WhatsInYourMeds

WhatsInYourMeds Privacy Policy

Last updated: October 11, 2026

WhatsInYourMeds keeps your medicine list under a code, not your name. We use it to run the service, and we don't sell it or share it with advertisers.

This policy is from ExciIQ LLC, an Ohio limited liability company ("we" or "us"). It covers the WhatsInYourMeds app at app.whatsinyourmeds.com and the website at whatsinyourmeds.com (together, the "Service"). A second document, the Consumer Health Data Policy, goes deeper on your medicine list. Please read both. They go with our Terms of Service.

1. THE SHORT VERSION

These are our own words about how we treat your information:

Your med list is stored under a code, not your name. We don't collect your name at all, and your account email lives only with our sign-in provider — never in the database that holds your medications. If you join the waitlist, we use that email only to tell you when we launch. We never link it to a med list, and we delete it after the launch email.

Separated by design: the database with your meds doesn't know your name.

We don't use ad trackers. We don't sell your information. We don't send your information to advertisers or analytics companies.

2. WHAT WE COLLECT

This is what we collect.

  • Your sign-in details. You sign in with a code sent to your email, or with a passkey. Our sign-in provider, Clerk, holds your email address, your passkey details, and records of your sign-ins. Those records can include your IP address and your browser or device type. We don't copy your sign-in email into our database. Clerk gives us an account code for you, and our database holds that code. Our team can match a code to an email address using Clerk's records, so we can handle a request from you.
  • Your medicine list. For each medicine you add, we store its FDA label codes (the set ID and the NDC), the label version you are on, and the date you added it. We don't ask for doses or schedules. When you remove a medicine, it leaves your list. See Section 9 for what stays.
  • Label-update history. When you move a medicine to a newer label version, we log the move: the medicine's codes, the two label versions, and the time, under your list's code. Removing a medicine doesn't remove this history. It stays until you delete your account.
  • Your settings and notices. We store your choice about label-update alerts. We also store which label-update notices you have seen or dismissed.
  • Sharing records. When you share a view or send a copy, we store a record of the link or code. It shows when you made it, when it expires, and whether it was used or cancelled. The link or code is shown to you once, when you make it. We keep only a scrambled copy (a hash), so we can't read it back. For a live view, we also store a record that links your account code to the viewer's account code. For a copy code, we store a saved copy of your list as it was when you made the code. Removing a medicine from your list doesn't change that saved copy.
  • Your Terms record. We store which version of the Terms you accepted, your account code, and the time. We don't store your IP address or device details with it.
  • Daily counts. We count how many searches and label look-ups each account makes each day. We use the counts to spot automated copying of our data. If an account's counts look like automated copying, we send our team an alert that can include the account code. The alert goes to our team and holds no email address.
  • What you search for. The words, NDC or imprint you type are sent to our servers to find results. We don't save your searches to your account.
  • Server logs. Our servers write a log line for each request. It holds the time, your IP address, the web address requested, and the result. The web address can include your list's code, a medicine's FDA codes, or the words you searched for. We use logs to keep the Service running and secure. Fly keeps them for a short time. We don't send them anywhere else.
  • On your device. Your private notes stay in your browser's storage on your device. We don't receive them. The same is true of your screen color and text size choices. When you sign out or delete your account in the app, the app clears your private notes on that device. If you open a share link while signed out, your browser holds the link's code in tab storage until you finish signing in.
  • The website. If you join the waitlist, we collect your email address and nothing else. We store it in our database, apart from any medicine list. Our team gets an alert that someone joined, and the alert does not include the address (see Section 5). If the form can't reach our server, it opens your email app so you can send the same address to hello@exciiq.com, and it lands in our team's inbox.
  • Messages to us. If you write to us, we keep your message and your email address.

3. WHAT WE DO NOT COLLECT

The Service has no place to enter, and we don't ask for:

  • your name;
  • your date of birth, age or gender;
  • your street address or phone number;
  • payment details, because the Service is free during early access;
  • photos, or access to your camera or contacts;
  • notes you type in your own words, because the app has no free-text box for notes.

We don't ask your device for your location. Your IP address can show roughly where you are, and our servers and providers can see it, as described in this policy.

Please don't try to put your name or other identifying details into the Service. It doesn't need them.

4. HOW WE USE YOUR INFORMATION

We use your information to:

  • show your medicine list, its ingredients, and label updates, and let you share it;
  • keep the Service working and secure, fix errors, and limit automated copying;
  • keep a record that you accepted the Terms;
  • answer your messages, and tell waitlist members when we launch;
  • follow the law.

We don't use your information for advertising. We don't sell it. We don't build marketing profiles from it.

5. WHO GETS YOUR INFORMATION

We share information only in the ways below.

  • People you choose. See Section 6.
  • Companies that help us run the Service. They may use your information only to do that work for us.
  • The law. We may share information when the law requires it, such as a valid court order, or to protect people from serious harm. Where the law allows, we will tell you first.
  • A buyer. If we sell or merge our business, your information may go to the new owner. We will tell you before that happens, and you can delete your information first.

We don't sell your information. We don't share it with advertisers, data brokers, social media companies, or analytics companies.

The companies that help us run the Service are listed below. Each has its own privacy policy, which we encourage you to read.

  • Clerk. Our sign-in provider. It holds your email address, passkey details and sign-in records. It sends your sign-in codes.
  • Cloudflare. It hosts the app and the website and runs our domain names. It handles each page request, so it sees your IP address, browser details, and the page address. A page address can include a medicine's FDA codes.
  • Fly.io. It runs our servers. It handles each request the app sends to our servers, so it sees your IP address and the medicine codes or search words in the request.
  • Neon. It hosts our database. It holds the records in Section 2 that we keep in our database, under your account code. It never receives your private notes.
  • Google Workspace. It hosts our email, legal@exciiq.com and hello@exciiq.com, so it handles the messages you send us.
  • Resend and Pushover. For the waitlist only. We use them to send our team an alert when someone joins. The alert says only that someone joined. It does not include the email address.

6. SHARING YOUR LIST

Sharing is always your choice, and each kind has its own consent screen.

  • Share a view. This gives someone a read-only view of your medicines and their ingredients. They must sign in to WhatsInYourMeds to open it. They see your list as it changes, but they can't change it. They don't see your private notes. They don't see a name or an email address. Your list carries neither. The link's secret sits after the # sign in the address, which your browser doesn't send to our servers. The view stays live until you stop sharing. An unused link expires after 7 days. When you stop sharing, their access ends right away. We keep a record that the share existed, marked as stopped, until you or the viewer deletes an account.
  • Send a copy. This makes a one-time code. The code works once and expires after 72 hours. Your care team opens it in ExciIQ, our app for health professionals, so they need an ExciIQ account. Anyone who has the code and an ExciIQ account can open it, so give it only to your care team. They get their own copy of your list as it was on the day you made the code. It has no private notes. We don't keep a record that ties the copy to the professional who opened it. After they open it, the copy belongs to them and is kept in their records, under their own rules. They may add details of their own to it. Changing your list later doesn't change their copy. Deleting your account doesn't delete it. You can cancel a code until it is opened. If you cancel a code, or it expires, the saved copy of your list stays with the code record until you delete your account.

Once someone has seen your list, we can't take back what they saw. Please share only with people you trust.

7. COOKIES AND TRACKING

  • We don't use advertising or analytics cookies, pixels or scripts. The app runs only code from us and from our sign-in provider. We host our own fonts.
  • Our sign-in provider uses cookies and browser storage to keep you signed in.
  • Our website doesn't set cookies of its own.
  • We store a few choices in your browser: your private notes, your screen color, and your text size.
  • We don't track you across other sites, so a "Do Not Track" signal changes nothing.

8. HOW LONG WE KEEP INFORMATION

  • Your medicine list, settings, notices, sharing records and daily counts: until you remove them or delete your account. Label-update history and the saved copy in a copy code stay after you remove a medicine, or cancel a code, until you delete your account.
  • Your Terms record: we keep it after you delete your account, so we can show that our agreement was made.
  • A copy a care team has opened: it belongs to them.
  • Server logs: kept by Fly for a short time. We don't send them elsewhere.
  • Backups and copies: our database provider keeps backups and history for a short time. A branch or snapshot we make for testing or recovery is a copy too. Deleted information can sit in these until they expire. That is never longer than 6 months. If we ever restore one, we delete your information again before the Service uses it.
  • Waitlist emails: until we send the launch email. Then we delete them from our database and from our team inbox within 30 days.
  • Messages to us: as long as we need to answer you and keep our records.
  • Your device: private notes and display choices stay on your device until you clear your browser's site data. Signing out or deleting your account in the app clears your private notes on that device, but not on other devices or browsers.

9. DELETING YOUR INFORMATION

You can remove any medicine from your list in the app at any time. You can stop a live view and cancel a copy code that hasn't been opened.

To delete your account and the information we hold about you, open Me in the app and choose "Delete my meds and my account". We ask you to confirm. The app then removes your medicine list, label-update history, settings, notices, sharing records, daily counts and account code from our database. It also deletes your account with our sign-in provider. That removes your email address and sign-in details there.

If you can't use the app, email legal@exciiq.com from the email address on your account. We will delete your account with our sign-in provider, which sets off the same removal from our database. We will act on a request within 45 days.

What stays: your Terms record, any copy a care team has already opened, a saved copy in a code record until you delete your account, server logs and backups until they expire, and what is on your own device. If you only remove a medicine, its label-update history stays until you delete your account.

10. YOUR CHOICES AND RIGHTS

These choices are open to everyone who uses the Service, wherever you live in the United States.

  • See. You can see your medicine list in the app. You can also ask us what information we hold about you, and who we share it with.
  • Fix. You can change your list in the app.
  • Delete. See Section 9.
  • Withdraw consent. You can stop a share or cancel a copy code at any time. You can stop using the Service and delete your account.
  • Stop emails. Every email from us about the Service tells you how to stop getting them. You can also ask us at the address below, and we will remove you from our list.
  • Ask. Email us at the address below. We may ask you to write from the email address on your account so we know it is you.

If we say no to a request, tell us why you disagree. We will review it and answer within 45 days. You may also contact your state attorney general. The Consumer Health Data Policy has more about your health data rights.

11. SECURITY

  • Our app, website and servers use encrypted HTTPS connections.
  • We keep identity and health information apart. Your email lives with our sign-in provider. Your medicine list lives under a code.
  • Database rules limit each account's records to that account.
  • We keep only a scrambled copy (a hash) of share links and codes, and unused sharing codes expire.

No system is perfectly secure, so we can't promise that nothing will ever go wrong.

If your health information is exposed without your OK, we will notify you as the law requires, without unreasonable delay and no later than 60 days after we find out. We will also tell the Federal Trade Commission and others as the law requires.

12. WHO CAN USE THE SERVICE

The Service is for adults who are 18 or older and live in the United States. Please don't use it if you are under 18. If we learn that an account belongs to someone under 18, we will delete it. Our servers and database are in the United States.

13. LINKS TO OTHER SITES

The Service links to other sites, such as DailyMed and exciiq.com. Those sites have their own privacy practices. When you follow a link, the other site can see which page you opened. A DailyMed link carries the medicine's set ID in its address, so DailyMed can see which label you opened.

14. CHANGES

We may update this policy. We will post the new version here and change the date at the top. If a change matters for your health information, we will ask you to accept the new Terms before you keep using the Service.

15. CONTACT

Questions about this policy, or requests about your information.

By mail: ExciIQ LLC, 6545 Market Ave. North, Ste 100, Canton, OH 44721. This is the address on our registration, not an office you can visit.

By email: legal@exciiq.com.

For information and education only — not medical advice. Never stop, start, or change a medication without talking to your prescriber.