Information we use
X-Medic provides first-aid-kit supply suggestions and private saved recommendations. We collect information you provide in the intake and in support requests. The intake asks about first-aid skill, licensure, ZIP code, number of people, intended use or activity, and an optional container and its dimensions. Do not submit patient records.
Our Consumer Health Data Privacy Notice separately explains health-related categories, recipients, and applicable rights.
Supabase Auth processes your email, verified account and sign-in identifiers, sessions, and authentication events. Google supplies the identity information authorized by you when you choose Google sign-in. Our customer database uses keyed digests of verified email and provider identifiers to connect those identities to your internal account.
Selecting Generate and save stores permitted intake values and all three recommendation tiers, including supplies, quantities, explanations, supporting evidence, version information, and recalculation links. Unresolved custom hobby or occupation text is processed for the request, then omitted from saved history; a keyed digest records that exact replay is unavailable. Pending answers remain in the current browser tab for up to one hour and are cleared after saving, sign-out, reset, or account deletion.
We also process network and device information to serve and protect the website. Our application retains short-lived keyed network and request digests for abuse detection, plus quota and duplicate-request records. Hosting, sign-in, email, and bot-check providers may retain the delivery and security metadata needed to operate their services.
Purposes and recipients
We use this information to authenticate accounts; generate, display, save, recalculate, and delete recommendations; answer support requests; prevent abuse and duplicate saves; and maintain, secure, and recover the service. Saved history does not subscribe you to notification or marketing email.
Our operating providers are Supabase (authentication, database, and backups), Vercel (hosting, security, and homepage analytics), Google Workspace (sign-in email and support correspondence), Google (optional sign-in), and Cloudflare Turnstile (bot checks). They receive information necessary for those functions. Cloudflare also uses security signals to improve Turnstile, as described in its Turnstile Privacy Addendum. Product links take you to Amazon or another retailer, which processes your visit and purchases under its own privacy notice. We may disclose information when required by law or necessary to protect people or the service.
F3 administers the shared Google Workspace tenant and hosting accounts used by X Medic. Authorized F3 administrators may access support or privacy correspondence and service information when administering those services.
X Medic does not collect, use, or sell your personal data to train large language models.
We do not sell intake or recommendation information or use it for targeted advertising. Analytics run only on the public homepage, not on intake, authentication, account, history, or recommendation pages. Our analytics configuration does not track your activity across unrelated websites. External sign-in and retailer services can process activity on their own sites. X-Medic does not currently change its behavior in response to a browser's Do Not Track signal. You can disable homepage analytics in this browser by visiting the homepage with analytics off.
Retention and your controls
Saved recommendations expire 12 months after creation. You can view or delete them and request account deletion from your account page. Deleting a run hides it immediately; its content and derived records are purged within 24 hours. Account deletion immediately blocks account access and purges recommendation content. Authentication-provider deletion is retried if the provider is unavailable; the account remains blocked.
Abuse events expire after 24 hours. Duplicate-request records expire after 32 days of inactivity; aggregate quota records use short operating windows of up to three months. Account deletion removes these records. Minimal keyed account, identity, and deletion records remain to prevent deleted-account sessions, re-registration, or restored backups from bringing deleted access back. They contain no recommendation content or raw email, but remain linked to the account and are not treated as anonymous information. These minimal records currently have no automatic expiry.
Restricted database backups may retain deleted information for up to seven days. Before restored data becomes accessible, deletion records must be reconciled and checked. We do not retain a hidden copy of deleted recommendations for product use.
Contact the privacy address above to request access, correction, deletion, or other applicable privacy rights, or to appeal a request decision. We may verify your identity. Corrections to saved, immutable recommendations require a new run; you can delete the old run. Any legal restriction on retaining security or deletion records still applies.
Changes
We will post changes here with an updated effective date and prominently identify material changes on the website before they take effect.