Privacy Policy
Effective [to be confirmed: effective date] · Version 2026-10-us-v3
The short version
- We keep your health entries under a random ID, apart from your login details. That makes them pseudonymous, not anonymous: we can still connect them to your account, because that is how you see your own data.
- Other members never see your entries. They see statistics built from many members' entries, and a statistic is only shown once at least 10 people are behind it and a physician has reviewed it.
- We may use these statistics in reports and scientific research, on our own or with a research partner such as a university. Only statistics leave N-of-All, never your individual entries, unless you have agreed to that separately.
- We don't sell your data and we don't use it for advertising. There are no analytics or advertising trackers in the app.
- A few companies run parts of the service for us: hosting, the database, email and, for two optional features, AI. They may use your data only to provide that service to us. The list changes when we change providers; section 5 always has the current one.
- You can download or delete your data in the app at any time. Deleting your account ends your sharing, but what you shared before stays part of the statistics, cut off from you; section 9 explains exactly which entries.
- Health data is covered in more detail in our Consumer Health Data Privacy Policy.
1. Who we are
N-of-All is run by a physician licensed and established in Switzerland ("we", "us"). We decide what personal data is collected and how it is used, so we are responsible for it. For anything about privacy, write to [to be confirmed: privacy email]. We are not yet incorporated. The operating company will be a Swiss GmbH; it will be named here, with its registered address, as soon as it is registered.
N-of-All is not a health-care provider and HIPAA does not apply to it. The consumer privacy laws described in this policy do apply, and so does Swiss data-protection law, because we are established in Switzerland.
2. What this policy covers
This policy covers everything we hold about you. Your health information also has its own, more detailed policy, the Consumer Health Data Privacy Policy. If the two ever seem to say different things about health information, the Consumer Health Data Privacy Policy is the one that applies.
3. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account and sign-in | An email address, if you give one. It is optional: you can sign up with a passkey instead. We store it encrypted and we never check that it is really yours. A password, stored only as a hash that we cannot read back. If you use passkeys: the public key your device creates, a device name, whether the passkey is synced between your devices, and when it was last used. Your fingerprint or face is checked by your own device and never reaches us. Recovery codes, stored only as hashes. Your role, and a display name if you choose one, which only you see. | You, at signup and in Account |
| Consent records | Each consent you give or withdraw, the exact wording you were shown, the version, the region you chose, and the time | You |
| Health and substance data | Everything you log, described in the Consumer Health Data Privacy Policy | You, plus what the app works out from your entries |
| Settings | Reminder, notification and check-in settings, and whether your entries are marked as test data | You |
| Messages and feedback | Feedback you send in the app, including a screenshot of the page if you choose to attach one (it may show health information); requests to add a substance; emails you send us | You |
| Batch reports | If you report a batch that a lab tested: the product and brand as printed, the batch number, the lab, the test date, what the test found, and the certificate you attach. These reports are stored without any link to your account. | You |
| Technical data | Your IP address and browser details, in our hosting provider's request logs. Your IP address is also held briefly in the server's memory to limit repeated attempts at logging in, signing up, resetting a password, using recovery codes, sending feedback and requesting substances. It is not written to our database. | Your device, automatically |
We do not collect your precise location, your contacts, government ID numbers, payment details or advertising identifiers.
4. How we use it
| Purpose | Data used |
|---|---|
| Run your account, keep it secure, let you sign in and get back in | Account and sign-in, technical data |
| Show you your logs, history, reminders, safety questionnaires, and interaction and organ-load flags | Health and substance data |
| Produce community safety statistics | Health and substance data, under a random ID |
| Write reports and scientific research from those statistics, on our own or with a research partner such as a university | Health and substance data, under a random ID; only aggregate statistics are published or given to a partner |
| Keep those statistics trustworthy by detecting fake, automated or duplicate entries | Health data, patterns of activity |
| Send password-reset emails and, only if you switch them on, reminder emails that never name a substance | Email address |
| Answer your messages and requests, and improve the app from your feedback | Messages and feedback, account |
| Warn members about products: publish checked batch results and official enforcement records | Batch reports (not linked to you) |
| Follow how the service is used, with aggregate statistics for our staff (for example new members per week, or how many people record each substance) | All of the above, counted in aggregate; no individual is looked at |
| Prevent abuse, protect people from harm, and comply with the law | Technical data and account data, as needed |
Automated checks. To protect the community statistics, we run automated checks for entries that are not genuine. Three patterns are left out of the statistics automatically: posting at very high speed, posting the same report over and over, and many new accounts posting the same thing within a short time. Other unusual entries are flagged for a person to review, and that person can reverse any automatic exclusion. We may not tell you when this happens, because telling would help people get around the checks. It never changes your own logs, and it has no legal or similarly significant effect on you.
We don't use your data for advertising and we don't send marketing emails.
5. Who receives your data
We don't sell personal data. We don't share it for targeted advertising. We don't give it to data brokers.
These companies process personal data for us, [to be confirmed: data-processing agreements with each provider, limiting them to providing their service to us]:
| Provider | What they do for us | What they receive | Where |
|---|---|---|---|
| Vercel Inc. | Runs the app | Everything you send or view passes through its servers | [to be confirmed: hosting location] |
| [to be confirmed: Neon legal entity] (Neon) | Database | Everything we store | [to be confirmed: database region] |
| [to be confirmed: Resend legal entity] (Resend) | Sends our emails | Your email address and the content of the email | United States |
| [to be confirmed: mailbox provider] | Hosts our privacy and legal inboxes | Emails you send us, and anything attached to them | [to be confirmed: mailbox provider location] |
| Anthropic PBC | AI, for two optional features, and only while they are switched on | Photos you choose to scan; side-effect descriptions in your own words that the app could not match, together with the names of the substances you track | United States |
When providers change. The companies in this table can change. When they do, we update this table, the Consumer Health Data Privacy Policy and the consent screen, and we show every member the new list the next time they open the app.
We may also disclose personal data:
- when we believe the law requires it (section 12);
- where the law allows it, to protect someone from serious harm;
- if N-of-All is sold or merged. The new owner would have to keep to this policy. We would tell you before the transfer, and we would ask for your consent before your health data is used in a materially different way.
Reports and research. We may publish statistics built from members' pooled entries, for example in a safety notice, a report or a scientific article, and we may do this together with a research partner such as a university. What we publish or give to a research partner is always aggregate figures built from at least 10 people, never anyone's individual entries. If a project ever needed more than that, for example individual entries without names, we would first ask for your separate consent, saying who the partner is and what the project is for. Saying no would not change anything for you in the app. Statistics that have already been published can't be withdrawn.
When you print or download a report from the app and give it to someone, such as your doctor, that is your own disclosure. We are not involved in it.
Product warnings. When a physician has checked a batch report, we publish a short factual summary to members: the product and brand as printed, the batch, the lab and what the test found. The certificate itself is never shown to other members, and nothing in the warning identifies who sent it.
6. Cookies and browser storage
We use a small number of cookies that the login system needs: one keeps you signed in, and short-lived ones protect sign-in against forgery and remember where to send you after you log in.
The app also keeps two things in your browser's local storage: that you closed the beta banner, and the choices you made for your last data export, which can include the substances you picked. These stay on your device and are not sent to us.
There are no analytics, advertising or social-media cookies, pixels or scripts on N-of-All, and no third party can track you here. Because we don't sell or share data for advertising, a Global Privacy Control signal from your browser has nothing left to switch off. You are already opted out.
7. Your rights
Wherever you live in the US, you can:
- see and download what we hold about you: Account → Export my data;
- correct it: edit it in the app, or ask us;
- delete it: Account → Delete my data (section 9 explains what deletion keeps);
- withdraw consent: optional features in Account → Privacy; your core consent by deleting your data or your account;
- get a list of the third parties we have shared or sold your data with. There are none;
- appeal if we turn down a request.
Some states give you the right to opt out of the sale of your data, targeted advertising or certain kinds of profiling. We do none of these, so there is nothing to opt out of.
How to make a request. Use the tools in the app, or write to [to be confirmed: privacy email]. Because we never verify email addresses, a message from the address on your account is not enough on its own to show that it comes from you, so for access and deletion we may ask you to confirm the request in the app. If your account has no email address, the app is the way to make a request: we have no other way to know it is you.
Someone you authorise can make a request for you. We will ask for proof that they may act for you, and we may ask you to confirm in the app.
We answer within 45 days. If we need longer, we tell you within those 45 days and explain why, and we take at most 45 days more. Requests are free, at least twice in any 12 months. If a request is clearly unfounded or excessive, we may charge a reasonable fee or decline it where the law allows, and we will tell you why.
Appeals. If we turn down a request, reply to our decision or write to [to be confirmed: privacy email] with the subject "Appeal". We will look at the request again and answer within 45 days. If we still say no, we will tell you how to contact your state's Attorney General.
We will never treat you differently for using your privacy rights.
If a member has died. A family member or legal representative can write to us. We will ask for proof of the death and of their authority, and handle the request as the law that applies allows.
Batch reports have no link to your account, so they can't appear in your export or be deleted with your account. If you want a report removed, write to us with the product and batch, and we will remove it.
Residents of Washington, Nevada and Connecticut have further rights over health data. They are described in the Consumer Health Data Privacy Policy, and we give them to every member in the US.
8. How we protect it
- Your login details and your health data are kept in separate parts of the database, linked only through a random ID. The safety analysis works with a one-way code derived from that ID.
- Email addresses are stored encrypted, and we find your account through a keyed hash of the address, not the address itself. This protects the addresses if a copy of the database ever leaks. It does not protect them from someone who takes over our running servers, which hold the keys.
- Passwords are stored as bcrypt hashes. Password-reset links work once and expire after one hour. Passkeys are checked on your own device.
- All connections to N-of-All are encrypted (HTTPS).
- Access to our systems is limited to [to be confirmed: who has staff access]. Our review tools show random IDs, not email addresses.
No system is perfectly secure, and we can't promise that ours will never be breached. If a breach affects your data, we will tell you as the law requires: by email if your account has an address, and in the app.
9. How long we keep it
| Data | How long | Then |
|---|---|---|
| Account and sign-in details | As long as your account exists | Erased when you delete your account |
| Your health entries, questionnaire answers, notes, feedback and substance requests | As long as your account exists, or until you delete them | Erased, with one exception: your past side-effect reports and substance-use entries are moved to a new random ID with no link to you, with your notes, free text, and batch and source details removed, and kept for safety analysis and for the reports and research built from it. If those entries had been excluded from the statistics as not genuine, they are erased too. |
| Consent records | As long as your account exists | Erased when you delete your account |
| Password-reset links | 1 hour, single use | Expire |
| IP addresses held for rate limiting | Only in the server's memory, normally for a few minutes and at the latest until the server restarts | Discarded |
| Hosting request logs | [to be confirmed: Vercel log retention] | Deleted by the provider |
| Email delivery logs | [to be confirmed: Resend log retention] | Deleted by the provider |
| Data sent to our AI provider | [to be confirmed: Anthropic retention] | Deleted by the provider |
| Database backups | [to be confirmed: backup window] days | Overwritten |
| Beta "test data" | Until public launch | Deleted |
| Batch reports | Published reports: while the warning is relevant. Reports we decide not to publish: the certificate is deleted at that moment | Removed on request (section 7) |
After you delete. Deleting your account ends your sharing: nothing new is added from that moment. What you shared before stays part of the statistics, cut off from you as described above, and statistics that were already shown or published stay as they are.
We don't currently delete inactive accounts automatically. If we introduce a time limit, we will announce it here first.
10. Where your data is processed
Our database is in [to be confirmed: database region]. Our hosting, email and AI providers process data in the United States, and our hosting provider may also handle requests in other countries through its network. Wherever your data is processed, this policy applies.
When data of members in Switzerland or the EU goes to a provider in the United States, it is protected by the following safeguards: [to be confirmed: transfer safeguards for each US provider]. These safeguards bind the providers; they do not bind US authorities.
11. Children
N-of-All is only for adults 18 and older. We don't knowingly collect data from anyone younger, and if we learn that we have, we delete it.
12. Legal requests for data
N-of-All holds information about the use of substances that may be unapproved, controlled or illegal where you live. If we receive a subpoena, warrant, court order or other demand for data:
- We disclose data only when we believe the law requires it, and only what the demand covers.
- We check whether the demand is valid. Where we believe it is invalid or broader than it needs to be, we may object to it or ask for it to be narrowed.
- Unless the law or the demand itself prevents it, we will try to tell you before we disclose your data, so that you have a chance to object.
- We can't promise that your data will never be disclosed under a valid order. What we can do is collect less, keep it apart from your identity, and let you delete it.
13. Beta and test data
While N-of-All is in private beta, you can mark your entries as test data, and change that later in Account → Privacy. Test data never counts toward community statistics, and we delete it before public launch.
14. Members in Switzerland and the EU
Swiss data-protection law (the revised Federal Act on Data Protection) applies to everything we do. For members in the EU, the General Data Protection Regulation (GDPR) applies as well.
Why we are allowed to process your data:
| What | Legal basis |
|---|---|
| Your health data | Your explicit consent (GDPR Art. 9(2)(a); revFADP Art. 6(7)) |
| Your account and the service itself | Our agreement with you (GDPR Art. 6(1)(b)) |
| Security, abuse prevention and keeping the statistics trustworthy | Our legitimate interest in a reliable and safe service, weighed against your rights (GDPR Art. 6(1)(f)) |
| What the law requires of us | Legal obligation (GDPR Art. 6(1)(c)) |
In your region, the AI features (photo scanning and free-text matching) and the batch and source fields are switched off.
You have the rights described in section 7, and also the right to restrict processing, to object to processing based on our legitimate interests, and to complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to the data-protection authority where you live or work. Withdrawing consent does not affect what we did with your data before you withdrew it.
Our representative in the EU: [to be confirmed: EU representative (GDPR Art 27)].
15. Changes to this policy
When we change this policy, we post the new version here with a new effective date. If a change matters, for example a new use of your data or a new kind of recipient, we tell you in the app before it takes effect, and where the law requires it we ask for your consent again. Earlier versions are available on request.
16. Contact
N-of-All, run by a physician licensed and established in Switzerland. Privacy: [to be confirmed: privacy email]