Protection, plainly explained.

Several layers of protection

Dini uses HTTPS for service connections, provider storage encryption and database access policies. Native sign-in credentials use the device’s secure storage. Selected records receive additional authenticated encryption with a key held on the device. These protections do not make cloud processing end-to-end encrypted.

Website forms and private documents

Early-access and recruitment forms use encrypted connections to Dini’s Supabase backend. Public clients have submission access only; they cannot read application or early-access records. Résumés are stored in a private bucket with a 5 MB limit and permitted PDF and DOCX file types.

These controls do not make the entire service end-to-end encrypted. Authorized project administrators can access submitted information to manage requests and applications. Do not upload passwords, medical records or documents you do not have permission to share.

Your permissions stay separate

Health-source permissions are managed by your device. AI processing is an optional, saved choice in Dini Settings. A Max household profile does not grant access to another adult’s account.

Know the limits

No service is perfectly secure. If you lose a device-bound encryption key, some records may not be recoverable. Keep independent copies of information needed for care. PIPEDA, Canada’s federal privacy law, and Quebec’s private-sector privacy law, where it applies, govern how we handle personal information. We do not currently hold a third-party security certification, such as SOC 2 or ISO 27001.

Report a concern

Email privacy@diniapp.com with a short description. Do not email passwords, access tokens, full medical records or other people’s information. We will arrange an appropriate way to investigate.