Privacy Policy

Bayesian Homeopathic Repertory (BHR)

Last updated: August 14, 2026

1. Introduction and data controller

This Privacy Policy describes how BHR (Bayesian Homeopathic Repertory), hereinafter "BHR", "the platform", or "the system", processes the personal data of its users. BHR is an online service accessible from different countries, so this policy follows Argentine legal requirements and, in addition, good practices from the European Union's General Data Protection Regulation (GDPR) and United States privacy regulations.

Privacy contact email: bayes.hom.rep@gmail.com
Site: bhr-iota-nine.vercel.app

By registering and using BHR, the user states that they have read and understood this policy.

2. Scope and legal frameworks

This policy applies to all BHR users, regardless of their country of residence.

Argentina: BHR processes data in accordance with Law No. 25,326 on the Protection of Personal Data and its Regulatory Decree 1558/2001, under the supervision of the Agency for Access to Public Information (AAIP).
European Union / European Economic Area: for users located in the EU/EEA, BHR observes the principles and rights of Regulation (EU) 2016/679 (GDPR).
United States: for users in the U.S., and California in particular, BHR observes good practices aligned with the CCPA/CPRA and comparable state regulations.

When different rules grant a person a higher level of protection, BHR will seek to apply the more protective standard.

3. What data we collect (and what we do NOT collect)

a) Registration and account data. To create and manage your account and enable authentication:

Name.
Country.
Email address (which also serves as your username).
Password, stored encrypted through hashing (never in plain text; inaccessible even to the BHR team).
Whether you declared holding a medical degree, and whether you declared being a homeopath — self-declared professional data, used to understand the user community profile and to assign the "researcher" role.
Your preference to receive or not receive the newsletter.
Role within the platform: user, researcher, or administrator.

Under CCPA terminology, most of this data falls under the category of identifiers.

b) Account activity data. To offer you access recovery and to allow the administrator to monitor the system's overall usage, we record, associated with your account (not with your content):

Date and time of each login.
How many times you clicked "Clear selection" to start a new repertorization — an activity counter, not linked to the content of any query (which symptoms or remedies were involved is never recorded).

This activity data is associated with your account — it is not anonymous — but it never contains nor allows reconstruction of the content of your repertorizations.

c) Technical security data. To prevent unauthorized access, we temporarily record the IP address along with the number of attempts on sensitive operations (login, registration, password recovery), for the sole purpose of limiting excessive attempts within a short time window.

3.1. Data we do NOT collect or store

We do not record the symptoms entered in a repertorization.
We do not record the results (suggested remedies, rankings, or probabilities) of any repertorization.
We do not store medical records or patient health data. BHR is a professional support tool and does not constitute medical software or a clinical record system. Clinical responsibility and the handling of patient data rest exclusively with the professional user, outside this platform.

Accordingly, BHR does not process sensitive data or special categories of third-party health data through the system. This data-minimization design is a deliberate "privacy by design and by default" decision.

4. Purposes and legal bases of processing

Purpose	Legal basis
Create, authenticate, and manage the account; provide the repertorization service	Performance of a contract / provision of the requested service
Verify your account and let you recover access (verification email, password reset)	Performance of a contract — essential communications, no separate consent required
Prevent unauthorized access (rate limiting, audit log of administrative actions)	Legitimate interest in system security
Measure overall system usage (account activity, section 3.b)	Legitimate interest in improving the product
Manage donations and, in the future, paid subscriptions (see note below)	Performance of a contract / legitimate interest
Send news and updates	Consent (opt-in)
Comply with legal obligations or authority requirements	Legal obligation

Data is not used for any purpose incompatible with those stated here.

Note on donations and subscriptions: BHR plans to introduce, as a first stage, a donation option and, once validated, a paid annual subscription option. As of this version of the policy, that mechanism is not yet implemented. When it is enabled, this policy will be updated with details on what payment data is collected and which payment processor is used as a new data processor (BHR will not store card data or other payment details directly).

5. Communications

BHR will contact the user in the following cases:

Essential account communications: email verification upon registration, and password or username recovery when you request it. These are necessary to provide the service and do not depend on your newsletter subscription.
Donations and subscriptions (once implemented): donation confirmations, receipts, and expiration or renewal notices. These do not constitute advertising and are necessary for that specific relationship with the user.
News and updates: only to those who have expressly opted in (unchecked by default at registration). You may unsubscribe at any time by writing to bayes.hom.rep@gmail.com.

BHR does not send third-party advertising or use contact data for unrelated commercial purposes.

6. No sale or transfer of data

BHR does not sell or "share" (in the CCPA/CPRA sense) personal data, and does not transfer, sell, or hand over to third parties the user database or the system's proprietary repertory, except:

When there is a legal obligation or a requirement from a competent authority.
With service providers acting as data processors solely to operate the platform (see section 8), under a duty of confidentiality and the controller's instructions.

In the past 12 months, BHR has not sold or shared personal data for commercial purposes. The confidentiality duty under Article 10 of Law 25,326 also applies.

7. Data retention

Account and activity data: retained while the account remains active. When an account is deleted, its registration and associated activity data are deleted along with it.
Technical security data (section 3.c): retained for short windows (minutes to hours), the time needed to control attempts.
Upon a deletion request, data is deleted, except for data that must be retained under legal requirements.

8. Information security and data processors

BHR adopts technical and organizational measures, including:

Passwords encrypted through hashing (bcrypt).
Token-based authentication with expiration, and role-based access control.
Rate limiting on sensitive operations.
HTTP security headers (Content-Security-Policy, HSTS, among others) and encrypted connection (HTTPS) across the entire site.
Audit log of actions taken by administrators on user accounts.

To operate the service, BHR uses the following data processors:

Vercel Inc. — application hosting.
Neon Database, Inc. — managed database (Postgres), hosted on AWS infrastructure in the us-east-1 region (United States).
SMTP email provider — sending of transactional emails (account verification, password recovery). [to be named once the effectively configured provider is confirmed]
Payment processor — to be added once the donation/subscription option is enabled (see section 4). Not yet in use.

No security measure is infallible. BHR does not guarantee absolute security, but acts diligently and, in the event of an incident affecting personal data, will notify the affected individuals and authorities when applicable and within the legally required timeframes.

9. International data transfers

Since BHR operates with global providers (Vercel and Neon are U.S. companies), data may be stored or processed on servers located outside your country, including the United States.

For transfers from the EU/EEA, BHR relies on recognized mechanisms, such as adequacy decisions or Standard Contractual Clauses (SCC) offered by the providers.
For transfers from Argentina, BHR seeks to ensure recipients offer adequate guarantees under Article 12 of Law 25,326.

10. Cookies and similar technologies

BHR does not use cookies. The session is maintained through an access token stored locally in your browser, which is sent only to our own server. No third-party cookies or tracking technologies are used for advertising purposes.

11. Automated decisions

BHR uses a Bayesian algorithm to display likelihood ratios for a group of symptoms in relation to certain homeopathic medicines, observed in an ongoing observational research study. These outputs are inputs for the professional judgment of the user and do not constitute automated decisions, suggestions, or recommendations that produce legal or similarly significant effects on the user within the meaning of Article 22 of the GDPR. Clinical decision responsibility always remains human and belongs to the professional.

12. User rights

Depending on your jurisdiction, you may exercise the following rights:

Access to your data and information about its processing.
Rectification / correction of inaccurate data.
Erasure / deletion ("right to be forgotten" under GDPR).
Restriction of processing (GDPR).
Portability of the data you provided (GDPR).
Objection to certain processing activities.
Withdrawal of consent at any time (for example, unsubscribing from updates), without affecting the lawfulness of prior processing.
Non-discrimination for exercising your privacy rights (CCPA/CPRA).

How to exercise them: write to bayes.hom.rep@gmail.com, identifying yourself appropriately. BHR will respond within the applicable legal timeframes. There is no charge for exercising these rights, except in the exceptional cases provided by law for manifestly unfounded or excessive requests.

Complaints to authorities:

Argentina: Agency for Access to Public Information (AAIP).
EU/EEA: the supervisory authority of your country of residence.
California (U.S.): the California Privacy Protection Agency or the State Attorney General's Office.

13. Minors

BHR is intended for professionals and adults. It is not directed at minors and does not knowingly collect their data. If we detect data from a minor collected without a legal basis, we will delete it.

14. Changes to this policy

BHR may update this policy to reflect changes in the service or in applicable regulations. The current version is published at bhr-iota-nine.vercel.app/privacy.html with its last-updated date.

15. Contact

Privacy email: bayes.hom.rep@gmail.com