Privacy & Data Security

Effective September 27, 2026

LexiTar is a free, public health literacy utility operated by the Tiny Tars Foundation, a registered 501(c)(3) tax-exempt charitable organization (EIN: 39-2278196) ("we," "us," or "the Foundation"). Because LexiTar helps you organize sensitive health information, protecting that information is central to our mission. This policy explains what we collect, how we use and safeguard it, what we will never do with it, and the choices and rights you have. It applies to this website and to the LexiTar dashboard.

The commitments we will not break

We do not sell, rent, trade, or otherwise monetize your personal or health information — ever, to anyone. We do not share your health data with advertisers, pharmaceutical companies, insurers, employers, or data brokers. We do not use your health information to build advertising profiles or to serve you personalized medical remarketing, and we run no commercial advertising on our platform. These are permanent commitments, not settings you must find and switch off.

Information we collect

Health information you choose to enter. When you use the dashboard, you may add laboratory results, biomarker values, and context such as age and sex so the tool can translate and organize them for you. You may also upload the reports themselves — PDFs or photographs — which are encrypted in your browser before they are stored. You decide what to enter; you are never required to provide any particular data point. Creating an account also records a birth year, which is checked in your browser and never sent to us.

Waitlist and contact details. If you ask to join our early-access waitlist, we collect the email address you provide and, optionally, your name, solely so we can invite you to create an account and communicate with you about that access.

Limited technical data. Like nearly all websites, our hosting provider records standard request information (such as IP address, browser type, and timestamps) for security, abuse prevention, and reliability. We use aggregate, privacy-respecting analytics to understand overall traffic patterns — for example, how many people visited a page — never to identify you individually or to track you for advertising.

How your health data is protected

Your dashboard is encrypted in your own browser under a key you control, and every document you upload is encrypted separately under a key that exists only inside that dashboard. The copies stored on our infrastructure stay encrypted at rest, and we never decrypt anything for advertising or profiling. Even so, no method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

What leaves your browser, stated plainly. Answering questions about your records means sending the reports themselves — whole documents, not summaries — to the company that runs the language model behind those answers. Whoever operates the deployment you use chooses whether that happens at all, and which company it is: with it off, no document ever leaves. With it on, the documents go when you open a record, not only when you ask a question, and a copy stays in that provider's prompt cache for up to about an hour after you stop using it — expiring on the provider's own schedule, which we can neither shorten nor recall. Read-aloud text goes to a separate speech provider, on that provider's own terms. The model calls run on standard commercial terms, with no negotiated zero-retention arrangement. That is an open item we will update here when it changes. Nothing goes to an advertiser, ever. The companies in use today are named below, and this policy is reissued when any of them changes.

Whether we can open your record. By default your dashboard also carries a recovery envelope that the Foundation can open, so that losing your password does not mean losing your health history. You can remove it from your account settings; once you do, your password is the only key and nobody — not you, not the Foundation — can recover the contents. Until you remove it, we can. We would rather say so here than let you infer otherwise.

How we use information

We use the health information you enter only to provide the service to you: translating terminology, calculating and displaying reference ranges, visualizing trends, and generating summaries you can share with your own physician. Producing those answers means sending your reports to the language model provider named under "When we disclose information" below; it is the same purpose, carried out by a processor. We use waitlist details only to contact you about access. We use technical and aggregate analytics data only to keep the service secure, working, and improving. We do not use any of this information for advertising.

Cookies and tracking

We use only the cookies and local storage necessary to operate the site and, where enabled, privacy-respecting aggregate analytics. We do not use advertising or cross-site tracking cookies, and we do not participate in medical or health-based ad remarketing. Where your browser sends a "Do Not Track" or global privacy signal, we honor it for optional analytics.

When we disclose information

We share information only in narrow, non-commercial circumstances: with the service providers named below, strictly to operate the service; when you explicitly direct us to (for instance, by exporting a summary to share with your physician); or where we are legally required to comply with a valid legal process. We will never disclose your data to a third party for that party's own marketing.

• Cloudflare — hosting, storage and database. Receives encrypted data and standard request logs; holds no key that can open your dashboard or your documents. Standard commercial terms.
• Anthropic — the language model. Receives whole documents in readable form, and the text of answers, while you have a record open. Standard commercial API terms: no business associate agreement and no negotiated zero-retention arrangement. A prompt-cache copy expires on Anthropic's own schedule.
• Microsoft Azure AI Speech — read-aloud. Receives the text being read, which can include health information. Standard commercial Azure terms. The Foundation is not a HIPAA covered entity (see below), so Microsoft's HIPAA business associate agreement does not apply to LexiTar; those terms, not that statute, are what protects this transfer.
• Google Workspace — transactional email. Receives your address and a message carrying no health information. Workspace terms.

These are the providers in use today; the model and speech providers are deployment choices, and this list is reissued if either changes. Where a provider's retention has not been negotiated, we say so above rather than implying a guarantee we do not have.

Data retention

We keep your dashboard data only for as long as your account is active or as needed to provide the service. We keep waitlist details until we have invited you and reasonably concluded our onboarding, or until you ask us to remove them. When information is no longer needed, we delete it or retain it only in encrypted form we cannot read. Records of who accessed whose data are kept as an audit trail; they carry no health content.

Your rights and choices

You may ask us to confirm what personal information we hold about you, to correct it, or to delete it, including your waitlist details or your account. You may also decline to provide any data or stop using the service at any time. We do not discriminate against you for exercising these rights. To make a request, contact us through our contact page.

Deleting your account is self-service, and here is its reach. The account panel deletes your records, your uploaded documents, your chat history and the account itself; nobody can undo it. Two limits we state rather than let you discover. Documents we cannot prove are yours to delete — uploaded before ownership was recorded, or in a space another account wrote into first — are left in place and reported to you as a count, so a partial deletion is never described as a complete one; ask us and they are removed by hand. And deleting your account stops anything further being sent to the model provider, but cannot recall a copy it already holds; that copy expires on the provider's own schedule, usually within about an hour.

Children's privacy

LexiTar is for people aged 16 and over, and that limit is checked rather than merely stated: creating an account requires a birth year, and a year that makes you under 16 is refused — at signup and again if you later edit it. Be clear about what that is worth. We collect a birth year, never a full date of birth, and it never reaches our servers; they record only that the check was passed and when. So it is a self-declaration at year granularity, not verified age. If you believe an account belongs to a child, report it through the channel below and we will delete the account and its contents.

Reporting a problem, and who answers

Every LexiTar screen that can produce a bad answer carries a Report control, and the list of people who can access your record carries one beside each of them. Use it for an answer that could mislead or harm, for illegal or abusive material, or for an account behaving abusively. A report carries no health content — not the document, not the answer complained about — so a reviewer will usually come back and ask you; that is deliberate, because the alternative is a system where a stranger's record can be read on the strength of a complaint.

Reports are read by a person, not a bot. The Tiny Tars Foundation is accountable for them and answers through its safety contact, a standing role rather than one individual, so the commitment below does not depend on who holds it. We aim to acknowledge within 3 business days and to resolve within10; reports of illegal material are looked at within 1 business day. You can also reach us through our contact page.

What we can do about a document nobody but its owner can open: we do not need to read it in order to destroy it. You can delete your own files and your whole account yourself; we can remove stored material out of band when a report is confirmed. What we cannot do is scan uploaded documents for bad content, because we hold no key that opens them — that is the design, and it is the reason the rest of this policy can say what it says. One honest qualification: documents uploaded before 24 September 2026 predate this separate encryption and are being converted in place. Until that conversion reports nothing left to convert, "we cannot open it" is true of every new upload and not yet of every old one. We will update this paragraph when it finishes, and not before.

Not a HIPAA covered entity

The Foundation is not your healthcare provider, health plan, or a HIPAA "covered entity," and using LexiTar does not create a provider–patient relationship. LexiTar is an educational tool to support your own advocacy, not a source of medical advice. See our Terms of Service for the full medical disclaimer.

Changes to this policy

If we make a material change to this policy, we will update the effective date above and, where appropriate, provide a more prominent notice. Your continued use of LexiTar after an update means you accept the revised policy.

Contact us

Questions or requests about your privacy? Reach the Tiny Tars Foundation through ourcontact page. We aim to acknowledge within 3 business days and to resolve within 10, and to look at reports of illegal material within 1 business day.