The notices
Terms of service
The deal in plain words: we publish graded evidence and tools, you use them as information and not as care.
Updated 2026-09-01
Privacy policy
What we collect and why, what we never do with it, and how to make us prove it.
Updated 2026-09-01
Health data and consent
The most sensitive thing we hold, and the narrowest set of things we are allowed to do with it.
Updated 2026-09-01
Provider terms
For clinics, labs and practitioners. Short version: you are responsible for your clinical claims and for the patient data you receive, and no amount of spend changes an evidence grade.
Updated 2026-09-01
Partner and affiliate terms
We only link commercially to things graded B or better, we disclose at the link, and editorial treatment is never part of the deal.
Updated 2026-09-01
Review guidelines
The rules a review is judged against, so a removal is never a matter of taste.
Updated 2026-09-01
Affiliate disclosure
Some links earn us a commission. Here is exactly which ones, and the rule that stops that from shaping what we say.
Updated 2026-09-01
Cookies and your choices
Three categories, one of which you cannot turn off because sign-in would stop working. The other two are off until you say otherwise.
Updated 2026-09-01
Accessibility statement
We target WCAG 2.2 Level AA. Here is where we meet it, where we know we do not, and how to tell us about something we have missed.
Updated 2026-09-01
Security and responsible disclosure
If you have found something, tell us. We will not threaten you for it.
Updated 2026-09-01
Which of these vary by market, and how
Every notice is one page. The facts inside it come from the market you are reading.
- Privacy, health data, and every page listing your rights change the regime, the rights list, the request route, the statutory officer, the response deadline, the supervisory authority, the lawful basis and the storage region.
- UK, EU, Germany and Spain get GDPR or UK GDPR rights, a Data Protection Officer contact, and their own supervisory authority — plus national additions such as the German Heilmittelwerbegesetz and the Spanish Royal Decree 1907/1996 on health claims.
- India gets a DPDP Act itemised consent notice, a named Grievance Officer route that must be used before the Data Protection Board, a 72-hour grievance acknowledgement, and Indian storage. The Hindi surface exists because the DPDP Act gives you the right to the notice in your own language.
- United Arab Emirates gets the PDPL, the DHA and DoH licensing and advertising position, and the Federal Law 2/2019 restriction that keeps UAE health data inside the UAE.
- United States gets HIPAA where a Business Associate Agreement is in place, the FTC Health Breach Notification Rule for everything outside it, and state law — including the Washington My Health My Data Act, whose separate-consent standard we apply to every US member rather than only to Washington residents.
- Provider, partner and API terms change the advertising and claim rules that apply, because those are what differ most between markets.