Why MedAI is free

A short tour through the federal rules that make a free, private health-records app actually possible.

Short version: the data is your right by law, the APIs that deliver it are mandated to be free, and we have no servers, so our cost to deliver it to you is roughly zero.

1. The data is yours by law

Under HIPAA's Right of Access (45 CFR §164.524), every covered entity — your hospital, clinic, lab, pharmacy — must give you an electronic copy of your medical records when you ask for one. Not a paper printout. Not a fax. The electronic copy, in a form you can use.

2. The APIs that deliver it are mandated to be free

The 21st Century Cures Act of 2016, implemented through the ONC certification rule (§170.315(g)(10), "Standardized API for Patient and Population Services"), requires every certified EHR vendor to expose patient data via a SMART on FHIR API. That includes Epic, Oracle Health (formerly Cerner), athenahealth, Meditech, Veradigm (formerly Allscripts), eClinicalWorks, NextGen, Greenway, and others.

The rule is explicit (45 CFR §170.404(a)(4)) that this API access must be provided at no cost to both:

• the patient (you), and
• the patient-directed app developer (us).

No portal fee. No per-call charge. No "developer license". No data tier. The infrastructure costs your provider operates is already paid for by their EHR certification — Cures forbids them from billing it out again.

3. Information blocking is illegal

If your provider, EHR vendor, or any health-information exchange interferes with your access — refuses to connect MedAI, charges you a fee, throttles requests, demands you sign extra paperwork — that may constitute "information blocking" under 45 CFR Part 171. Civil monetary penalties go up to $1 million per violation.

The complaint process is run by ONC at inquiry.healthit.gov. We have an in-app flow that helps you file one — see also our information-blocking guidance page.

4. We don't run a server, so we don't have a server cost

MedAI runs entirely on your device. The FHIR API calls go from your phone directly to your provider — we are never in the path. There is no MedAI server holding your records, so we don't pay for one. The AI that summarizes your records runs on your phone's own Neural Engine / NPU.

The only infrastructure we run is this static website (which you're reading) — about $0 to host on Cloudflare Pages. So our marginal cost per user is essentially the price of a domain name divided across all users.

5. The economic model is "donations, no extraction"

We don't sell ads (couldn't if we wanted to — we hold no targeting data). We don't sell your data (don't have it). We don't subsidize the app by surveilling you (no analytics, no SDKs). We don't lock features behind paywalls.

Development is funded by voluntary donations from people who find MedAI useful. If you can't or don't want to donate, use the app anyway — the whole point is to put leverage in your hands, not gate it on payment.

6. The mission

MedAI exists to embolden you to make informed decisions about your own health. That means putting your records — readable, searchable, queryable — in your hands. Not your provider's portal silo. Not an aggregator's database. Yours.

Free isn't a marketing strategy. It's a consequence of doing this right.

For the gritty regulatory detail, see healthit.gov/curesrule and hhs.gov/hipaa/right-to-access.