addresses of people you exchange with (to complete recipients as you write), email images in cache (so they are not downloaded again), and a message you send for the undo delay or until the time you scheduled.
• Revoking access: detach the inbox in MedLiam (the token is erased), or revoke access in your Google account (myaccount.google.com/permissions) or Microsoft account.

Google data: MedLiam's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice: Gmail data is used only for the email features you see in MedLiam; it is not sold, not used for advertising, not read by humans (except with your consent, for security, or where required by law), and not used to train AI models.

Video meetings

The video and audio of your meetings go through our server in Beauharnois, Québec, encrypted in transit. They are never recorded. We only keep the meeting code and the address of the person who created it; the link expires after 30 days and the entry is then deleted.

Call and SMS protection

Each protection is turned on separately, in iPhone Settings. iOS never gives MedLiam your call list or your messages.

SMS filter: iOS only shows the filter texts from unknown senders, one at a time, never iMessage or messages from your contacts. By default the analysis runs on the iPhone and nothing leaves it. If you choose "Enhanced analysis in Québec", a message that can't be sorted with confidence is sent to our server in Beauharnois with the sender's number. We don't keep its text: only a non-reversible fingerprint and the verdict, for 30 days, to spot a fraud campaign. No external AI reads these messages.

Reports: when you report a call or a text, we receive the number, the chosen category and the date, never the message text. Your report is tied to a hashed identifier, not your address, to weigh it and counter malicious reporting. Reports are kept for 12 months, then only as totals.

Call identification and blocking: MedLiam puts on your iPhone a list of fraud numbers confirmed by our team and of verified businesses. iOS checks it on the device; the call itself is never sent to us. No number is blocked without human review.

Confirmed number: if you confirm your number with an SMS code, we keep the number, the date and a hashed identifier. The confirmation expires after 180 days, so that a number reassigned by the carrier doesn't keep its former owner. It proves you received a code at that number, not that a call showing that number comes from you.

Disputing a classification: if your number is marked by mistake, write to [email protected] or use the dispute form. The classification is frozen during review.

Subprocessors

SMS sign-in codes are sent by our text messaging provider. To deliver outgoing email reliably, we use a third-party delivery service (email relay). Incoming mail passes through our network infrastructure provider. These partners process only what is strictly necessary for routing, under agreement.

Retention

We keep your data for as long as your account is active. If you close your account, your inbox and its contents are deleted.

Your rights (Law 25 / GDPR)

You can access your personal information, correct it, or request its deletion. Write to us at [email protected] and we will respond within the timeframes provided by law.

Security

Encrypted connections (TLS), hashed passwords, temporary sessions. No method is perfect, but we apply the reasonable protections expected.

Contact

Privacy questions: [email protected].

In case of any discrepancy between versions, the French version prevails.

← Back to MedLiam