Privacy Policy

Who we are

Rxference Foundation is responsible for the personal information described in this policy.

Rxference Foundation is a Delaware corporation.

Postal address:
221 E Maple St
Pasadena, CA 91101

Privacy enquiries, and any request under the rights described below: privacy@rxference.ai

We are established in the United States and the service is offered there. See “Where this service is offered” below.

What the application sends us

Almost nothing, and nothing about you.

The drug database is a file on your own machine. Searches, the drugs you look at, your settings, your licence file and your quiz progress stay there. There is no account inside the application, no analytics and no telemetry, and there is no code path by which a search term can leave your computer.

Three things do cross the network, and all three are described in the licence agreement as well:

1. A check for a new version, at most once a day. It is an ordinary HTTPS request for a small public file. It carries no identifier, no version number and no query string. Our content delivery network records the request in its access log, in the same way any web server records any request - see “Server logs” below.

2. The openFDA database download, only if you ask for it. Also a request for a public file, with the same properties.

3. Feedback, only when you write it and press send. See “Feedback you send from the application” below.

What we collect and why

Every category we hold, and what it is for. Where we ask for your agreement — the box about release emails is the only one — you can take it back at any time, and every message we send carries a one-click link that does exactly that.

— Academic licence registration.
We collect your name, email address, institution, role, field of study or practice, and whatever you write in the “how you will use it” field. We need these to decide whether you qualify for a free academic licence, to issue one, and to keep the academic tier to the audience it is licensed for. Your name, email address and institution are written into the signed licence file itself, because a licence that does not say who it belongs to records nothing.

— Signing in.
We send a six-digit code to your address and store a hash of that code, never the code itself, together with a hash of the session token issued when it is accepted. Without these you could not sign in.

— Being told about releases.
Only if you tick the box, which is unticked by default. Every such email carries a one-click link that stops it.

— Professional and investor enquiries.
Your name, email address, organisation, and what you write, so we can answer an enquiry you chose to send us. The separate box asking to be told when the Professional edition is ready is yours to tick or not.

— Feedback you send from the application.
The drug card you were on, what you propose changing, the application version, and your email address only if you fill it in. We also store a truncated one-way hash of the network address the submission came from, so the endpoint can be rate-limited; the address itself is never written down. We use it to correct clinical reference data that is wrong. Please do not send patient information: we have no reason to hold it, no wish to, and we will delete it if it reaches us.

— Not mailing people who asked us not to.
If an address bounces, or somebody reports our mail as unwanted, or uses an unsubscribe link, we record that address and the reason so we do not mail it again. Respecting that is the point, and it also keeps us able to deliver sign-in codes to everybody else.

— Website analytics.
Counts only. See “How we count visits” below. Because no identifier is created and nothing is stored on your device, there is nothing here that identifies you.

We do not sell personal information, we do not share it for advertising, and nothing here is used to make an automated decision that produces a legal or similarly significant effect.

How we count visits

The site counts page views, downloads and how long a page was visible. It stores counters, not records: one number per day per page per event, increased by one. There is no visitor identifier, no session, no cookie, and nothing written to your device — which means there is no way for us to tell a returning visitor from a new one, or to follow one person across pages. That is a deliberate trade and not an oversight.

What is sent is the path of the page you are on, with any query string removed, and how long the page was visible. Nothing else.

The site honours the Global Privacy Control and Do Not Track signals: if your browser sets either, nothing is sent at all.

Server logs

The website is served through a content delivery network, which writes an access log for every request — as any web server does. Those logs contain the requesting IP address, the time, the file requested and the user-agent string. An IP address is personal information, so we say so plainly rather than describing the site as logging nothing.

The logs are kept for 90 days and then deleted automatically. We use them to see that the site is working and to investigate abuse. They are not joined to anything else, and they are not used to build a picture of a visitor. We keep them to run and secure the service, and for nothing else.

Who else sees it

As few people and companies as we can manage.

• Amazon Web Services hosts the website and the database behind the licence service, on our instructions. The service runs in the United States.

• Microsoft carries our email. Sign-in codes and account messages are relayed through our Microsoft 365 mailbox, so the address a message is sent to, and the message itself, pass through Microsoft's systems in the ordinary way that email passes through the sender's mail provider.

• Stripe processes donations, and only if you choose to make one. Donating takes you to a page operated by Stripe; we never see your card details, and Stripe handles that information as its own controller under its own privacy policy.

That is the entire list. There is no advertising network, no analytics vendor, no tag manager, no embedded video, no social widget and no third-party font on this site. Loading a page from us contacts nobody but us.

We may disclose information if the law requires it, and we would tell you unless we were forbidden to. If the business is sold, information may transfer with it, and this policy would continue to apply until you were told otherwise.

Where this service is offered

Rxference is offered in the United States only. We are not currently selling, distributing or offering the software or this service to people in the United Kingdom or the European Economic Area, and the registration form asks you to confirm that your use is in the United States before we will issue a licence.

This is a decision about where we operate, not a technical barrier, and we say it plainly rather than leaving it implied. Automatic licence issue is limited to United States academic domains for the same reason.

Our infrastructure runs in the United States, so anything you do send us is stored and processed there.

If you are outside the United States and have registered anyway, write to us and we will delete your record. We would rather do that than hold information under a law we have not prepared for.

How long we keep it

Each of these is a setting in the running service, not an aspiration, and most are enforced by the database deleting the record itself when it expires.

• A sign-in code: 15 minutes, or until it is used once.
• A signed-in session: 12 hours.
• An academic licence and its record: 12 months from issue, renewable.
• Feedback and enquiries: 2 years.
• Analytics counters: 2 years.
• An address on the do-not-mail list: 400 days. Not for ever, because addresses are reassigned and somebody who leaves a university should not be permanently unreachable.
• Content delivery network access logs: 90 days.

Your account record persists while you have an account. Ask us to close it and we will delete it.

Your choices, and your rights

Whatever state you are in, and whether or not a statute obliges us, you may ask us to:

• tell you what we hold about you and why;
• correct anything that is wrong;
• delete it, and close your account;
• send you a copy in a portable form;
• stop emailing you, which the link in every message also does on its own.

We will not treat you differently for asking. There is no paid tier to withhold and no service to degrade.

On the state privacy statutes specifically, and we would rather be straight about this than imply more than is true: laws such as the California Consumer Privacy Act and its equivalents in Virginia, Colorado, Connecticut, Texas and elsewhere apply to businesses above revenue or volume thresholds that we are nowhere near. So they very likely do not yet bind us. We offer the rights above anyway, to everyone, because they cost us nothing and withholding them would be a strange thing to do.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA. There is therefore nothing to opt out of - but if you would like us to record you as having opted out regardless, say so and we will.

Write to privacy@rxference.ai. We aim to answer within 30 days and will tell you if we need longer. We may need to check the request comes from you, and usually the only way we can is by replying to the address on the account.

If you think we have got this wrong, tell us first - we would rather fix it. You may also complain to the attorney general of your state.

Children

The application and this site are for clinicians, students and researchers, are not directed at children, and are not intended for anyone under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has sent us something, tell us and we will delete it.

Security

Sign-in codes and session tokens are stored as one-way hashes, so a copy of our database could not be used to sign in as anybody. The key that signs licences lives inside a hardware security module and cannot be exported — not by us either. The application verifies every update against that signature and a checksum before it will run it. Network addresses used for rate-limiting are hashed rather than stored.

No system is perfectly secure. If you find a problem, please tell us at privacy@rxference.ai before telling anyone else, and we will work with you on it.

Changes

When we change this policy in substance we increase its version number and change the date at the top. If the change affects how we use information you have already given us, we will tell the people it affects rather than relying on them re-reading the page.