Privacy policy
Deployment information is incomplete. The administrator must add the data controller and privacy contact before public launch.
Who operates this platform
Data controller: not yet configured.
Privacy contact: not yet configured.
Public evidence data
The platform stores publication metadata and group-level summary statistics. It is not intended to store identifiable patient data. Do not enter patient names, identifiers, dates of birth, or individual-level health records.
Optional usage analytics
When enabled by the administrator and accepted by you, first-party analytics count page views, completed analyses and exports by UTC date. The application does not record raw IP addresses, referrers, browser fingerprints, search terms, or unique visitor identifiers for analytics. Daily event counters are retained for a rolling 90 days and purged when the next consented event is recorded. Optional analytics are based on your consent. You can withdraw it below; existing anonymous aggregate counts cannot be attributed to you.
Browser storage and accounts
A local storage entry remembers your privacy choice for 180 days. Administrative sign-in uses an essential session cookie, with a 30-minute inactivity timeout. Account email addresses, password hashes, assigned permissions and curation audit events are stored to operate and secure the service. A secret-keyed hash of the connecting IP is used for login throttling and retained for at most 24 hours, with cleanup on subsequent login attempts. Hosting providers may separately retain access logs.
Metadata services
Administrators can request publication metadata from Crossref and NCBI PubMed. Requests are sent by the server and include the requested DOI or PMID. Public analyses do not send study selections to those services. Following a publication link opens the publisher or PubMed website under its own policy.
Deployment-specific information and requests
Contact the operator for information about your account data, applicable access or erasure rights and hosting arrangements. The operator must document its legal bases for account/security processing, recipients, transfers, retention periods and relevant supervisory authority below before public launch.