Privacy Policy

When you choose a language, this site stores that preference in a first-party cookie named site-language for up to one year. It contains only the language choice, not patient data, and is not used for tracking.

Effective Date: January 1, 2026 · Last Updated: September 19, 2026

HIPAA & Patient Data

Do not submit identifiable patient information to the public calculator. Calculations run on a server. Entered clinical values and sample times are transmitted for calculation; signed-in users with calculation history can retain explicit calculations for 90 days. Clinical data are not automatically anonymous because names are omitted. Institutional use with patient data requires privacy, security and contractual review first. A BAA or other agreement depends on the actual workflow and must be executed where required before use.

1. Information We Collect

1.1 Information You Provide

Account information: Name, email address, institution/hospital, professional role (when you create an account or submit a form).
Contact form submissions: Name, email, message content, and any information you choose to provide.
Pilot program applications: Name, title, hospital/health system, email, phone, number of beds, and current vancomycin monitoring method.
Resource downloads: Name, email, institution, and role (for gated content).

1.2 Information Collected Automatically

Analytics data: We use Plausible Analytics, a privacy-focused analytics platform that does not use cookies, does not use advertising identifiers. Network requests necessarily transmit an IP address for service processing. Plausible provides aggregate website usage statistics only.
Essential cookies:We use cookies for session management, authentication (for logged-in users), and your chosen language. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

1.3 Calculator information

Clinical inputs are processed by the calculator server. The revised operational log records status, processing time and model version without clinical values or account email. Fit diagnostics are returned with the result and are not written to security logs. Saved calculation history remains a separate account feature. Earlier releases logged clinical values and diagnostics; their historical records and backups have not been certified deleted.

2. How We Use Your Information

To provide, maintain, and improve the Service.
To communicate with you about your account, inquiries, or pilot program.
To send product updates and clinical dosing insights (you can unsubscribe at any time).
To analyze aggregate website usage to improve user experience (via privacy-friendly analytics only).

3. Data Sharing

We do not sell, rent, or trade your personal information. We may share your information with:

Subprocessors: Third-party services that help us operate the Service. See Section 4 for the full list, what data each one processes, and where they are located. Applicable provider terms and data-processing arrangements must be reviewed for institutional use.
Legal obligations: When required by law, court order, or governmental request.

4. Subprocessors

The following vendors process limited categories of personal information on our behalf. Do not send PHI through the public service; actual institutional data flows require separate review.

Vendor	Role	Data Processed	Location
Render	Website hosting and database storage for account credentials, audit logs, calculation logs, and pilot lead data.	Hashed passwords, email addresses, stored calculation history and historical clinical logs, security audit events.	United States (AWS regions).
Stripe	Subscription billing for paid tiers (Individual Pro, Department, Hospital).	Billing email, name, payment method tokens. Card data is held by Stripe — Vancomyzer never sees raw card numbers.	United States.
Google Workspace	Email delivery (account approvals, password resets, pilot welcome emails, bug reports). Also hosts the pilot@dosys.health and sales@dosys.health mailboxes that receive customer correspondence.	Email addresses and email body content. Do not send patient information by email; unsolicited messages may nevertheless contain sensitive information and require appropriate handling.	United States. Google Workspace offers a HIPAA Business Associate Agreement for covered customers.
GitHub	Storage of the software code for the Vancomyzer calculator and the dosys.health marketing site.	Source code only — no user or patient data.	United States.
Plausible Analytics	Privacy-respecting web analytics on dosys.health and vancomyzer.com.	Aggregate usage reports; no clinical values are sent by the analytics integration. Requests transmit an IP address for service processing; reports do not display it. No tracking cookies.	Provider-managed infrastructure; confirm applicable contractual location and retention.

Render

Role:: Website hosting and database storage for account credentials, audit logs, calculation logs, and pilot lead data.
Data:: Hashed passwords, email addresses, stored calculation history and historical clinical logs, security audit events.
Location:: United States (AWS regions).

Stripe

Role:: Subscription billing for paid tiers (Individual Pro, Department, Hospital).
Data:: Billing email, name, payment method tokens. Card data is held by Stripe — Vancomyzer never sees raw card numbers.
Location:: United States.

Google Workspace

Role:: Email delivery (account approvals, password resets, pilot welcome emails, bug reports). Also hosts the pilot@dosys.health and sales@dosys.health mailboxes that receive customer correspondence.
Data:: Email addresses and email body content. Do not send patient information by email; unsolicited messages may nevertheless contain sensitive information and require appropriate handling.
Location:: United States. Google Workspace offers a HIPAA Business Associate Agreement for covered customers.

GitHub

Role:: Storage of the software code for the Vancomyzer calculator and the dosys.health marketing site.
Data:: Source code only — no user or patient data.
Location:: United States.

Plausible Analytics

Role:: Privacy-respecting web analytics on dosys.health and vancomyzer.com.
Data:: Aggregate usage reports; no clinical values are sent by the analytics integration. Requests transmit an IP address for service processing; reports do not display it. No tracking cookies.
Location:: Provider-managed infrastructure; confirm applicable contractual location and retention.

We review this list quarterly. To request notification when subprocessors are added or changed, email privacy@dosys.health.

5. Cookies

We use essential cookies only. No tracking.

We respect your data the way we respect your clinical judgment. Dōsys does not use Google Analytics, Facebook Pixel, advertising trackers, or any cookie-based tracking technology. Our analytics are powered by Plausible, which is cookieless and records page views without personal identifiers.

6. Data Security

We implement industry-standard security measures to protect your information, including TLS encryption for all data in transit and encrypted storage for account data at rest. However, no method of electronic transmission or storage is 100% secure.

7. Data Retention

We retain the personal information we collect only for as long as it serves a legitimate purpose. Specific retention windows by data category:

Data category	Retention
Calculation history	90-day application retention for explicit saved calculations; backups require separate review.
Calculation performance records	Status, duration and model version only in the revised release; how long hosting records are kept depends on the service settings.
Historical clinical logs and fit diagnostics	Legacy records and backups require a documented retention review; deletion has not been verified.
Accounts, security, correspondence and billing	Retained according to applicable service, contractual and legal requirements; contact us for the actual record category and deletion review.

Calculation history
90-day application retention for explicit saved calculations; backups require separate review.
Calculation performance records
Status, duration and model version only in the revised release; how long hosting records are kept depends on the service settings.
Historical clinical logs and fit diagnostics
Legacy records and backups require a documented retention review; deletion has not been verified.
Accounts, security, correspondence and billing
Retained according to applicable service, contractual and legal requirements; contact us for the actual record category and deletion review.

You may request deletion of your account and associated personal data at any time by emailing privacy@dosys.health. We will assess requests and respond within the applicable legal timeframe, including any permitted exceptions and extensions.

8. Your Rights Under US State Privacy Laws

If you reside in a US state with a comprehensive consumer privacy law — including but not limited to California (CCPA/CPRA), Virginia (VCDPA), Colorado (CDPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Florida (FDBR), Montana (MCDPA), Tennessee (TIPA), Delaware (DPDPA), New Jersey (NJDPA), New Hampshire (NHPA), Maryland (MODPA), and Minnesota (MCDPA) — you may have the following rights with respect to your personal information:

Right to know
Request access to the personal information we hold about you and how we use it.
Right to correct
Request correction of inaccurate personal information.
Right to delete
Request deletion of your personal information.
Right to portability
Request a copy of your personal information in a structured, machine-readable format.
Right to opt out
Opt out of the sale or sharing of your personal information for cross-context behavioral advertising. Dōsys does not sell personal information.
Right to opt out of profiling
Opt out of profiling that produces legal or similarly significant effects. Dōsys does not perform such profiling.
Right to non-discrimination
Exercise these rights without being denied service, charged different prices, or provided different quality of service.

To exercise any of these rights, email privacy@dosys.health with the subject line “Privacy Rights Request” and we will respond within the timeframe required by your state's law (generally 30–45 days).

9. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or prominently posted on the Service.

11. Contact

Dōsys Health LLC
McAllen, Texas
privacy@dosys.health