Privacy Policy

Drug Database is operated by the company behind drug-database.com (“Drug Database”, “we”, “us”), a company incorporated under Swiss law. For the personal data described in this Policy, we act as the data controller with respect to data we collect about you when you sign up for the Service or use the dashboard; and as the data processor with respect to any personal data your application sends through our API on behalf of your end-users (governed by our Data Processing Agreement).

The Service is designed so that, in normal use, your end-users’ personal data never reaches our infrastructure. Read on for the details.

We collect a deliberately narrow set of personal data:

• Account information. Tenant name, owner email address, country code, and (optionally) a billing address. Stored in the tenants table.
• Authentication artefacts. Sign-in (Google or an emailed magic link) is handled by Supabase Auth, which stores your email address and the session tokens behind the dashboard cookie.
• API keys. We store a SHA-256 hash of each key in the api_keys table. We never store the plaintext value; you see it once at creation and are responsible for its safe storage thereafter.
• API usage counters. The api_usage table records, per key and per calendar period, the endpoint called, the HTTP status, the response time in milliseconds, and a request counter. We do not log the drug name, identifier, ATC code, NDC, Pharmacode, GTIN, or any other catalogue value that appears in the request or response.
• Webhook subscriptions. For change-feed and recall webhooks, we store the destination URL and an HMAC signing secret in the webhook_subscriptions table.
• BYOL credentials. Where you supply credentials for a commercial upstream (HCI, Vidal, Rote Liste, etc.) for tenant-scoped passthrough, we store them encrypted with pgsodium AEAD using a per-provider key (seesupabase/migrations/20260602000034_byol_credentials.sql).
• AI assistant conversations. When you use the assistant (the dashboard chat, /v1/chat or the MCP ask tool), your questions and the answers are processed by our AI runtime, Monopea, and the language-model providers it routes to (see Subprocessors). We keep only the conversation identifier and per-turn token counts; the conversation itself is stored by Monopea. Do not enter patient-identifying information in the assistant.
• Payment information. Card numbers and bank details are handled by Stripe and never reach our infrastructure. We receive only a Stripe customer identifier, the last four digits of the card, and the subscription status.
• Support communications. Emails and dashboard messages you send to support, kept for as long as needed to resolve the issue and for our legitimate interest in operational records.

• No protected health information (PHI). Drug Database does not process or store PHI. The /v1/prescriptions/validate endpoint accepts bucketed, non-identifying context only — age band (e.g. “65–74”), sex, a pregnancy flag, eGFR band, and condition or allergy labels — never names, dates of birth, medical record numbers, email, addresses, or free-text notes. Any payload carrying a direct identifier is rejected with a 422 before processing. Screening runs entirely in-project against our own reviewed interaction data; there is no external gateway. The bodies of the request and response, and any warning text generated, are never persisted in Drug Database — only counters and elapsed-time values are retained.
• No catalogue values in logs. Operational logs record key identifier, endpoint, status, and timing. They do not record the drug name, ATC code, NDC, Pharmacode, GTIN, dm+d identifier, or any other clinical content.
• No marketing trackers. The marketing site and the dashboard do not embed third-party advertising pixels, third-party analytics, or session-replay tools. Our own page analytics is first-party and cookieless (see section 8).
• No biometric data. No facial recognition, no voiceprints, no fingerprints.

Under the EU GDPR and the Swiss revised Federal Act on Data Protection (nFADP):

• Performance of a contract. Account information, API keys, usage counters, billing data, and BYOL credentials are processed because they are necessary to deliver the Service you signed up for (Art. 6(1)(b) GDPR; Art. 31(2)(a) nFADP).
• Legitimate interest. Operational logs, security telemetry, fraud prevention, and aggregate analytics are processed to keep the Service running and secure (Art. 6(1)(f) GDPR).
• Legal obligation. Tax records, accounting books, and certain audit log entries are retained because Swiss commercial and tax law requires it (Art. 6(1)(c) GDPR; Code of Obligations Art. 957–958f).
• Consent. The product newsletter (if you opt in) and any non-essential cookies are based on your consent and can be withdrawn at any time (Art. 6(1)(a) GDPR).

Customer-facing Postgres is hosted on Supabase in Switzerland (eu-central-2 Zurich). The application edge runs on Cloudflare Workers in points-of-presence worldwide; Worker instances are stateless, terminate TLS, and forward authenticated requests to the Swiss database.

Outbound email (signup confirmations, billing receipts, dashboard notifications) is sent through Resend (Resend, Inc.); Cloudflare Email Routing is used only as a fallback for verified recipients. Payment events go through Stripe (Stripe Payments Europe Ltd., Ireland, with US sub-processors).

• Account records — for the life of the account. Deleting the account cancels any subscription and removes the records immediately; copies in encrypted backups expire within thirty days.
• API key hashes — a revoked key stops working at once; its hash is kept for thirteen months as an audit record, then deleted.
• API usage counters — daily and monthly request counts, kept for thirteen months, then deleted.
• Operational logs — thirty days.
• Sign-in sessions — until you sign out or the session expires.
• Magic-link tokens — single-use; expire within one hour.
• AI assistant conversations — kept by Monopea for the life of the account and deleted with it. Per-turn token counts (no content) are kept with the billing records.
• Payment event records from Stripe — full event content for ninety days; the event identifier is kept afterwards to prevent double-processing.
• Raw ingestion artefacts (BAG-SL CSVs, AIPS XML, openFDA dumps, etc.) — twelve months, in the sources/raw/{source}/ bucket.
• Ingestion run records (ingestion_runs) — kept indefinitely for audit and provenance.
• Prescription-validation calls — counted in the usage counters above; request and response bodies are never stored.
• Stripe invoice records — ten years, per Swiss tax law.
• Support correspondence — three years after the ticket is closed.

We use the following subprocessors. Each has been reviewed for security posture and signed appropriate data processing terms with us:

We will give thirty (30) days’ notice in the dashboard before adding or materially changing a subprocessor. Enterprise customers may object to a new subprocessor under the terms of their DPA.

The dashboard sets a single first-party session cookie. It is HttpOnly, Secure, and SameSite=Lax, with a maximum age of thirty days, and is revoked when you sign out.

The marketing site sets no advertising or tracking cookies.

Website analytics. We measure visits with first-party, cookieless analytics, hosted on Cloudflare by Monopea, which is run by the same operator as Drug Database. It sets no cookies and stores nothing in your browser. Your IP address and user agent are only used to compute a hash with a salt that rotates daily (each salt is deleted within 48 hours); they are never stored. We keep only the page path, the referring site’s host name, UTM campaign tags, your country, your device class (mobile, tablet or desktop), whether you signed up or completed a checkout, and that daily hash, for 90 days. Ids are removed from paths and drug, substance and class pages are recorded only as their template (for example /drugs/:slug), so what you looked up or searched for is never recorded. If your browser sends Do-Not-Track or Global Privacy Control, nothing is sent.

Personal data is primarily stored in Switzerland. When data crosses borders, we rely on the following safeguards:

• EU → Switzerland. Covered by the European Commission’s adequacy decision for Switzerland.
• Switzerland / EU → United States (Cloudflare control plane, Stripe sub-processors, and language-model providers used by the AI assistant). We rely on the EU–US Data Privacy Framework where applicable and on the European Commission’s 2021 Standard Contractual Clauses (Module 2 controller-to-processor and Module 3 processor-to-processor) with the Swiss FDPIC addendum, supplemented by the technical measures described in the Security Overview.

TLS 1.2 or higher for all client connections, with HSTS preload. AEAD-encrypted BYOL credentials. SHA-256 hashed API keys with no plaintext persistence. HMAC-signed session cookies. Bucketed (never identifying) clinical context on the validation endpoint. Full details are in the Security Overview.

Under GDPR (Articles 15–22) and the Swiss nFADP, you may:

• request access to the personal data we hold about you;
• request rectification of inaccurate data;
• request deletion (“right to be forgotten”), subject to retention obligations under Swiss law;
• request a portable export of the data you provided;
• object to processing based on legitimate interest;
• withdraw consent at any time, where consent is the legal basis;
• lodge a complaint with a supervisory authority — the Swiss Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB) or, for EU residents, the data protection authority of your member state.

Logged-in users can export and delete their account data self-serve from the Your Data & Deletion page. To exercise any of these rights by email, contact privacy@drug-database.com from the address registered to your account. We respond within thirty days.

The Service is for business and professional use by adults. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has created an account, contact us and we will delete it.

When you act as a data controller and use our Service to process personal data of your end-users, our Data Processing Agreement forms part of the contract. Enterprise customers can request a counter-signed copy with their tenant identifier.

We will notify the owner email on file and post a notice in the dashboard at least thirty days before material changes take effect. The effective date at the top of this page always reflects the current version.

Privacy and data-subject requests: privacy@drug-database.com.
Security disclosures: security@drug-database.com.
Incidents: incidents@drug-database.com.