Your privacy, our priority

Introduction

Welcome to Drugly. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our pharmaceutical information platform.

By accessing or using Drugly, you agree to the terms of this Privacy Policy. If you do not agree with our practices, please do not use our services.

Legal Framework (KVKK / UK GDPR / EU GDPR)

Drugly.ai is an international professional reference platform, and we comply with the applicable data protection laws of all jurisdictions in which we operate. As the data controller, Drugly.ai ("Drugly", "we", "us") processes your personal data on the legal bases set out below. You can reach us about any data-protection matter at hello@drugly.ai.

Legal Bases for Processing

• Contract (GDPR Art. 6(1)(b)): To create your account, manage your subscription, and deliver our services.
• Explicit Consent (GDPR Art. 6(1)(a), KVKK Art. 5/1): For your professional-use attestation, marketing communications, and non-essential cookies.
• Explicit consent for genetic data (GDPR Art. 6(1)(a) and 9(2)(a), KVKK Art. 6): For DNA files you upload to My Personal PGx Report. You give this consent with the checkbox on the upload form, and you can withdraw it at any time by deleting the upload or all your genetic data. Withdrawing does not affect the lawfulness of processing that took place before.
• Legitimate Interest (GDPR Art. 6(1)(f)): For security, fraud prevention, product improvement, and compliance audit logs.
• Legal Obligation (GDPR Art. 6(1)(c)): To comply with tax records, billing records, and our regulatory responsibilities.

Your Rights Under KVKK Article 11

For users resident in Türkiye, the rights under KVKK Article 11 apply (listed below). Your additional rights under the UK and EU GDPR are listed in the "Your Rights" section further below.

• Learn whether your data is processed
• Request information about processing
• Learn the purpose and whether data is used accordingly
• Know the third parties to whom data is transferred
• Request correction of incomplete or incorrect data
• Request deletion or anonymization
• Object to unfavorable results from automated processing
• Claim compensation for damages

You can exercise these rights free of charge by emailing hello@drugly.ai.

What Information We Collect

Required for account creation (with your explicit consent)

• Full name
• Email address
• Date of birth (only to verify 18+ compliance)
• Occupation and specialization (to verify licensed professional eligibility)
• Workplace / institution name (optional, to denote professional context)

Professional-use attestation (compliance audit log)

Because Drugly.ai is designed for licensed healthcare professionals, every user must provide a professional-use attestation before accessing the platform. For audit and compliance purposes, we record:

• Timestamp of attestation
• IP address and device / browser information
• Language preference and version at time of attestation
• Linked user ID (for registered users)

Collected automatically when you use Drugly.ai

• Search queries & viewed drug references (anonymized after 90 days)
• IP address & approximate location
• Device & browser information
• Session duration & clicked features

For paid subscriptions (paid plans only)

• Billing name and billing address (collected by our payment provider)
• Subscription status, start and renewal dates
• We do not collect or store payment card details — these are processed directly by our PCI-DSS compliant payment provider.

Genetic data you choose to upload (optional)

My Personal PGx Report lets you upload your own raw DNA file (for example from 23andMe or AncestryDNA, or a VCF file) to get a personal pharmacogenomic report. It is optional: we only receive your genetic data if you upload a file. Genetic data is a special category of personal data under GDPR Article 9 and KVKK Article 6, so we accept an upload only when you give your explicit consent with the checkbox on the upload form. When you upload a file, we store the following, linked to your account:

• Your genotype, only at the variants (rsIDs) that are also in our PharmGKB variant database: the rsID, your genotype (for example, AG), and the chromosome and position if your file includes them.
• Upload details: the original file name, file format and file size, how many rsIDs were read from the file and how many matched, the upload date and time, the optional label you give it, and when you gave consent and which version of the consent text you agreed to.

We do not keep your original file. It is read during the upload and not saved, and genotypes at variants that are not in our PharmGKB database are discarded at that point. Your report results (star alleles, metabolizer phenotypes, HLA risk markers and drug matches) are not saved either: they are recalculated from your stored genotypes and our PharmGKB and CPIC tables each time you open the report.

We use this data only to show your report and the genotype-aware drug check, and to create a PDF of your report when you ask for one. Report pages open only for the account that uploaded the file. Reports for files uploaded before we started asking for explicit consent stay closed until you give it, and you can delete those uploads instead. We do not send your genetic data to AI service providers, and we do not sell it. Our usage analytics do not record what you click on these pages, and they store the pages' addresses without the drug names you check.

If you use Email to clinician, we create a PDF of the report sections you choose and send it through our email provider to the address you enter, together with the upload's label (or its file name if it has no label) and any name and note you add. We do not save the PDF. Once sent, the email is in the hands of the recipient and their email provider.

How We Use Your Information

We use the collected information for the following purposes:

1. Service Delivery: To provide, maintain, and improve our services
2. Personalization: To customize your experience and provide relevant information
3. Communication: To send updates, newsletters, and important notifications
4. Security: To protect against fraud, abuse, and unauthorized access
5. Analytics: To understand how users interact with our platform
6. Legal Compliance: To comply with applicable laws and regulations

Information Sharing & Data Processors

To deliver our service, we share data with trusted processors in specific categories. All processors act on our behalf under data processing agreements that meet UK GDPR Article 28 and EU GDPR Article 28 standards. A full list is available on request from hello@drugly.ai.

Categories of Data Processors

• Cloud hosting and database: Infrastructure providers hosting our application and database (e.g., AWS, Render, Hetzner, or similar). Hosted in UK / EU region.
• Email delivery: We send our emails through Microsoft 365 (Outlook): transactional emails (verification, password reset, billing notifications), optional marketing communications, and PGx reports you choose to email to a clinician.
• Payment processing: Our PCI-DSS compliant payment provider, Stripe, for subscription billing and payment processing. Payment card data is collected and processed directly by them — we never see it.
• AI service providers: To power our AI-assisted reference assistant (Anthropic, our large-language-model provider). See "AI & Machine Learning" section below.
• Analytics (consent-based): To collect anonymous usage analytics only with your explicit consent (e.g., Plausible Analytics, Google Analytics).

Other Disclosure Circumstances

We may also share your information in the following circumstances:

• With Your Consent: When you explicitly agree to share your information
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In connection with mergers, acquisitions, or asset sales
• Safety and Security: To protect the rights, property, or safety of Drugly.ai, our users, or others

Cookies and Tracking Technologies

Drugly uses cookies to improve our website and provide you with a better experience. You can manage your cookie preferences at any time.

Cookie Categories

How to Manage Your Cookies

1. Drugly Cookie Preferences: From the cookie banner at the bottom of the page or click here to open cookie settings .
2. Browser Settings: You can block or delete cookies through your browser settings. However, this may affect some Drugly features.

AI & Machine Learning

Drugly.ai uses large language models (LLMs) to power features such as the AI-assisted reference assistant (chatbot) and interaction explanations. When you use these features, we want to be transparent about how we handle your data while protecting your privacy.

What Happens When You Interact with AI Features

• Your query is sent to our third-party AI service provider (Anthropic) to generate a response.
• These providers act subject to enterprise API privacy terms for their service usage. Enterprise API usage typically includes a commitment not to use the data to train their models.
• The query is not persistently stored by the AI provider after the response is generated (except for the provider's standard abuse-monitoring windows).
• We may retain anonymized, de-identified query / response pairs to improve service quality.

Is Your Data Used to Train AI Models?

Your queries or account data are not used to train our own AI models or the models of third-party AI providers without your explicit consent. If we ever consider using user data to improve our product in the future, we will clearly disclose this and provide an opt-in mechanism.

Automated Decision-Making

Drugly.ai does not make fully automated decisions that produce legal or similarly significant effects on you. All clinical decisions are made by a licensed healthcare professional; AI outputs are reference material that supports — never replaces — your professional judgment.

Data Security

We implement industry-standard security measures to protect your information:

• Encryption: SSL/TLS encryption for data transmission
• Password Protection: Secure password hashing (bcrypt)
• Access Controls: Restricted access to personal data
• Regular Audits: Security assessments and vulnerability testing
• Secure Infrastructure: Protected servers and databases

While we strive to protect your information, no method of internet transmission is 100% secure. We cannot guarantee absolute security.

Your Rights – Replied to within 1 month max

Under the UK GDPR (for users resident in the UK), the EU GDPR (for users resident in the EU), and KVKK (for users resident in Türkiye), you have significant rights over your data. These rights include:

• Right of access: Request a copy of the personal data we hold, free of charge (typically provided in structured JSON / CSV)
• Right to rectification: Have inaccurate or incomplete data corrected
• Right to erasure ("Right to be Forgotten"): Request deletion of your data under certain conditions
• Right to restrict processing: Limit how we use your data in specific cases
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or for marketing purposes
• Rights related to automated decision-making: Not be subject to fully automated decisions that affect you (Drugly.ai does not make such decisions)
• Right to withdraw consent: If processing is based on consent, you may withdraw your consent at any time
• Right to lodge a complaint: With the relevant data protection authority: the UK Information Commissioner's Office (ICO), your relevant EU data protection authority, or the Turkish Personal Data Protection Authority (KVKK).

Deleting or Downloading Your Genetic Data

Deleting your genetic data is also how you withdraw your explicit consent to our processing it.

• Delete one upload: On the My Personal PGx Report page, use the delete button next to the upload. The upload and all its stored genotypes are deleted from our database straight away. This page requires an active subscription.
• Delete everything: "Delete my genetic data" on your profile page deletes all your uploads and genotypes, and "Delete my account" deletes them along with your account. Neither requires a subscription.
• Get a copy: The file you get from "Download my data" on your profile page includes all your uploads (with your consent record) and all your stored genotypes.

If you can't use these options, write to us as described below and we will delete or send your genetic data for you.

How to Exercise Your Rights

Send an email to hello@drugly.ai with "Privacy request" in the subject line, stating your request. We may need to verify your identity to confirm the request. We typically respond to requests within 30 days (this may be extended by up to 2 further months for complex cases, in which case we will notify you with the reason). All rights are exercised free of charge.

Children's Privacy

Drugly is not intended for use by children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

International Data Transfers

Your data is primarily processed in the United Kingdom and European Union. Some of our data processors (e.g., AI service providers, email services) may operate servers in the United States or other jurisdictions. In such cases, we implement appropriate safeguards under applicable law:

• Standard Contractual Clauses (SCCs) approved by the European Commission and / or the UK ICO International Data Transfer Agreement (IDTA).
• Adequacy decisions where applicable (e.g., UK ICO adequacy decision).
• Providers certified under the EU-U.S. Data Privacy Framework where applicable.

For users in Türkiye, we obtain your explicit consent for international data transfers at registration, as required by KVKK Article 9.

Data Retention

We retain your personal data only for as long as necessary. The following retention periods apply:

• Account data: For as long as your account is active + deleted or anonymized within 30 days of account-deletion request.
• Genetic data (optional PGx report uploads): Kept until you delete the upload, all your genetic data or your account, and deleted from our database straight away when you do. It is not deleted automatically, including when a subscription ends.
• Professional-use attestation audit records: Retained for 7 years from the date of attestation for compliance purposes.
• Billing and subscription records: Retained for 7 years per tax and accounting laws (minimum statutory requirement across UK / EU / TR jurisdictions).
• Search / usage logs: Retained for up to 90 days in linked form, then anonymized.
• Security logs: Retained for up to 12 months for security incident detection and response.
• AI interaction data: Retained only in anonymized, de-identified form for quality improvement purposes.

When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by statutory obligations (e.g., billing records).

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. Your continued use of Drugly after changes are posted constitutes acceptance of the revised policy.

Contact Us