Effective date: [FOUNDER TO SUPPLY: actual effective date].
Who we are
[FOUNDER TO SUPPLY: legal entity, public address and privacy inbox]. This draft needs checks against the final site's data flows.
Browsing
The audit found no accounts or analytics trackers. The host and security providers may still keep logs. These can include IP address, pages opened, browser details and times. A medicine page in a log can reveal a health interest. [FOUNDER TO SUPPLY: providers, fields, purpose, access, storage country and deletion periods]. [VERIFY: final cookies, browser storage and network requests]. No trackers does not mean no data.
Optional features
The audited map tool builds a pharmacy search in your browser. If you open the link, Google gets the query and connection data. It leaves out the medicine name. [VERIFY: ZIP storage and final map query]. An outside video link or player can send data to its host. A privacy-enhanced player is not data-free. [VERIFY: links versus embeds, click-to-load behavior and thumbnail requests]. See Google privacy and YouTube terms. Some read-aloud voices run on your device. Others use a remote service. See MDN's voice flag. [VERIFY: policies of actual voice providers]. The audited feedback tool saves a local file. It does not send it to us. A send feature needs a new notice before launch.
Messages and storage
Email sends your address, message and files to our mail provider and staff. Send a page link and a general question. Please omit health records, diagnoses and prescription details. We propose no marketing use of health details sent to us. [FOUNDER TO SUPPLY: mail provider, access controls, storage and backup periods, deletion process].
Consumer health data privacy
Logs or messages may reveal health interests. The policy must list what we hold, where it comes from, how we use it and who gets it. Our proposed rule is no sale of health data and no targeted ads. [FOUNDER TO SUPPLY: actual practices, affiliates and processors]. [VERIFY: Washington, Nevada and Connecticut duties based on real data flows]. Washington's policy rule requires these details, rights information and a prominent home-page link. RCW 19.373.020. Asking readers not to send health data does not erase duties for data we receive.
Rights, children and security
Ask the privacy contact about access, fixes or deletion. Rights depend on the law that applies. [VERIFY: response times, identity checks, appeals and regulator details]. We do not need a medical record for a general request. The site is for a general audience. It is not meant to collect data from children under 13. [VERIFY: child-related duties and procedures]. No service can promise perfect security. [FOUNDER TO SUPPLY: controls and incident contact]. For EU/UK readers: [VERIFY: legal scope, bases for processing, transfers, safeguards and representative duties]. This draft makes no claim of legal compliance. We will date major changes and retain prior versions.