Privacy Policy

Who we are

Dosius (“Dosius”, “we”, “us”) is a subscription regulatory intelligence service that aggregates publicly available U.S. drug-related records. This policy explains what personal information we collect when you use the service at dosius.com, how we use it, and the choices you have. Questions? Reach us at support@dosius.com.

Information we collect

• Access requests. If you ask for access from the landing page, we keep the name, work email address, organization, and note you submit, together with the time, so we can decide on and reply to your request. A request is deleted automatically 120 days after it is decided.
• Account information. When you accept an invitation we collect your name and email address, and optionally your firm or organization. Sign-in runs on dosius.com with WorkOS as the identity provider behind it: WorkOS stores your email address, your password in hashed form, and the authenticator factor you enroll for the second sign-in step. If you choose a code by email instead, we generate the code, keep only a hashed copy for ten minutes, and send it to your address. We never see or store your password. The time of your last sign-in is stored with your account. The network address and browser used to sign in are passed to WorkOS for its own security checks and used by us to rate-limit sign-in attempts.
• Browsers you sign in from. For each browser you sign in from, we keep a scrambled (hashed) copy of its device cookie, the browser and device type (for example, “Chrome on Windows”), and when it was first and last used. We use this only to email you when your account is signed in from a browser it hasn’t used before. A browser not used for a year is removed.
• Billing information. Where paid plans apply, payments are processed by Stripe. Your card number is entered directly with Stripe and never touches our servers; we store only your subscription status, plan, and a Stripe customer reference.
• Usage information. We record how signed-in accounts use the service, specifically, pages viewed, searches run, records opened, exports made, and alerts managed, along with their respective timestamps. We use this to operate per-account plans, show you your own session history (the last 30 days, under My Session History), support users, and improve the product.
• Your settings. Preferences you set in the app, like pinned pages, the layout and figures of your dashboard, chart text size, and the items you watch for alerts, are stored with your account so they follow you between devices.
• Questions you ask. If you use “Ask Dosius”, the question you type is sent to Anthropic, our AI provider, which turns it into a database query and writes the answer. Your questions and answers are saved as chats you can reopen for 30 days, after which they are deleted. Do not include confidential or personal information in questions. The morning brief on the dashboard is also written by Anthropic’s model, from public records only; nothing about you is sent for it.
• Feedback and messages. If you send feedback from the app or use a contact form, we keep your name, email address, message, the page you sent it from, and any screenshots you attach, so we can respond and fix things.
• Technical information. Like most web services, our servers keep standard logs (network address, browser type, requested page, time) for security and troubleshooting.

Cookies and browser storage

We use a small number of first-party cookies, all functional — we do not use advertising or cross-site tracking cookies:

• Session cookie — keeps you signed in.
• Sign-in cookie — during sign-in, a signed cookie that lasts ten minutes carries the state between the password and the second sign-in step and protects the forms against forged submissions.
• Device cookie — a random identifier, kept for up to a year, that lets us recognise a browser you’ve signed in from before, so we can email you when your account is used from a new one. It contains no personal information.
• Preview cookie — when a free preview is offered to visitors without an account, a signed cookie counts the preview searches and profile views used this month. It contains no personal information and expires automatically.

Your browser also keeps a few conveniences locally, such as your light or dark theme, which table columns you have hidden, and whether a page’s charts have played their entrance this session. These never leave your browser.

The request-access, sign-in, and password-reset forms are protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a script. Cloudflare processes your network address and browser signals for that check, under its own privacy policy, and may set a cookie of its own.

Email we send

• Account email — invitations, password resets, and sign-in help, sent from support@dosius.com.
• Sign-in alerts — an email when your account is signed in from a browser we haven’t seen before, with the time and the browser, so you can act if it wasn’t you.
• Alert digests — only if you set up alerts, at the frequency you choose, with a link in every email to manage or stop them.

Our email is delivered by Resend, which processes your address and the message to send it. We do not send marketing email.

How we use your information

• To decide on access requests and provide, secure, and personalize the service
• To manage your subscription, free trial, and billing where they apply
• To send the alerts you asked for and the emails your account needs
• To respond to feedback, messages, and support requests
• To monitor usage, prevent abuse, and enforce per-account plan limits
• To understand which features are used and improve the product

We do not sell your personal information, and we do not use it for third-party advertising.

Who we share it with

We share personal information only with the service providers that make Dosius work, each bound by its own privacy commitments:

• WorkOS — identity: your email, hashed password, and authenticator factor
• Stripe — payments and subscription billing
• Anthropic — processes “Ask Dosius” question text to generate answers, and writes the morning brief from public records
• Resend — delivers our account and alert email
• Cloudflare — the Turnstile check on our signed-out forms
• Our hosting provider — the servers the service runs on

We may also disclose information if required by law, to protect our rights or users’ safety, or as part of a business transfer (in which case this policy would continue to apply to the transferred data).

Data retention

We keep account, settings, and usage records while your account is active. Ask Dosius chats are deleted after 30 days. Feedback, messages, and access requests, with any screenshots, are deleted 120 days after they are handled. If your account is closed, we delete your account record, settings, alerts, activity, chats, and the messages and screenshots you sent us at that time, except where we must keep something (for example, billing records required for tax and accounting purposes).

Security

The service is served over HTTPS. Passwords, authenticator factors, and payment details are handled exclusively by our specialized providers, sign-in attempts are rate-limited, and access to personal data is limited to what operating the service requires. No system is perfectly secure, but we work to protect your information with measures appropriate to the data we hold.

Your rights and choices

You can view and update your profile at any time from your account page, see your own activity under My Session History, and manage or stop alerts from the Alerts page or the link in any alert email. You may request a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account and associated data by emailing support@dosius.com. Depending on where you live, you may have additional rights under laws such as the GDPR or the California Consumer Privacy Act; we will honor valid requests in accordance with applicable law.

Children

Dosius is a professional tool and is not directed to anyone under 16. We do not knowingly collect personal information from children.

Changes to this policy

If we make material changes to this policy, we will update the date above and take reasonable steps to notify active users (for example, a notice in the app or an email). Continued use of the service after a change takes effect means you accept the updated policy.

Contact

For privacy questions or requests, send us an email at support@dosius.com and we will respond as promptly as we can.