Privacy Policy

Last updated: October 10, 2026 · Contact: hello@alhia.ai

Alhia shows population-level information and is not medical advice. You can read everything without an account. We don't use tracking cookies, and as of the date above we haven't sold or licensed data.

What we collect

Account (optional): your email address and your consent choices. There's no password. You get an access token once, and we store only a one-way hash of it.
Reports you submit: condition, treatment, age band, sex, whether it worked, whether you still take it, side effects, and an optional note. Please don't include your name or other identifying details.
Anonymous reports: a keyed one-way hash of your IP address, used only to catch duplicate or spam submissions. Without our secret key it can't be turned back into your IP address.
Your IP address, briefly: used for rate limiting and abuse prevention by our hosting providers and application.

How we use it

Reports are combined into grouped statistics shown to all visitors. We don't publish your email, and individual reports aren't shown as profiles. "Anonymized" means we don't store your name, not that re-identification is impossible: unusual details in your text, or a very small group, could point to a person.

The optional "help research along" box records your consent to inclusion in aggregate research datasets. We haven't provided data to any outside party. If that changes, we'll update this policy and ask again where required.

Who else handles data

Railway hosts our server and database (United States).
Cloudflare serves the website and DNS, so requests pass through its network.
Google Fonts supplies typefaces, so your browser contacts Google when a page loads.

We may disclose information if legally required.

Your choices

Export or delete: with an account, you can export your data or delete your account (removing your email and token). You can also delete your linked reports; otherwise they stay as grouped statistics, detached from you.
Anonymous reports can't be found or deleted afterward, because we can't tell which one is yours.
Research consent can be withdrawn any time by emailing us, effective for future datasets.
Depending on where you live, you may have further rights (access, correction, deletion). Email us and we'll respond within a reasonable time, normally 30 days.

Retention, security, and children

We keep reports until you delete them or, if anonymous, indefinitely as grouped statistics. Account data stays until you delete the account, and account tokens expire after 90 days. Data is encrypted in transit, but no system is perfectly secure. Alhia is for adults (18+).

Changes and contact

If we change this policy in a meaningful way, we'll update the date above. Questions or requests: hello@alhia.ai