Legal

Privacy Policy

Last updated: 18 October 2026

This policy explains what OpenSupport collects when you use our app (app.opensupport.me and our iOS and Android apps), our member site (member.opensupport.me), the assistant on our website and on partner sites, and this website, and what we do with it. We have written it to say exactly what our services do.

Who we are

OpenSupport LLC, a New Jersey limited liability company (“OpenSupport”, “we”, “us”), runs these services and decides how the information in them is used. The exception is an assistant or member site a pharmaceutical company runs for its own programme: there the company decides, and we handle the information for it (see “Pharmaceutical companies’ programmes” below).

You can reach us about anything in this policy at privacy@opensupport.me, or by post at OpenSupport LLC, 28 Spring St, Unit #221, Princeton, NJ 08542, United States.

Our patient services are designed for people in the United States: for example, the crisis numbers they show are US numbers. Wherever you are, you can use the rights described below.

What we collect

The questions you ask and the answers. Before we store a question, we remove names, email addresses, phone numbers and other identifiers our systems can detect. Detection is automatic and can miss things, so please leave them out.
Without an account (as a guest, or in an assistant on a website), your questions and the answers are kept against an anonymous session that is not linked to you, and deleted after 30 days, unless you save the conversation to an account.
With an account: the name you give us (or, if you haven’t yet, the first part of your email address), your email address, your password (stored only as a one-way hash), your conversations, what you save, the health topics you pick for your profile, the groups you join, the choices you make (with their dates) and, if you turn it on, what the assistant remembers between conversations. If you sign in with Google or Apple, we receive your name, email address and an account ID from them, and they learn that you use OpenSupport.
Answers to optional follow-up questions. The assistant may ask optional questions, such as your age, gender, where you live (city or state), your insurance or other medicines you take, to tailor an answer. It never asks for your name or contact details.
What you post in our community. Posts and comments are stored as you write them: identifiers are not removed. Anyone using our services can read them, including people without an account. They never show your name: you appear under a member name such as “Member 3f2a9c01”, the same in everything you write in one group and different in every other group, or as “Anonymous” for a post you choose to make anonymous; our own team appears as “OpenSupport team”. Within a group, others can tell which posts and comments come from the same member and who moderates it, but can’t match a member across groups. Posts in OpenSupport’s groups may also be used, as written, as a source in answers to other people. The name and description of a group you create can be read the same way.
Ratings and comments on answers, and reports about an answer, a post or a doctor listing. What you write in them is cleaned of identifiers the same way questions are.
What our systems work out from your questions, such as their health topic, or that one may describe a side effect of a medicine.
When you search for a doctor: the name, specialty and place (city, state or ZIP code) you search for.
What you send us through a form on our website, such as your name, email address, organisation, role and message, whether to contact us or to open our demo.
Short-lived technical records: our servers log requests (time, page, result, browser type) to keep the services secure and working. These logs do not contain what you asked, though a line may note its general topic, such as a medical specialty and state. We use your IP address only briefly, to limit abuse.
On your device: our phone apps keep a copy of your conversations on the device so they open quickly. It is deleted when you sign out or your session ends (for example, after you delete your account on another device), and a guest’s copy after 30 days. It is not included in device backups.

How we use it

To answer your questions, with the sources the answer is based on.
To keep your account and conversations so you can come back to them.
To find doctors when you search for one.
To use posts in OpenSupport’s community groups as sources in answers to other people, as described above.
For your safety: to recognise when a question may describe a crisis, and show crisis resources, or a possible side effect of a medicine (see “Side-effect reports”).
To keep the services secure, prevent abuse and fix problems.
To check the quality and safety of answers: our team can review conversations, with the identifiers we can detect removed.

We do not sell your information. We do not use it for advertising, or share it for advertising based on your activity elsewhere. We do not use your conversations to train AI models.

Where the law asks for a legal basis: we use your information to provide the services you ask for, for safety and security, to meet legal obligations (ours, or a pharmaceutical company’s in its own programme, such as side-effect reporting), and with your consent where we ask for it.

AI, and the companies that help us

Answers are written by an AI model, Anthropic’s Claude, from medical sources we find for your question. They are general information, not medical advice. We make no decisions about you by automated means that have legal or similarly significant effects.

To answer a question, we send it, after removing the identifiers we can detect, to:

Anthropic, which writes the answer. It also checks community posts before they appear, and receives posts from OpenSupport’s groups, as written, when they are among the sources for an answer.
Voyage AI, which turns questions and answers into search vectors for our library of sources. It does the same for posts in OpenSupport’s community groups, which it receives as written.
Tavily, a web search service.
Public medical databases: PubMed (US National Library of Medicine) and ClinicalTrials.gov receive the question; openFDA and RxNav (US National Library of Medicine) receive only the names of medicines in it.

When you search for a doctor, the US National Plan and Provider Enumeration System (NPPES, run by the Centers for Medicare & Medicaid Services) receives the name, specialty and place you search for.

Other companies run parts of the service for us: Amazon Web Services (hosting, in the United States) and our email providers (account emails, and the messages you send us). Each receives only what it needs for its part.

To show characters its own fonts don’t have, such as emoji, our web app (app.opensupport.me) may load a font from Google’s servers, which then receive your IP address. Our assistant’s demo page (widget.opensupport.me) loads its fonts from Google the same way. Google does not receive what you ask.

When our assistant runs on another organisation’s website, it runs inside that site’s page, so the site and the tools it uses may be able to see what you type there, under its own privacy notice.

Otherwise we share information only with a pharmaceutical company in its own programme (below), when the law requires it, to protect someone’s life or safety, or with a company that acquires OpenSupport, which would be bound by this policy.

Side-effect reports

If a question, or a post in a pharmaceutical company’s group, may describe a side effect of a medicine, our systems note it so it can be reviewed for patient safety.

In OpenSupport’s own services we keep only that a side effect may have been described, its kind and dates, and any notes our reviewers add (with the identifiers we can detect removed), never your words. The note stays after you delete the conversation or your account, with nothing that identifies you.
In a pharmaceutical company’s programme, the company must by law record suspected side effects of its medicines. If you delete what you wrote, a copy of it (with the identifiers we can detect removed) stays with the report while it is reviewed for the company, and then for the period set in the company’s agreement with us (90 days unless it sets another), after which the copy is deleted. The report itself (its kind, status and dates) is kept as the company’s safety records require.
If, in a company’s programme, you agree to be contacted about a side effect you report, the company’s safety team receives your email address and the kind of side effect, not your conversation.

Some pharmaceutical companies run our assistant on their own websites, or a member site for their programme. There the company decides how your information is used, and we handle it on the company’s behalf; the company’s own privacy notice applies too.

An account in a company’s programme is separate from an OpenSupport account. Nothing is shared between them.
The company’s staff can see the conversations in its programme, with the identifiers we can detect removed, and what is posted in its groups, under names that don’t identify your account.
Side effects reported there are handled as described above.

Outside a company’s own programme, we don’t share your information with pharmaceutical companies.

Cookies and browser storage

This website sets no cookies and uses no analytics or advertising tools. Your browser’s local storage keeps your answer to the cookie notice and, once you have filled in the form to open our demo, that you did, so you aren’t asked again.
The member site uses one essential cookie, which keeps you signed in. It cannot be read by the page’s scripts and is not used for tracking. While you save a conversation from an assistant, the browser tab briefly keeps a one-time code.
The web app keeps your sign-in (or your guest session) and a few preferences, such as having seen its notice about AI, in your browser’s storage. Our phone apps keep your sign-in securely on the device.
The assistant on websites keeps its anonymous session only while the page is open.

How long we keep it

Conversations without an account: 30 days, unless you save them to an account.
Conversations, saved items and memories in an account: until you delete them, or your account. Ratings, comments and reports about an answer go with its conversation.
Community posts and comments: until you delete your account, or until we delete one you ask us to.
Reports about a post: until the post, or your account, is deleted. Reports about a doctor listing: until your account is erased.
Your profile, the groups you join and the choices you make (with their dates): until your account is erased. A group you create stays in the community, with nothing linking it to you.
Your account: until you delete it. Deleting signs you out everywhere at once, and you can restore the account within 30 days; until then your posts stay visible in the community. After that it is erased for good, with its conversations, saved items, memories, community posts and comments, and other people’s comments under those posts.
Side-effect reports: as described in “Side-effect reports”.
Backups: database backups are kept for up to 60 days and disk snapshots for 7 days, so erased information can remain in a backup for up to 60 days.
Server logs: rotated by size (about 30 MB for each part of the service, so busier parts keep theirs for less time), and kept in disk snapshots for up to 7 days.
Security and audit records: kept for security, with reference numbers only, never what you wrote.
What you send us through our website’s forms: for as long as we need it to deal with your request and keep a record of it.

Your choices and rights

With an account, you can at any time download a copy of your data, delete a conversation and delete your account, in the app or on the member site. Under You on the member site you can change the choices you have made there, and in the app you can turn off what the assistant remembers, which deletes it. To have a community post or comment deleted, email us.

Wherever you live, you can ask us to tell you what we hold about you, give you a copy, correct it, delete it, stop or limit how we use it, or withdraw a consent you gave. Email privacy@opensupport.me. We will check the request comes from you and answer within 30 days, or within the time your law allows if it is longer. If we decline, you can appeal by replying to our answer, and you can also complain to your state attorney general or your data protection authority.

California

California residents have the rights to know, delete and correct personal information, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to be treated differently for using these rights. We do not sell or share personal information. We use sensitive personal information, such as health questions, only for purposes the law allows without a request to limit it: providing the services you ask for, keeping them safe and secure, and checking their quality. Sharing a post you write in our community with the people who read it, and quoting a post in OpenSupport’s groups as a source in other people’s answers, is part of the service you ask for when you post; our app and member site say so where you write it.

Consumer health data

Washington’s My Health My Data Act and similar laws in other states give you rights over consumer health data. This section is our consumer health data privacy policy.

What we collect: questions about health, conditions, medicines and treatments; answers to optional follow-up questions, such as your age, gender, location, insurance or other medicines you take; the health topics you pick for your profile and the groups you join; what the assistant remembers, if you turn it on; the health topic of a question and notes that a side effect may have been described; your community posts and comments; and the doctors you search for.
Where it comes from: from you, and from what our systems work out from what you tell us.
Why: to answer your questions and keep your conversations, which are the services you ask for; to check the quality and safety of answers; for safety; to keep the services secure; and, for posts in OpenSupport’s groups, to use them as sources in answers to other people.
Who we share it with: the companies and public services that help us answer, listed above, to do their part in answering; other people using our services, who can read your posts and may see posts from OpenSupport’s groups quoted as sources in their answers; and a pharmaceutical company only in its own programme. We never sell it.
Your rights: to confirm whether we collect or share your consumer health data, to see it and the list of third parties we shared it with, to withdraw consent and to have it deleted. Use the controls under You, in the app or on the member site, or email privacy@opensupport.me. If we decline a request, you can appeal by replying to us.
We do not use location to place a virtual boundary (a geofence) around health care facilities.

Security

Your information is encrypted in transit and at rest, the details of what the assistant remembers are encrypted once more, and only staff who need access have it. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.

Children

Our services are not for anyone under 18. When you create an account with your email address, you confirm you are 18 or older. We do not knowingly collect information from children; if you think a child has given us information, email privacy@opensupport.me and we will delete it.

Where your information is kept

In the United States. If you use our services from elsewhere, your information is transferred to and processed in the United States.

HIPAA

OpenSupport is not a healthcare provider or a health plan, so HIPAA generally does not apply to what you share with us. We protect it as this policy describes.

Changes to this policy

When we change this policy, we post the new version here with its date. If a change is significant, we tell account holders by email or in the app before it takes effect.

Contact

Email privacy@opensupport.me.