Consumer Health Data Privacy Policy
Effective [to be confirmed: effective date] · Version 2026-10-us-v3
This policy applies to everyone who uses N-of-All in the United States. Washington, Nevada and Connecticut require it by law, and we apply it, and the rights in it, to every member in the US.
Who we are
N-of-All is run by a physician licensed and established in Switzerland ("N-of-All", "we", "us"). Contact: [to be confirmed: privacy email]. We are not yet incorporated. The operating company will be a Swiss GmbH; it will be named here, with its registered address, as soon as it is registered.
What this policy covers
"Consumer health data" means information that identifies you, or could reasonably be linked to you, and that relates to your past, present or future physical or mental health. It includes conclusions drawn from other information, such as a result the app calculates from your entries.
Almost everything you enter in N-of-All is consumer health data, so we treat all of it that way. Our Privacy Policy covers the rest: your account, technical data and cookies.
1. The consumer health data we collect
| Category | What it includes |
|---|---|
| Substance use | Compounds you take, doses and units, how you take them, dates, cycle phases, plans and schedules, injection sites and dates |
| Effects and symptoms | Side effects and benefits you report, how severe they were and when they started, and your answers to the weekly safety questionnaires, including questions about mood and thoughts of self-harm |
| Lab results | Values, units, reference ranges and test dates, typed in or read from a photo if you use photo scanning |
| Health history and medicines | Conditions you list for yourself and your family; prescription medicines and supplements |
| Body and lifestyle | Biological sex, birth year, weight range, exercise, diet, alcohol, smoking, recreational drug use |
| Your own words | Anything you write in notes or "other" fields, including free text in questionnaires. Before we save side-effect notes, questionnaire answers, injection notes, feedback and substance requests, the app automatically removes email addresses, links, @usernames and phone numbers. This works by pattern-matching and will not catch everything, so please leave such details out. |
| Results the app works out | Safety-questionnaire results, interaction and organ-load flags, notes on where a dose sits against the ranges we have on record, and how your own words were matched to our list of effects |
| Photos, only if you switch on photo scanning | A lab report or vial label you choose to upload. The photo is read and then discarded. We never store it. Our AI provider may keep it for the period stated in our Privacy Policy. |
| Feedback and requests | Feedback you send, including a screenshot of the page if you choose to attach one, and requests to add a substance |
We do not collect precise location, data from wearable devices, or biometric data. If you sign in with a passkey, your fingerprint or face is checked by your own device and never reaches us. We do not use geofencing.
2. Where it comes from
From you, through the app, and from the results the app calculates from what you enter. We don't buy health data, and we don't receive it from other companies.
3. Why we collect and use it
- To provide the service you asked for: your logs, history, trends, reminders, safety questionnaires, interaction and organ-load flags, and the reports you can export or print, for example for your own doctor.
- To produce community safety statistics. We pool members' entries, stored under random IDs, and analyse them: we look for side effects that are reported with a substance more often than expected (safety signals), and our staff follow aggregate figures such as how many people record each substance and how often they report side effects. A statistic is only shown to members once at least 10 people are behind it, it passes fixed statistical thresholds, and a physician has reviewed it. Members never see anyone's individual entries. This is the purpose of N-of-All.
- For reports and research. We may use these statistics in reports and scientific research, for example in a safety notice or a scientific article, on our own or with a research partner such as a university. Only aggregate statistics built from at least 10 people are published or given to a partner. Statistics that have already been published can't be withdrawn.
- To keep the community statistics trustworthy. Automated checks look for duplicate, automated or fake entries and leave them out of the statistics. A person reviews unclear cases and can reverse any exclusion.
- For your safety. When an answer or a note suggests thoughts of suicide or self-harm, the app is designed to show crisis contacts straight away. It works by recognising certain answers and phrases, so it can miss things. No person is alerted, and nobody watches entries in real time.
- For security and legal reasons: protecting accounts, preventing abuse, and complying with the law.
We do not use consumer health data for advertising, for marketing by anyone else, or for decisions about employment, credit, insurance, housing or education.
4. Who we share it with
We do not sell consumer health data. We do not share it with third parties: not with advertisers, data brokers, insurers, employers, researchers or other members. We have no affiliates. If a research project ever needed consumer health data rather than aggregate statistics, we would first ask for your separate consent, saying who the partner is, what they would receive and what for. You could say no, and it would not change anything for you in the app.
We disclose it only to processors, companies that handle it on our behalf, [to be confirmed: data-processing agreements with each provider, limiting them to providing their service to us]:
| Processor | What they do for us | What they receive | Where |
|---|---|---|---|
| Vercel Inc. | Runs the app | Everything you send or view passes through its servers | [to be confirmed: hosting location] |
| [to be confirmed: Neon legal entity] (Neon) | Database | Everything we store | [to be confirmed: database region] |
| [to be confirmed: Resend legal entity] (Resend) | Sends our emails | Your email address and the email: password-reset links and, only if you switch them on, reminders that never name a substance | United States |
| [to be confirmed: mailbox provider] | Hosts our privacy and legal inboxes | Anything you write to us | [to be confirmed: mailbox provider location] |
| Anthropic PBC | AI, for two optional features, and only while they are switched on | (a) photos you choose to scan; (b) side-effect descriptions in your own words that the app could not match itself, together with the names of the substances you track, so they can be matched to our list | United States |
These companies can change. When they do, we update this table, our Privacy Policy and the consent screen, and we show every member the new list the next time they open the app.
No third party collects consumer health data about you over time or across websites through N-of-All.
We may disclose consumer health data when we believe the law requires it, for example under a valid court order. How we handle such demands is set out under Legal requests for data in our Privacy Policy.
The statistics we publish, or give to a research partner, are aggregate figures built from at least 10 people. They do not identify anyone and are not consumer health data.
5. Your rights
These rights come from the laws of Washington, Nevada and Connecticut. We give them to every member in the US.
| Right | How to use it |
|---|---|
| Confirm and access: know whether we hold your consumer health data, get a copy, and get a list of every third party and affiliate we have shared or sold it to | Account → Export my data gives you a full copy straight away. The list of third parties and affiliates is empty, because we have none. You can also write to us. |
| Withdraw consent | Optional choices, such as photo scanning: Account → Privacy. Your core consent: delete your data or your account (below). |
| Delete | Account → Delete my data, or write to us. See What deletion does below. |
| Correct | Edit your entries and profile in the app, or write to us. |
| Take your data elsewhere | Account → Export my data gives you a machine-readable file. |
| Appeal | If we turn down a request, you can appeal (below). |
We will never treat you differently for using these rights. There is one limit we can't remove: N-of-All can't work without your core consent, so withdrawing it means deleting your data or your account.
How to make a request
Use the options in the app, or write to [to be confirmed: privacy email]. Because we never verify email addresses, a message from the address on your account is not enough on its own to show it comes from you, so for access and deletion we may ask you to confirm the request in the app. If your account has no email address, the app is the way to make a request. Someone you authorise can make a request for you; we will ask for proof that they may act for you.
We answer within 45 days. If we need longer, we tell you within those 45 days and explain why, and we take at most 45 days more. Requests are free, at least twice in any 12 months.
What deletion does
You can choose Delete my data, which keeps your login so you can start again, or Delete my account, which removes your login as well.
Erased: lab results, injections, medicines, health history, plans and schedules, check-ins, safety-questionnaire answers, notes, articles you saved or read, feedback, substance requests, notifications, and the health details in your profile (sex, birth year, weight range and lifestyle answers). With Delete my account we also erase your profile, your consent records and your login.
Kept, but cut off from you: your past side-effect reports and substance-use entries. We move them to a new random ID that has no link to your account, give them a new analysis code derived from that ID, and remove your notes, your own words and any batch or source details. They stay because other members' safety statistics are calculated from them, and removing them would quietly change results people rely on. If your entries had been excluded from the statistics as not genuine, we erase them instead.
Your sharing ends. Deleting your account ends your sharing: nothing new is added from that moment. What you shared before stays part of the statistics, and statistics that were already shown or published stay as they are.
Backups and providers: copies in our database backups are overwritten within [to be confirmed: backup window] days. Our database provider holds your data only as part of our database, so what we delete is deleted there too, apart from those backups. Request logs at our hosting provider, email logs, and anything sent to our AI provider are deleted on those providers' own schedules, which are listed in our Privacy Policy. Where the law requires it, we pass your deletion request on to our processors.
Appeals
If we turn down your request, reply to our decision or write to [to be confirmed: privacy email] with the subject "Appeal". We will look at the request again and answer within 45 days, explaining our decision. If you still disagree, you can contact your state's Attorney General: Washington (atg.wa.gov/file-complaint), Nevada (ag.nv.gov) or Connecticut (portal.ct.gov/ag).
6. Deidentified data: our public commitment
The entries kept after deletion (section 5) are held under a random ID with no link to any account, and without your notes or your own words. We treat them as deidentified data, and we publicly commit to:
- keep and use them only in deidentified form;
- not attempt to re-identify anyone from them; and
- never give them to a third party as individual entries, research partners included. They only count toward aggregate statistics.
7. How we protect it
- Your health data and your login details are stored separately, linked only through a random ID. The safety analysis works with a one-way code derived from that ID, not the ID itself.
- Email addresses are stored encrypted. Passwords are stored only as hashes. All connections are encrypted (HTTPS). Password-reset links work once and expire after one hour.
- Access is limited to [to be confirmed: who has staff access]. Our review tools show random IDs, not email addresses. A staff member sees an email address only when typing one in to help a member reset a password.
No system is perfectly secure. If a breach affects your data, we will tell you as the law requires: by email if your account has an address, and in the app.
8. Changes to this policy
We post updates here with a new effective date, and tell you in the app before a significant change takes effect. We will ask for your consent first before using consumer health data for a new purpose, or before sharing it with anyone not listed above. Earlier versions are available on request.
9. Contact
N-of-All, run by a physician licensed and established in Switzerland. Privacy: [to be confirmed: privacy email]