Privacy Policy

Last updated: August 2026

Health data notice: Information about your health conditions and the compounds you take is classified as special category data under UK GDPR (Article 9) and may constitute Protected Health Information under HIPAA. We treat this data with the highest level of protection.

1. What we collect

Account data: Email address (for login), display name (pseudonymous by default)
Health data: Compounds you take, conditions you track, outcomes you report, doses, durations
Usage data: Pages visited, features used, and Core Web Vitals, collected via Vercel Analytics and Speed Insights — first-party, cookie-free tools that never see search terms or form input. Compound and condition names in page URLs are redacted before being sent.
What we DON'T collect: Real names (optional), precise location, IP addresses (not stored in our database)

2. How we use your data

To display your outcomes on compound and condition pages (under your display name)
To aggregate with other users' data for community insights (de-identified)
To improve our services and develop new features
To send you essential account-related emails (password reset, security notices)

We never sell your individual health data. Aggregated, de-identified data may be licensed to research institutions and commercial partners under strict data licensing terms.

3. How we protect your data

Row-Level Security (RLS): Database-level access controls ensure users can only see their own data
Aggregation threshold: We never display aggregated outcomes for a compound Ã— condition pair with fewer than 3 data points
Encryption: All data in transit (TLS) and at rest (AES-256)
No third-party trackers on pages containing health data
Pseudonymous by default: Display names only â€” real names are never required

4. Your rights (UK GDPR)

Right of access: Request a copy of all data we hold about you
Right to rectification: Correct inaccurate data
Right to erasure: Delete your account and all associated data
Right to data portability: Export your data in a machine-readable format
Right to object: Stop processing of your data for specific purposes

To exercise any of these rights, email us at privacy@works-for-us.app (placeholder).

5. Data retention

Your individual data is retained for as long as your account is active. If you delete your account, your individual data is permanently removed within 30 days. Aggregated, de-identified data derived from your outcomes is retained permanently as it can no longer be linked to you.

6. Contact

For privacy questions or data requests, contact us at privacy@works-for-us.app (placeholder).