What KODEx records about you, why it records it, who else sees it, and how to get rid of it.
The short version
We keep what the service needs to work for you: the email address you sign in with, what you search for and save, the notes and sheets you write, your team, and, if you subscribe, what Stripe tells us about that subscription. There are no analytics, no advertising, and no third-party trackers on any page. You can erase your history and saved items, or delete your whole account, yourself, at any time, from your account page.
What we record
- Your email address. It is how you sign in. Our authentication provider holds it, and so does Stripe if you subscribe. Our own tables link your records by a one-way hash of it rather than the address.
- Addresses you type in. When you invite a teammate or share a drug sheet, the address you enter is stored as written, so the invitation can reach that person.
- Your name, if you choose to add one. It is optional and used only to address you.
- What you searched for. The text of each search, so you can see your own history. Searches are also counted, without who made them, to rank the codes people look up most. Please do not type patient-identifying detail into it — see below.
- What you saved. The codes, policies and payers you put in folders, and the folder names.
- What you write. Notes (private, or shared with your team), drug sheets and their entries, cheat sheets, and any problem report you send us.
- Your team, if you are on one: its name, its members and their roles, and its invitations.
- Your settings, such as whether you get the weekly change email.
- Subscription details, if you have one: a Stripe customer reference, the plan, the number of seats, its status and its renewal date. We never see or store card numbers.
- Rate-limit counters. To hold the free limit and slow down sign-in guessing we keep keyed hashes of your network address and email address with a count. Our own tables never store the network address itself; our hosting and authentication providers record it in their security logs.
- Ordinary server logs kept by our hosting provider for a short period. They include the address of each page requested, which for a search includes the search text.
What we do not record
- No analytics, no advertising pixels, no third-party trackers, no cross-site cookies. The application loads no script from any company that sells advertising.
- No card details.
- No protected health information. KODEx is not built for PHI, and Kura Notes LLC is not a HIPAA business associate and will not sign a business associate agreement. Do not enter patient names, dates of birth or service, member, claim or record numbers, or any other identifying detail anywhere in the application, including search, notes, drug sheets and problem reports.
Why we hold it
- To sign you in and keep you signed in.
- To show you your own history, saved references, notes and sheets, and your team’s.
- To apply the free daily limit fairly, and to take payment if you subscribe.
- To send the weekly change email, if you turn it on.
- To keep the service secure — sign-in attempts are rate limited and staff actions are logged.
- To run the service and answer you. Our staff can see account email addresses, names, plans and problem reports. They cannot read your private notes through the application.
We do not sell your information, and we do not share it for anyone else’s advertising.
Who else processes it
We use a small number of service providers, each handling only what its job needs:
- Supabase — database, authentication and file storage.
- Vercel — hosting and request logs.
- Stripe — payments and the billing portal. Stripe holds the card details and your billing email; we hold a reference.
- Resend — delivery of sign-in codes and the weekly change email.
- DeepSeek, an AI provider whose servers may be outside the United States — checks newly published public source files and drug-label changes before they go live. No account, search, note or other personal information is ever sent to it, only documents that publishers have already released.
- CMS and FDA lookups. When you use the NPI or NDC lookup, the number or name you type is sent to the government registry (CMS’s NPPES, or FDA’s openFDA) to fetch the answer.
Cookies and browser storage
Only the ones the application needs to work: a session cookie that keeps you signed in, a short-lived cookie during the sign-in code exchange, and, for staff, a one-hour cookie recording that the staff area was unlocked. Your browser also keeps a few preferences on your device, such as the colour theme, the sidebar and where “Back” returns to. Stripe sets its own cookies on its checkout and billing pages. No advertising or analytics cookies are set, so there is no consent banner to dismiss.
How long we keep it
- Your searches, saved items, notes and sheets are kept until you delete them or delete your account.
- Deleting your account removes your records at once. Database backups that still hold them are overwritten within 7 days. A problem report you sent is kept without your name, so the fix can still be traced.
- Rate-limit counters are deleted after 30 days.
- Stripe keeps billing records as long as tax law requires.
- Server logs are kept for a short period by our hosting provider and then discarded.
What you can do
- Erase your history and saved items yourself, from your account page, immediately and without asking us. It removes the record of what you looked up, not your access.
- Clear items one at a time from History or Saved.
- Delete your account yourself, from Settings. It cancels any subscription first, then deletes your profile, searches, saved items, notes, sheets and team membership.
- Ask us for a copy of what we hold, or to correct or delete it, by writing to support@kuranotes.app. We answer within 30 days, and may ask you to confirm the request from your account’s email address.
California residents
In the past 12 months we collected identifiers (email address, name, hashed network address), commercial information (plan and billing status) and internet activity (searches, saved items, notes and sheets), for the purposes above, and disclosed them only to the service providers listed. We do not sell or share personal information, have not done so in the past 12 months, and do not use sensitive personal information to infer anything about you. You may ask to know, delete or correct your information by writing to support@kuranotes.app; an authorised agent may ask for you with your signed permission. We will not treat you differently for doing so. Residents of other states with similar laws have the same rights, and the same address works for them.
Security
Traffic is encrypted in transit. Each account’s rows are separated at the database level rather than by application code alone, so one account cannot read another’s even if the application were at fault. The key that bypasses those rules is only ever used on the server and is never sent to a browser. Staff access to the administrative area needs both a staff role and a separate passphrase, and every staff action is recorded.
No system is perfectly secure. If we discover a breach affecting your information we will tell you and any regulator the law requires, without undue delay.
Children
KODEx is a professional tool and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, write to support@kuranotes.app and we will delete it.
Where your data is held
Our providers store and process your data in the United States. (DeepSeek, above, receives only public documents.) If you use the service from elsewhere, you are sending your information to the United States, where privacy law differs from your own.
Changes
If we change this policy materially we will tell account holders by email at least 30 days beforehand, and the date at the top of this page will change.
Contact
Kura Notes LLC. Email support@kuranotes.app — that is the address for a request to see, correct or delete what we hold, and we answer within 30 days.