Encrypted values and readable metadata

Sensitive values stored as ciphertext

These values are encrypted on-device before storage and sync. Maestra’s database cannot read their plaintext.

Category	Encrypted values
Patient	Names and demographics, identifiers, contacts, addresses, notes, and custom field values
Clinical record	Documents, generated notes, encounter notes, reason and treatment summaries
Communication	Encounter-assistant and Patient Assistant messages
Transcript	Text, speaker labels, assigned roles, and encrypted speaker or voice centroids treated as biometric clinical data
Finance	Charge, payment, allocation, credit amounts, and sensitive notes
Retrieval	Search embeddings and persisted clinical retrieval content

Readable structural and account metadata

Category	Readable data and purpose
Account	Email, display name, profession, language, region, and authentication state
Structure	Entity IDs, owner IDs, relational links, and non-sensitive coordination fields
Schedule	Encounter dates, times, recurrence structure, status, attendance, and consent-attestation timestamp
Operations	Processing status, subscription state, and account-level service coordination
Security	Wrapped key material, salts, and nonces. These do not include the unwrapped data key

Readable metadata does not turn encrypted clinical fields into plaintext. It remains personal data and is handled under the applicable account and service safeguards.

Requests that use plaintext transiently

The device sends only the necessary payload through the relay for transcription, note and assistant generation, patient import parsing, assistant embeddings and retrieval, and PDF rendering. The relay performs request-scoped processing without logging or retaining the clinical payload. Relevant contracted processors receive the task payload described in Sub-processors.

flowchart LR
    Device["Device\nHolds unwrapped data key"]
    Database["Database\nCiphertext sensitive values\nReadable structural metadata"]
    Relay["Relay\nTransient request processing"]
    Processors["Contracted processors\nTask-specific payload"]

    Device -->|Encrypted fields and metadata| Database
    Device -->|Necessary plaintext| Relay
    Relay --> Processors
    Processors --> Relay
    Relay --> Device

What account deletion changes

Account deletion removes Maestra-held account and database records plus wrapped key material. This makes server-side ciphertext unavailable to Maestra. It does not erase plaintext exports, user-created backups, or copies retained on another device. External Apple-token and RevenueCat cleanup is attempted on a best-effort basis, and store subscriptions must be cancelled independently.