This notice explains how X-Medic handles information that may qualify as consumer health data, including account-linked first-aid preparation information and derived injury associations. X-Medic does not diagnose your health or monitor whether an injury occurs.
Categories, sources, and purposes
You provide first-aid skill, licensure, ZIP code, group size, intended use, activity or occupation, and optional container details. When you select Generate and save, we process those answers and store the permitted intake values with your recommendation. Some fields, including the type of license and container dimensions, are saved as part of your answers but do not currently change the recommendation calculation.
Our recommendation engine derives possible injury associations and suggested first-aid supplies from the selected activity or occupation, ZIP-related climate, and general kit rules. Saved records include all three supply tiers, quantities, explanations, supporting evidence, version information, and recalculation links. These associations describe kit preparation, not a finding that you have a medical condition. Unresolved raw custom text is processed transiently and is omitted from saved history.
Your verified email-code or Google identity links the records to your private account. Supabase and, when selected, Google provide the sign-in information. You may also provide consumer health information in a support or privacy request. Please avoid sending patient records or information unnecessary for the request.
We use these categories to provide the kit generation, saving, viewing, recalculation, deletion, and support you request; to maintain and recover those records; and to secure the service. We rely on the requested-service exception where it applies. We will seek any consent required before collecting or sharing consumer health data for an additional purpose. Generating a kit does not enroll you in health-related marketing or notifications.
Sharing and recipients
Supabase processes account-linked intake, saved outputs and evidence, identity information, deletion records, and backups. Vercel processes intake and recommendation requests while hosting the application. Google Workspace processes information you choose to send in support or privacy correspondence and the metadata needed to deliver sign-in messages.
Google sign-in receives identity and sign-in information; Cloudflare Turnstile receives browser and security signals for bot checks. We do not send your intake or saved recommendation to either as part of those integrations. Our homepage analytics does not run on intake, account, or recommendation pages or receive their content.
Affiliates and shared administration: F3 administers the shared Google Workspace tenant and hosting accounts used by X Medic. Authorized F3 administrators may access support or privacy correspondence and service information when administering those services.
X Medic does not collect, use, or sell your personal data to train large language models.
We do not sell your intake, saved recommendations, or supporting account evidence. If you follow a product link, the retailer receives the product page you choose and information sent by your browser under that retailer's own privacy practices. We do not send your stored intake or history to retailers. We do not authorize third parties to collect consumer health data through X-Medic across unrelated websites over time.
We may disclose information when a law requires it or when a permitted security or fraud purpose requires it. You may request the actual recipients of your consumer health data, including contact information, through the contact above.
Your choices and requests
Use your account to view saved recommendations, delete a run, or delete your account. Contact the address above to confirm or access other consumer health data we hold, obtain the recipient list, request correction or deletion, ask us to stop collection or sharing, or withdraw consent where processing depends on consent. You do not need to create an account to submit a request. We will use a proportionate identity check before disclosing or changing private records.
Saved recommendations are immutable; correcting their answers requires a new run, and you can delete the old run. Stopping processing needed to provide an account service may prevent us from continuing that service. We do not treat a request to stop processing as permission to enroll you in another use.
We respond to Washington rights requests within 45 days of receipt. When legally permitted and reasonably necessary, we may extend once by 45 days after notifying you within the initial period. For Nevada deletion requests, we complete deletion within 30 days after authentication. The faster deletion commitments below continue to apply to the account and run controls.
To appeal a request decision, contact the address above and state that you are appealing. We will review the decision and provide a written explanation within 45 days. If your appeal is denied, you may complain to the Washington Attorney General or the Nevada Attorney General, or the Connecticut Attorney General, as applicable. We will not discriminate against you for exercising applicable privacy rights.
Deletion and retention
Saved recommendations expire after 12 months. Run deletion immediately hides the run and purges its content within 24 hours. Account deletion immediately blocks access and purges recommendation content; failed identity-provider deletion is retried. Restricted backups may retain deleted information for up to seven days. Deletion records must be reconciled before restored data is accessible, and applicable deletion requests are communicated to the relevant recipients.
Minimal keyed identity and deletion records remain to prevent deleted access from returning and to protect against abuse. They do not contain recommendation content or raw email, are not anonymous, and currently have no automatic expiry. We retain or use them only to the extent applicable law permits the specific security or deletion purpose.
Changes
We identify material changes on the website before they take effect and update the effective date on this notice. Any new use or sharing that requires consent will wait for that consent.