Privacy policy

This policy explains what Voxsanity collects, why, where it is held, how long we keep it, and what you can ask us to do with it. It is written to meet our obligations under the Australian Privacy Act 1988 and the Australian Privacy Principles.

Who we are

Voxsanity ("we", "us", "our") is a registered business name of Voxsanity Pty Ltd (ABN 82 700 348 867), trading as Voxsanity. You can reach us through our contact page, or at privacy@voxsanity.com.au.

The short version

Voxsanity is free and most of it can be read without an account. If you do not create one, do not sign up for an email update and do not write to us, the only thing we hold about you is analytics, and only if you accepted analytics when the site asked.

We do not sell anything and we do not sell data. There is no advertising on this site.

What we do not collect

We do not store which health conditions you look at linked to your identity. We do not build a search history against you. There is no free-text search box on this site that records what you typed.

We do not ask for, and have no use for, your name, date of birth, Medicare number, address or any clinical detail. Do not send us any of that.

What we collect, and why

If you create an account

Your email address and a password, which is what an account is. We use it to sign you in and to send you the emails you asked for.

An account also holds the things you choose to save. Each of these is visible only to you:

The conditions you follow, the sponsors you follow and the medicines you follow, so we can show them on your dashboard and send the updates you opted into.
The trials you saved to your shortlist, held by their public registry identifier.
Your tags, which are labels you type yourself to group what you follow, and which of them you put on what.
Any saved views, which are filter settings you asked us to remember.
Your account profile, which records when the account started.
Any subscription record from when this site had paid plans. It holds payment references only. No card details are held here or anywhere on Voxsanity servers.
The corrections you have asked for, meaning requests to fix something we hold about you, and whether we have acted on them.
A record of the data-download links you have requested, so a link cannot be used twice.

What you follow can say something about your health, or somebody else's. We treat it that way: it is visible only to your own account, it is never sold, and it is never shared with anybody.

One thing about tags. A tag is the only free-text field on this site where you might write something about another person. Please use a nickname, an initial or a code, never a real name, a date of birth or a diagnosis. A tag sits beside the conditions attached to it, so a real name would record somebody else's health information in an account they cannot see.

If you sign up for an email update

We store your email address, and where the update is about a particular condition, the identifier of the condition you chose. That is a system identifier, not a medical record. We do not store your name or any reason for your interest.

You can unsubscribe with one click from the link in every email we send. There is no login required and the link does not expire. When you unsubscribe we keep a record that you did, so that we can show we stopped when you asked. If you would rather the address were removed entirely, ask us and we will remove it.

Subject lines are deliberately general, for example "An update on conditions you follow" rather than the name of a condition or a medicine. A subject line is the part visible on a lock screen without the email being opened, and the part that persists in our email provider's own logs.

We also keep the log of emails we have sent you, and whether the alert emails we sent you were delivered or opened. Both are kept so we can answer "did that email arrive" without guessing, and both are removed when an account is deleted.

If you join a waitlist or ask us to add a condition

A waitlist or interest form stores the email address you gave and the answers you typed, and nothing else. It is not linked to any account you may hold.

If you register interest as a business, through the form at /for-businesses/, we store what you submit: your email address, the organisation you name, the organisation type you select from the list, and any free text you write, so we can follow up with you. This does not create an account and is not linked to one.

A condition request stores the condition you asked for and, if you chose to give one, an email address to tell you when it is added. We have not set an automatic deletion window for condition requests, because a request is a record of what people are asking for and has no natural expiry. Ask us and we will delete yours.

If you write to us

The contact form and the report-an-issue links store your message, the category you chose, and an email address to reply to. We have not set an automatic deletion window for this data: a report about an error is usually the reason we changed something, so it is the record of that correction. It is not linked to any account, and deleting your account does not remove it. Ask us and we will delete it.

So that we can answer safely, a message is flagged internally where it looks like it may describe a side effect from a medicine. The flag only changes how your message is prioritised and answered. It tells us to point you to the Therapeutic Goods Administration and to your prescriber rather than treat your message as a website correction. It is stored with your message, it is shared with nobody, and we report nothing to the TGA on your behalf.

Analytics, and only if you accept

We use Google Analytics 4 to see which pages people use. If you decline analytics, or never answer the cookie notice, no analytics cookie is set and nothing is sent to Google.

If you accept, it records the pages you view, which include the addresses of condition pages and therefore name the condition, and a small number of actions such as following a condition, against a pseudonymous identifier Google gives your browser. That identifier is not your name, your email address or your Voxsanity account. We never send your account identity to Google and we never join analytics data back to your account. IP anonymisation is on, and we strip condition, drug, diagnosis and treatment parameters out of the page address before it is sent.

We look at this in aggregate. The underlying records Google holds are per-event and pseudonymous rather than anonymous, so we say that rather than call them anonymous. You can also opt out with Google's own Analytics Opt-out Browser Add-on.

Campaign measurement

Separately from Google Analytics, and again only if you accept analytics, we keep our own record of visits that arrive from one of our campaign links. It holds the campaign the link came from, the page you landed on, whether you read further, and whether you afterwards joined a mailing list or created an account, filed against a randomly generated reference for that visit. That reference holds no email address, no account, no IP address and nothing that describes you, and there is nothing stored anywhere that connects it to you. Your browser keeps it for up to three days and then discards it; on our servers the visit record is deleted after two months. It is shared with nobody. If you decline, none of it is created, and campaign information already stored is deleted along with the analytics cookies.

Cookies and browser storage

We set one cookie, to record your answer to the cookie notice. Analytics cookies are set only if you accept. These are the cookies this site causes to be set.

Cookie	Set by	What it is for	Kept for
consent_given	Voxsanity	Records your answer to the cookie notice, so you are not asked again.	About 12 months
_ga, _ga_…	Google Analytics	Tells us how many people visit and which pages they use. Set only if you accept.	About 13 months

We do not set any cookie to keep you signed in. Your session is kept in your browser's own storage instead, and it is cleared when you sign out or clear your browser's site data.

We also keep a small number of display preferences in your browser's own storage: whether you told us you are looking on behalf of somebody else, and whether you have dismissed a prompt. These are written only when you actively choose them, they stay on your device, they are never sent to our servers, and they are not linked to your account or to any condition. Clearing your browser's site data removes them.

Organisations we approach by email

We write to health and community organisations, in Australia and overseas, to tell them this free resource exists. For each contact we hold an email address, the name of the organisation, the country, which list it came from and a reference to the file and row it was imported from, the date the record was added, and whether a message was sent, delivered, opened or replied to. We do not hold, for most of these addresses, a record of the web page it was published on or the date it was found there. This is about organisations, not about the people who read this site, and none of it comes from anything you do here.

If you tell us to stop, we add the address to a suppression list so that nothing is ever sent to it again. That is the one record that a request to delete everything does not remove, because deleting it would resume sending to somebody who asked us not to. It holds the address and nothing else.

Where your data is held

Your account data, meaning your email address, what you follow and what you save, is held in Australia, in the Sydney (ap-southeast-2) region.

How long we keep things

Your account. We retain your account data for as long as you have an account. Delete the account and it goes, along with everything listed under "If you create an account" above.
Analytics. Analytics data (Google Analytics 4) is retained for 2 months. Google holds per-browser records, which include the addresses of condition pages, for 2 months.
Campaign measurement. We keep it for two months. Because there is nothing in it that identifies you, deleting your account cannot reach it, since no part of our system can tell which of these records was yours, so it is deleted on that schedule instead.
Glossary downloads. When somebody downloads the glossary from our glossary page, we add one to a count of how many times that file has been downloaded that day. That is the whole record: which file, the date, and a number. There is no account, no sign-in, no identifier, no IP address and no separate entry per download, so there is nothing in it that could be traced back to you by us or by anybody else. Downloading the glossary needs no account and never will.
Email records. Our own log is deleted with your account. Our email provider keeps its own separate record of every message it sent, which is held under Resend's retention policy rather than a period we set, and deleting your Voxsanity account does not remove it, because it is theirs rather than ours.
Payment records. Stripe holds the payment and invoice records from when this site had paid plans, and we keep payment and invoice records for 7 years because Australian tax law requires it.
Our own copy of what Stripe told us. When Stripe told our servers that a payment, a refund or a subscription change had happened, we stored that notification whole. A checkout notification carries the name, email address and billing address entered at the checkout, and a refund notification carries the same three details. So those personal details are removed from it after 90 days, and the notification is kept without them because it is what stops the same event being processed twice.
Email sign-ups you never confirmed. If you give us your address to receive the weekly Australian trial update and never click the confirmation link, we delete the address 30 days later. We do this automatically, every day, whether or not you ask. Until you confirm, we have never had your permission to email you, so there is nothing we can use the address for and no reason to keep it.
Messages, reports, waitlist entries and condition requests. No automatic window, as stated in each section above. Ask and we will delete them.
Backups. Our database provider keeps daily backups for up to 7 days. A deleted row can survive in a backup until it rotates out.
Data-download links. A link we email you is single use: it works once, within an hour.

Accounts are for people aged 18 and over

Voxsanity accounts are for people aged 18 and over, and the site is not directed at children. We do not knowingly collect personal information from a child.

We do not ask your age and we have no way to verify it, so this is a statement about who the site is for, not a check we perform. We would rather say that than imply a gate that does not exist. If you believe a child has created an account, tell us through our contact page and we will delete it.

Your rights

You can ask us for any of the following, and you do not need to explain why.

Access. A copy of everything we hold against your account. Ask from your account page and we email you a single-use download link.
Correction. If something we hold about you is wrong, tell us and we will fix it. Requests you make are recorded as the corrections you have asked for, so you can see whether we have acted.
Deletion. Delete your account and everything keyed to it goes with it. Two things survive and we would rather say so here than let you find out afterwards: the payment and invoice records Australian tax law requires us to retain for seven years, which Stripe holds, and the suppression record described above, if you asked us to stop emailing an address. What deletion does and does not reach is set out at delete my data. If you do not hold an account, ask us and we will delete what we hold.
Unsubscribe. One click, from any email we send.

If you would rather not do any of this yourself, email privacy@voxsanity.com.au or use the contact form and we will do it for you.

Service providers, and disclosure overseas

Australian Privacy Principle 1.4(f) and (g) require a privacy policy to say whether personal information is likely to be disclosed to recipients overseas, and which countries they are in. So:

Provider	What it does for us	Where
Supabase	Holds the database, including your account. Your browser contacts it directly when you sign in, so it receives your IP address.	Data stored in Sydney. Supabase is a United States company and its staff can access the service for support and maintenance.
Netlify	Serves every page, so it receives your IP address.	United States
Resend	Sends our email. Your browser never contacts it.	United States
Google	Google Analytics, which runs only if you accept analytics, and Google Fonts, which loads the site's typefaces on every page. Google also hosts the mailboxes the outreach email described above is sent from and replied to.	United States, and other countries in which Google operates
Smartlead	Sends the outreach email to organisations. Operated by 521 Products Pty Ltd (ACN 645 593 835), an Australian company. No account, email-update or reading data is sent to it.	Australia. Its own data processing terms name processing in Singapore, India, Japan, the United States, Canada, Germany, Ireland and Sweden as well.
MillionVerifier	Checks that an outreach contact address still works. It receives only those organisation addresses. No account, email-update or reading data is sent to it.	Hungary, and its suppliers in other countries including the United States. Operated by GBD Software as a Service Private Limited Company, of Lakitelek, Hungary.
GitHub	Holds the private repository in which the outreach contact records are kept and backed up. This is not where the site is hosted, and no account or reading data is sent to it.	United States
Stripe	Past payment records only. This site takes no payments now. Stripe holds the records of the payments it processed while it did. Your browser does not contact Stripe while you are reading the site.	United States and Ireland

Nothing else is loaded from anywhere else. There is no advertising network, no session recording, no heatmap tool, no chat widget, no social media embed, no A/B testing tool, and no image or video hosted elsewhere.

We take reasonable steps to ensure these providers handle personal information consistently with the Australian Privacy Principles. If you would rather nothing about you left Australia, the whole public site can be read without an account and without accepting analytics.

Security

Connections to this site are encrypted. Passwords are stored only in a form nobody can read back, including us. Access to the database is restricted by row-level security so that an account can reach its own rows and nothing else. We hold no payment card details.

No system is perfectly secure. If you find a weakness, please tell us through the contact page and we will act on it.

Making a complaint

If you think we have mishandled your personal information, tell us and we will try to put it right.

Contact us through our contact page, or email privacy@voxsanity.com.au, and describe what happened. You do not need any particular form of words and you do not need to quote this policy.
We will acknowledge your complaint, look into it, and tell you in writing what we found and what we have done. We treat privacy complaints as a priority and will keep you posted on where yours is up to.
If you are not satisfied with our response, or we do not respond, you can take it to the Office of the Australian Information Commissioner, the regulator for the Privacy Act 1988. OAIC: oaic.gov.au, phone 1300 363 992, or GPO Box 5288, Sydney NSW 2001. You are entitled to go to the OAIC directly, though they will usually ask that you raise it with us first.

Changes to this policy

We may update this policy from time to time. The version published on this page is always the current one.

Contact

Privacy questions can be sent through our contact page, or to privacy@voxsanity.com.au.