Privacy Policy

We only collect what we need to run the service. Nothing more.

Account info: When you sign up, we store your email and a hashed password so you can log in. We also track your subscription status so we know which features you have access to.

Usage data: We log basic analytics like which pages you visit and what you search for. This helps us understand what features matter most and fix bugs. We do not track you across other websites.

Device info: We may collect your browser type and operating system to diagnose issues and optimize performance.

What we do NOT collect: We do not collect patient data, prescription history, or any clinical information about your patients.

We use your data to provide the service by logging you in, syncing your data, and enabling premium features. We also use it to improve DrugIndex by understanding which features are popular and fixing things that break; to communicate with you by sending account notifications, password resets, and occasional product updates (you can unsubscribe from non-essential emails anytime); and to enforce our terms by detecting abuse, fraud, or unauthorized access.

We do not use your data for targeted advertising, and we do not build profiles to sell to third parties.

All data is encrypted in transit using TLS (HTTPS), and passwords are hashed with modern one-way algorithms. We use Supabase for authentication and database hosting, which maintains SOC 2 compliance and regular security audits. Access to production systems is limited to core team members, and we do not store credit card details on our servers; payments are handled by our payment processor.

No system is 100% secure. If we discover a breach that affects your data, we will notify you as soon as possible and tell you what steps to take.

You have control over your data. You can view the data we hold about you in your profile settings, request account deletion at any time (we will remove your personal data within 30 days, except where we are legally required to keep it), ask us for a copy of your data in a common format, and opt out of non-essential emails using the unsubscribe link in any email we send.

If you are in a jurisdiction with additional privacy rights (such as GDPR or Kenya\'s Data Protection Act), those rights apply too. Contact us to exercise them.

We do not sell your personal information. Period. We only share data with services that help us run DrugIndex. Supabase hosts our database and authentication and only processes data as needed to provide their service. Vercel hosts our website and may process basic request logs for uptime and performance monitoring. Our payment processor handles billing, and we never see your full credit card number.

Each of these providers has their own privacy policy and security standards. We choose partners who take privacy seriously.

DrugIndex is designed for healthcare professionals and students. It is not intended for children under 13. If you are under 18, please use DrugIndex under the supervision of a parent, guardian, or educator.

If you believe we have inadvertently collected data from a child under 13, please contact us and we will delete it immediately.