Privacy

This page covers the hosted site at lastehr.com, including the live demo. It does not cover deployments you run yourself from the source code; those are addressed in the self-hosted section below.

The hosted site uses PostHog, configured to capture only explicit events I chose to instrument: a small set of product interaction events in the demo, such as clicking a starter prompt, sending a message, or approving a proposed write. Event properties never include the content of your chat or any chart data.

Autocapture, automatic pageview tracking, session recording, and surveys are all disabled. Analytics state is kept in memory only, so nothing is written to your device, and no person profiles are created. Analytics only run on the hosted site; a build without the PostHog key sends nothing.

If you join the waitlist, I store the name and email you submit, along with the referring page, your browser's user agent, and your IP address, in a Postgres database (Neon). The extra fields exist to spot bot floods, nothing else. Entries are deduplicated by email. I use this list only to send updates about the project, and I do not share or sell it.

The site sets functional cookies only; there are no tracking cookies. The ones you may see:

• medplum_access_token: an HttpOnly session token used to talk to the FHIR backend.
• demo_session_id: an HttpOnly random identifier that isolates your demo writes from other visitors'.
• smart_session: a non-secret marker indicating a SMART on FHIR launch.
• smart_state, smart_verifier, smart_token_endpoint: transient values used during a SMART launch handshake.

To keep the demo usable, requests are rate limited by client IP using a sliding 60-second window. On the hosted site the counters live briefly in Upstash Redis with its analytics disabled; the IP is used as a counter key and expires with the window. Self-hosted deployments without Upstash configured fall back to an in-memory limiter, so the IP never leaves the process.

When you use the demo chat, your messages and the synthetic chart context are sent to the configured model provider to generate a response. The site stores no transcripts. All demo patient data is synthetic. Please do not paste real patient information into the demo; it would be sent to the model provider like any other message.

The server logs errors and operational warnings. When a chat request fails, the log line records the error type, message, and status code, not the content of your messages or the chart context.

If you run Last EHR from source or self-host it, none of the hosted-site analytics or waitlist collection happens by default: the PostHog key is unset and there is no waitlist database. What your deployment sends to your FHIR backend and your model provider is between you and them.

If the site starts collecting something new, I will update this page and the effective date at the top. The page's history is visible in the repository. Questions: open a GitHub issue.