Privacy Notice

What we collect

• Account: display name, email address, password hash, consent records, and account timestamps.
• Community activity: product submissions, revisions, reviews, likes, and moderation status.
• Security and operations: IP address, browser information, request logs, cookies needed for sign-in, and error diagnostics.
• Messages: information you send when contacting support or making a privacy request.

Please do not submit diagnoses, medical records, insurance data, precise treatment history, or another person’s information.

How and why we use it

We use information to provide accounts, publish and moderate the catalog, prevent abuse, secure and troubleshoot the service, answer requests, comply with law, and improve accessibility and usefulness. Where GDPR or UK GDPR applies, our legal bases are contract (providing requested features), legitimate interests (security and moderation), consent where required, and legal obligation.

When we share it

Public display names, approved submissions, and approved reviews are visible to anyone. Service providers may process limited data for hosting, database, email, security, backups, and support under appropriate terms. We may disclose information when legally required or needed to protect people, rights, and service security. We do not sell personal information.

Retention and security

We keep account data while the account is active and as reasonably needed for security, disputes, legal duties, and backups. Routine logs are kept for a limited operational period. Deletion from backups may take additional time. We use access controls, encryption in transit, password hashing, backups, monitoring, and least-privilege administration, but no online service can promise perfect security.

Your choices and rights

You may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent where those rights apply. You may also complain to your local privacy authority. We will verify requests and respond within the time required by applicable law. Email [email protected]. You may appeal a denied request by replying with “Privacy appeal.”

International use and children

The service is operated from the United States. If information crosses borders, we use safeguards required by applicable law. OstomyChoices is intended for adults and is not directed to children under 18. Contact us if you believe a child submitted personal information.

Cookies and changes

We use strictly necessary cookies for authentication and security. We will ask before adding optional analytics or advertising cookies where consent is required. Material notice changes will be highlighted here and, when appropriate, by email. Health-related privacy details are in our Consumer Health Privacy Notice.