Legal

Privacy Policy

What MyDeficiencies collects, why, who processes it, and the choices you have.

Last updated: August 7, 2026Version 1.0Health-related inputs and findings are covered separately in our Consumer Health Data Privacy Policy.

1. Who this policy covers

This policy applies to visitors, account holders, and purchasers using the MyDeficiencies website. MyDeficiencies is an educational health-information service. It is not a healthcare provider, health plan, or healthcare clearinghouse, so it is not a HIPAA covered entity, and we do not describe this service as HIPAA compliant. We instead describe our own handling of your information honestly below.

2. Account information

Email address: used to sign you in, deliver purchase access, and provide support.
Account identifier: an internal ID that links your reports and purchases to you.
Authentication method: whether you signed in by email link, password, or a supported social provider. We never see your social account password.
Display name: optional, only if you enter one.
Account status: whether the account is active, restricted, or pending deletion review.

We do not ask for your legal name, postal address, phone number, date of birth, or government identifiers to create an account.

3. Health-related information

Medication and supplement inputs, other health-related text you enter, and the educational findings generated from them are handled under a dedicated policy: Consumer Health Data Privacy. In short: it is collected only to produce the report you requested, it is never sold, it is never used for advertising, and you can ask us to delete it.

4. Technical information

Request metadata such as browser and device information, used for security and debugging.
A one-way, non-reversible fingerprint derived from your network address, used to rate-limit form submissions and prevent abuse. We do not store raw IP addresses alongside form submissions for analytics or profiling.
Session and authentication cookies required to keep you signed in, plus a first-party cookie that lets you return to a report you generated before creating an account.
A local browser preference for light or dark theme, stored on your device only.
Application and security logs generated while operating the service.

We do not operate advertising cookies, third-party advertising pixels, or cross-site tracking.

5. Payment information

Payments are processed by Stripe. Card numbers, CVC codes, and full payment credentials are entered on Stripe's hosted checkout and are never received or stored by MyDeficiencies. We retain order records, including plan purchased, amount, currency, status, timestamps, the email used at checkout, and the processor's reference identifiers, so we can grant access, support you, issue refunds where our policy allows, and meet accounting obligations.

Stripe does not receive your report

We deliberately exclude health inputs, report contents, and anonymous report tokens from everything we send to the payment processor.

6. Communications

Transactional email: sign-in links, password resets, email-change confirmations, and purchase access. These are required to operate your account and are not marketing.
Support communication: if you use the contact form, we store your name, email, inquiry type, message, the page you submitted from, and abuse-prevention metadata so we can reply.
Optional email updates: only if you explicitly opt in. Consent is recorded separately from account creation, and every optional message includes an unsubscribe link.

Creating an account, purchasing a report, or making a privacy request never enrols you in marketing email.

7. Analytics and cookies

Product events (such as "paywall viewed" or "checkout started") are emitted to a first-party data layer for product measurement. These events carry counts, plan codes, and interface state only, with no medication names, supplement names, report contents, or other health values, and no email addresses. No third-party analytics or advertising vendor is currently connected to this site. If we connect one, we will update this section before it goes live and will keep health-related values out of it.

8. AI and model processing

Part of each report's narrative is drafted by a large language model reached through the Lovable AI Gateway, which routes to third-party model providers. To do that, we transmit the medication and supplement names you entered together with our own knowledge-base context. We do not transmit your email address, account identifier, payment details, or any name.

We also generate text embeddings of our internal knowledge-base documents to support retrieval. Those documents are our own research content, not your personal information.

What we will not claim

We do not claim that model providers never retain inputs, never train on inputs, offer zero-retention processing, or are HIPAA compliant. Where we have not verified a provider's practice contractually, we say it is unverified rather than making a promise we cannot support.

9. Service providers

We use a small number of providers to run the service, each processing only what their function requires:

Cloud application, database, authentication, and file infrastructure: stores accounts, reports, and operational records.
Hosting and content delivery: serves the website and API responses.
Stripe: payment processing and subscription billing records.
Transactional email delivery: sends sign-in and account emails.
AI model processing via the Lovable AI Gateway: drafts report narrative text.

We do not sell personal information and we do not share it for cross-context behavioural advertising.

10. Retention and deletion

Account records are retained while your account exists.
Reports are retained so you can reopen them; purchased reports are retained for as long as your access lasts.
Contact form submissions are retained so we can handle and audit support requests.
Order, subscription, and refund records are retained for accounting, tax, and dispute purposes even after other data is deleted.
Security, audit, and abuse-prevention logs are retained for a limited operational period.

Account deletion is handled as a reviewed request: your account is restricted immediately, future billing is stopped, an audit record is written, and an administrator completes the removal. We do not claim instantaneous erasure from every encrypted backup. Start a request on the Privacy Request page or from your account.

11. Security

We use administrative, technical, and organisational safeguards designed to protect information, including encrypted transport, row-level database access controls, scoped privileges for administrative operations, re-authentication for destructive actions, audit logging, and rate limiting on public forms. No online service can be guaranteed completely secure, and we make no claim of absolute security.

12. Minors and parental use

MyDeficiencies accounts are for adults. A parent or legal guardian may use this educational service to research information relevant to a dependent, but the service is not designed for children to use independently and children should not create accounts or submit personal information.

The application does not ask for anyone's age or date of birth, does not create child profiles, and does not ask for a child's name or other identifying details. Please do not enter a child's identifying information into any field. If you believe a child has provided personal information to us, contact hello@mydeficiencies.com and we will delete it.

13. Your choices and rights

Edit your display name and email in your account.
Request access, correction, deletion, or a copy of your information at any time.
Unsubscribe from optional email using the link in any such message.
Ask us to delete your health inputs and reports.

See State Privacy Rights for how state law may expand these, and Privacy Request to submit one.

14. Changes and contact

We will update this page when our practices change and revise the "last updated" date above. Questions: hello@mydeficiencies.com.