Privacy policy

Who we are

EvenGut (“we”, “us”) is an education and organization tool for people with IBS. It helps you keep track of what you've tried and prepare for appointments. You can reach us at [contact email], or by mail at [Mailing address]. Our privacy officer is [Privacy officer name].

What we collect, and when

When you arrive from an ad or a link

Links to EvenGut, including our ads on Instagram and Facebook, can carry campaign tags: which website sent you, the kind of link, the campaign and the ad (for example, “meta” and “paid_social”). The home page also has a few versions, one for each kind of ad (such as the one at /for/bloating). Your browser tab keeps the first campaign tags it arrived with and which version of the home page you saw, in session storage, until you close the tab. The name of an ad or a page can hint at a symptom, so when an account or the phone app list keeps them, they're stored encrypted (see below), and a review you save doesn't keep them. We never send them to Meta, Google or any other ad network.

While you take the review

Your answers are kept in your browser's session storage for that tab only, so refreshing the page doesn't lose them. They're cleared when you close the tab. We don't receive them unless you download a visit sheet or save your review.

When you download a visit sheet

Your answers, and the first name you type if you add one, are sent to our server, turned into a PDF and sent straight back. We don't store them, and we don't log them.

When you save your review

We store:

• your email address;
• your answers, encrypted (AES-256-GCM) with a key kept outside the database;
• whether your answers included a warning sign (a yes or no), so we can check how often safety messages appear;
• your consent choices, the version of the consent wording you saw, and when you saved and confirmed;
• an anonymous reference for your browser tab.

We don't store the first name you type for your visit sheet, or your tab's campaign tags. A review saved before we stopped keeping them still has the campaign tags it was saved with, until it's deleted.

When you sign in or create an account

To sign you in, we email you a 6-digit code and a link that work once, for 10 minutes. We store the code and the link only as one-way hashes, with your email address, and delete them a day or two after they expire (our daily clean-up deletes them once they're a day past). While you wait for the code, the sign-in form keeps the address you typed and the time the code was sent in that browser tab's session storage, so the code still works if the page reloads (for example, after you switch to your mail app). The form uses it only for the code's 10 minutes. It's removed when you sign in, go back to change the address or sign out, and it's gone when you close the tab.

When a sign-in creates your account, the account keeps the campaign tags and home page version of the browser tab where you asked for the code. They travel with the sign-in code and are stored encrypted with your account, like your health information. They're in your export (Export my data) and deleted with your account. We use them only to count how many accounts each ad and each version of the home page brought, and how many of those logged three days.

When you use the app

Your app account keeps your email address, your settings and what you put in the app: your daily logs, your case file (with lab values and the lab reports you upload), your trials and case reviews, and your investigation. The investigation is your story (the answers you give and the medicine names you type), where each avenue stands (with any note you add), the visits you record, and your self-tests (the days you ticked, how each step went and your notes).

Your health information is stored encrypted (AES-256-GCM) with a key kept outside the database, like saved answers. So the app can sort and count without opening it, a few plain fields are not encrypted: ids, dates, kinds and statuses, such as which guideline item an avenue status or a self-test is about and whether it's ruled out, planned or finished. For each warning sign the app shows you, plain fields say which warning sign it was, how urgent, where it came from (the safety check, your story, your log, a lab value or something you typed), when, and whether you've said you talked to a doctor about it. The words that raised it are never kept, only a one-way fingerprint of them, so the same note doesn't raise it twice.

You can download all of it at any time with Export my data in the app. Deleting your account deletes all of it, your story, avenue statuses, visits and self-tests included.

The phone app email list

If you ask us to tell you when the iPhone or Android app is out, we store your email address, the campaign tags and home page version from your tab (encrypted), the version of the consent wording you saw, when you joined and confirmed, and when we told you about each app. We email you a link to confirm your address, and addresses that aren't confirmed are deleted after 7 days. After you confirm, you get at most two emails from this list: one when the first app is out and one when the other is. If one app is already out when you join, your confirm email and the confirm page give its link, and the list sends you at most one email, when the other is out. Once both apps are out, the list takes no new addresses. The unsubscribe link in any email from this list takes your address off this list and off launch news. Deleting your EvenGut account also deletes your address from the list. The list is kept apart from saved reviews and from launch news.

Emails

We use your email address to send the confirm link and your private review link, your sign-in codes, daily reminders if you turn them on, the phone app emails if you join that list, and launch news and occasional updates only if you ticked that box. Our emails never contain anything about your health.

Pre-orders

Stripe handles payment. Stripe collects your card details and email address under its own privacy policy; we never see your full card number. We receive the payment status, the amount, and the campaign tags and anonymous tab reference described above. Nothing about your review or your health is sent to Stripe.

Analytics

We count anonymous events, such as “a review was started” or “a visit sheet was downloaded”, to learn whether EvenGut is useful. Events never include your answers. When a review is completed, the event includes how many guideline options you've explored and how long the review took. When a safety message is shown, the event includes which kind it was (for example, “bleeding”), with nothing that identifies you.

To learn which ads work, five counts carry the campaign tags of the link that opened your tab and which version of the home page you saw (“none” when there were none): a home page was opened, a review was started, a review was finished, an account was created, and an account logged its third day. They never carry anything about your health. The account and third-day counts are sent from our server with no identifier at all: not your email, your account or your browser tab. Our analytics provider also adds campaign tags to every other event from your tab, including events from the app, such as a day being logged: the tags of the newest tagged link opened in that tab.

Analytics use no cookies. Their identifier lives in session storage and is gone when you close the tab. Before an event leaves your browser, web addresses are cut at the “?” and private review links are removed. We don't create profiles of individual people, and our analytics provider is set to discard IP addresses.

Vercel, our host, also counts visits to the public pages (never the app): which page, the site you came from, and your country, browser and device type. It uses no cookies and doesn't store your IP address. Before a visit is counted, its web address is cut at the “?”, keeping only an ad link's campaign tags, and private review links are removed.

IP addresses

We don't store your IP address. To stop abuse, we turn it into a keyed one-way hash, which can't be turned back into the address, and use that to limit how often saves, sign-in codes, downloads, checkouts, phone app sign-ups and anonymous counts can be made. For downloads, checkouts and counts, the hash is kept only in our server's memory, and deleted at most an hour and a minute after your last request. A sign-in code keeps it until the code is deleted, a day or two after it expires. The phone app form keeps it with each request for a day or two (our daily clean-up deletes it once it's a day old); an address on the phone app list keeps none. A saved review keeps the hash of the request that saved it until the review is deleted.

Error reports

When something breaks, an error report goes to Sentry with request contents, cookies and web address parameters removed.

Why we use it

• To show your results and make your visit sheet.
• To save your review and email you its link, when you ask us to.
• To send launch news and updates, only if you opt in.
• To email you when the phone apps are out, if you ask.
• To count, for each ad and each version of the home page, how many people started and finished the review, created an account and logged three days.
• To take pre-orders and give refunds.
• To understand, in aggregate, whether EvenGut helps people, and to keep it secure.

What we never do

• Sell or rent your information.
• Use advertising pixels or third-party trackers.
• Send anything about you to Meta, Google or any other ad network.
• Put health information in emails, web addresses or payment records.
• Share your answers with your doctor, employer or insurer. Only you decide who sees your visit sheet.

How long we keep it

• Answers in your browser: until you close the tab.
• Saves you don't confirm: deleted after 7 days.
• Saved reviews: until you delete them, using the button on your saved review page, or ask us to.
• Your app account and everything in it: until you delete your account in the app, or ask us to.
• Your email for launch news: until you unsubscribe or ask us to delete it.
• The phone app email list: until you unsubscribe, delete your account or ask us to delete it. Addresses that aren't confirmed: deleted after 7 days.
• Campaign tags and home page version: in your browser tab, until you close it; with a sign-in code, until the code is deleted (a day or two after it expires); with your account or your phone app list address, as long as those are kept. Pre-order records keep the campaign tags (not the home page version) as long as the pre-order record is kept. New saved reviews keep none; a review saved before we stopped keeping them keeps the ones it was saved with until it's deleted.
• Pre-order records: as long as tax and accounting law requires.
• Rate-limit hashes: as described under IP addresses above.
• Analytics events: [retention period].

Who processes data for us

These providers process data only to run their part of EvenGut for us.

Some of these providers are in the United States, so your information may be processed there.

How we protect it

Everything travels over HTTPS. Saved answers are encrypted before they reach the database. The links we email use long random codes, and we store only a one-way hash of each, so a copy of our database can't open your review. Access to our systems is limited to the people who run EvenGut.

Your rights and choices

• See your information: ask us for a copy of what we hold about you.
• Delete it: delete a saved review yourself from its page at any time, or ask us to delete everything we hold about you.
• Correct it: ask us to fix anything that's wrong.
• Withdraw consent: unsubscribe using the link in any email, or ask us to delete your saved review.

Email [contact email] to use any of these rights. We'll reply within 30 days. You can also complain to a privacy regulator (see below).

If you're in the United States

EvenGut isn't a healthcare provider or health plan, so HIPAA doesn't apply to it. The Federal Trade Commission's Health Breach Notification Rule does. If there's ever a breach of your unsecured health information, we'll notify you, the FTC and, where the rule requires, the media, without unreasonable delay and no later than 60 days after we discover it. Some states give you extra rights over health data; you can use the rights above wherever you live.

If you're in Canada

We handle personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA). Our privacy officer, [Privacy officer name], is accountable for it. If a breach of our safeguards creates a real risk of significant harm to you, we'll report it to the Office of the Privacy Commissioner of Canada, notify you, and keep a record of it. You can complain to the Office of the Privacy Commissioner of Canada.

If you live in Quebec, Law 25 also applies. Our privacy officer is the person in charge of protecting personal information. Your information may be processed outside Quebec by the providers listed above. You can ask to see and correct your information, and you can complain to the Commission d'accès à l'information du Québec.

Children

EvenGut is meant for adults. It isn't directed at children, and we don't knowingly collect their information.

Changes to this policy

When we change this policy, we'll update the date at the top. If a change affects how we use information you already gave us, we'll ask for your consent again first.

Contact

Privacy officer: [Privacy officer name]
Email: [contact email]
Mail: [Mailing address]