Privacy Policy

Welcome to ToxiFlash ("App", "we", "us", or "our").

ToxiFlash is an educational application designed primarily for medical students and healthcare learners to study and revise toxicology.

This Privacy Policy explains how ToxiFlash collects, uses, stores, and protects information when you use our application and related services.

We respect your privacy and aim to collect only information that is reasonably necessary to provide, maintain, and improve ToxiFlash.

By using ToxiFlash, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

Depending on the features you use, ToxiFlash collects the following categories of information.

A. Account Information

When you create an account, we collect and store:

• Username (display name).
• Email address.
• Password, which is stored in hashed (not readable) form.
• Device type (for example, Android or iOS).
• Account creation date and time, and last login date and time.
• Profile photo, if you choose to upload one. Profile photos are stored on our cloud storage and may be accessible to anyone who has the link to the image. Please do not upload images that identify a patient or any other person without their permission.

B. Email Verification (One-Time Passcode)

To verify your email address during sign-up, we generate a one-time passcode (OTP) and send it to your email address. The OTP is valid for 5 minutes and is removed once it has been used successfully or has expired. Your email address is used for this purpose and is processed by our email delivery provider.

C. Login Sessions and Tokens

To keep you signed in securely, we issue access tokens and refresh tokens. Refresh tokens are stored on our servers, linked to your account and device type, until you log out or they expire.

D. Toxidrome Identification History

When you use the toxidrome identification feature, ToxiFlash stores the following under your account:

• The symptoms or clinical features you select in the App.
• The results generated for that selection, including the matched toxidromes and match percentages.
• The date and time of each identification.

This history is stored so that you can view your previous identifications later.

E. Favorites

If you mark a toxidrome as a favorite, we store the identifier of that toxidrome under your account so that it appears in your favorites list.

F. Technical and Server Log Information

When the App communicates with our servers, limited technical information such as request details, IP address, timestamps, and error information may be recorded in server logs. We use this information for security, troubleshooting, and maintaining the service.

Educational content such as toxidrome information, notes, antidote lists, and conference videos is provided to all users. We do not track which individual notes, lists, or videos you open.

2. Information We Do Not Want You to Submit

Users should not enter identifiable or confidential patient information into ToxiFlash, including in profile fields such as your username or profile photo.

Please do not enter or upload:

• Patient names.
• Addresses.
• Phone numbers.
• Medical record numbers.
• Government identification numbers.
• Identifiable photographs.
• Hospital identification numbers.
• Other information that can directly identify a patient.

If you are studying a clinical case, use de-identified information whenever possible.

3. How We Use Information

We use collected information to:

• Create and manage your account.
• Verify your email address and authenticate you when you log in.
• Provide and operate ToxiFlash.
• Provide the toxidrome identification feature.
• Save and display your identification history.
• Save and display your favorite toxidromes.
• Show your username and profile photo in your profile.
• Provide toxicology notes, antidote information, and educational videos.
• Diagnose technical problems and improve App performance.
• Maintain security and prevent misuse or abuse.
• Respond to user requests.
• Comply with applicable legal requirements.

4. Identification History

Your identification history is an important feature of ToxiFlash. Each time you use the identification feature, your selections and results may be stored under your account so that you can access them later.

Because these selections describe clinical features, we strongly recommend that you do not link them to any identifiable patient.

You can request deletion of your identification history, or of your entire account, by contacting us using the details in Section 17. Where the App provides in-app deletion controls, you may use them instead.

5. Consent and Legal Basis

Where required by applicable law, ToxiFlash will obtain appropriate consent before processing personal data for purposes requiring consent.

Where consent is the legal basis for processing, users may have the right to withdraw consent, subject to applicable law and any consequences of such withdrawal.

6. Sharing of Information

We do not sell users' personal information.

We share information only with service providers that help us operate ToxiFlash, and only as reasonably necessary. These include:

• Amazon Web Services (AWS), for cloud hosting, database storage, file storage (profile photos), and email delivery (verification codes).
• Third-party video platforms that host educational or conference videos, when you choose to play them.

These providers process information on our behalf and may be subject to contractual, technical, or legal obligations concerning the information they process.

We may also disclose information where required by applicable law, regulation, legal process, or lawful government request.

7. Third-Party Services

ToxiFlash uses the third-party services described in Section 6 to provide its functionality. The privacy practices of these providers are governed by their own privacy policies and terms. If you open a video hosted on a third-party platform, that platform may collect its own information about your viewing.

8. Educational Purpose and Automated Matching

The toxidrome identification feature compares the symptoms or features you select against the toxidrome information stored in our database and ranks the closest matches. This is done by automated matching within our own systems. Your selections are not sent to any third-party artificial intelligence service.

Results are intended for educational purposes only. They are not medical advice, diagnosis, or treatment, and may contain errors or omissions. Do not rely on ToxiFlash for clinical decisions or emergency care.

9. Data Storage and Security

We take reasonable technical and organizational measures to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. These include encrypted connections (HTTPS), hashed password storage, and token-based authentication for account-related features.

However, no electronic system or internet transmission can be guaranteed to be completely secure.

We therefore cannot guarantee absolute security of information transmitted to or stored by ToxiFlash.

10. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy or as required or permitted by applicable law.

• Account information, identification history, and favorites: kept until you ask us to delete them or delete your account.
• Refresh tokens: kept until you log out or they expire.
• Verification codes (OTP): valid for 5 minutes and removed after successful verification.
• Server logs: kept for a limited period for security and troubleshooting.

A different retention period may apply where required by law.

11. Deletion of Information

You may request deletion of your account and personal information, or of your identification history only, by contacting us at:

Please send the request from the email address registered with your account. We may need to verify your identity before processing a deletion request.

Certain information may need to be retained where required by law or for legitimate legal, security, or fraud-prevention purposes.

12. User Rights

Subject to applicable law, users may have rights relating to their personal data, including:

• Access to information about processing.
• Correction of inaccurate information. You can update your username and profile photo in your profile.
• Deletion of personal information.
• Withdrawal of consent where consent is the basis of processing.
• Raising privacy-related complaints or grievances.

The specific rights and procedures applicable to a user depend on applicable law and the circumstances of the processing. To exercise your rights, contact us using the details in Section 17.

13. Children's Privacy

ToxiFlash is primarily intended for medical students, healthcare learners, and other individuals studying toxicology.

We do not knowingly collect personal information from children in violation of applicable law.

If you believe that a child has provided personal information to us inappropriately, please contact us so that we can take appropriate action.

14. Data Location and International Transfers

ToxiFlash's servers, database, and file storage are hosted on Amazon Web Services in the Asia Pacific (Hyderabad) region in India.

Some third-party services, such as video platforms, may process information outside India. Where personal information is transferred or processed outside India, we will take steps required by applicable law.

15. Device Storage and Similar Technologies

The ToxiFlash App may store login tokens and basic settings on your device so that you stay signed in until you log out. You can remove this information by logging out or by clearing the App's data or uninstalling the App.

If our website uses cookies, they are used only for basic technical purposes such as making the site work properly.

16. Changes to This Privacy Policy

We may update this Privacy Policy when our services, data practices, technology, or applicable legal requirements change.

Updated versions will be made available through ToxiFlash or on this webpage.

The "Last Updated" date at the beginning of this Privacy Policy indicates when it was most recently revised.

17. Contact and Privacy Requests

18. Acceptance

By using ToxiFlash, you acknowledge that you have read and understood this Privacy Policy.

Where applicable, we will obtain consent through the mechanisms required by law before processing personal data on the basis of consent.