Privacy Policy

Overview

Trouvera (trouvera.org) is operated by Trouvera. This Privacy Policy explains how we collect, use, and protect information when you use our website.

We are committed to protecting your privacy, especially given the sensitive health-related nature of the information on this site.

Information We Collect

Information You Provide

If you submit content through the Community Forum, we collect the information you voluntarily provide, which may include:

• Your name or chosen display name
• Your email address (used for follow-up only and never published or shared)
• The content of your submission

Information Collected Automatically

When you visit our website, our web server may automatically collect standard technical information, including:

• IP address
• Browser type and version
• Pages visited and time spent
• Referring website

We do not use third-party analytics services, advertising trackers, or cookies for tracking purposes. We do not use Google Analytics or similar services.

How We Use Your Information

We use the information we collect solely for the following purposes:

• To review and potentially publish your Community Forum submissions (with identifying details removed)
• To respond to your inquiries or follow up on submissions via the email you provide
• To maintain and improve the website's functionality and security

We do not sell, rent, trade, or otherwise share your personal information with any third party for marketing, advertising, or any other commercial purpose.

Health Information

Trouvera is not a healthcare provider and is not subject to HIPAA. However, we recognize the sensitive nature of health-related discussions and take the following precautions:

• We review all Community Forum submissions before publication and remove any personally identifiable health information
• We strongly discourage users from sharing personal medical details that could identify them or others
• Email addresses submitted through the forum are stored securely and never published

Healthcare Practitioner Accounts

Certain sections of Trouvera (clinical guides) are designed for healthcare practitioners and may require account registration. If you create a practitioner account, we additionally collect:

• Professional email address
• Name and credentials (e.g., MD, DO, NP, PA)
• Practice affiliation (optional)
• Hashed authentication credentials (we never store plaintext passwords)

This information is used solely to verify practitioner status and provide access to clinical-level content. Practitioner data is never shared with third parties, used for marketing, or combined with patient-facing site usage data.

HCP Data Retention & Deletion

Practitioner account data is retained for as long as the account remains active. You may request account deletion at any time by contacting us at the email address below. Upon deletion request, all personal data associated with your account will be permanently removed within 30 days. Access logs are retained in anonymized form for security audit purposes only.

Data Retention

Community Forum submissions are retained for the purpose of review and publication. You may request deletion of your submitted content by contacting us at the email address below. Published posts can be removed upon request.

Server Logs

Server access logs (including IP addresses and page views) are automatically rotated and deleted after 90 days. Logs are stored on our secured server and are not shared with any third party. Anonymized, aggregate analytics may be retained indefinitely for site improvement purposes.

Data Security

We implement reasonable technical and organizational measures to protect the information we collect against unauthorized access, alteration, disclosure, or destruction:

• All connections to Trouvera are encrypted via TLS (HTTPS)
• Authentication credentials are salted and hashed using industry-standard algorithms
• Sensitive configuration and credential files are access-restricted at the operating system level
• Server access is limited to key-based SSH authentication with password login disabled
• Automated intrusion detection (fail2ban) and rate limiting are active on all endpoints

However, no method of internet transmission or electronic storage is 100% secure.

Breach Notification

In the unlikely event of a data breach affecting your personal information, we will notify affected users via their registered email address within 72 hours of discovering the breach. The notification will describe the nature of the breach, the data potentially affected, and the steps we are taking to address it.

Your Rights Under GDPR and CCPA

Depending on your location, you may have additional rights regarding your personal data:

European Economic Area (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the right to:

• Access your personal data and receive a copy of the information we hold about you
• Rectification of inaccurate or incomplete personal data
• Erasure (“right to be forgotten”) of your personal data, subject to legal retention requirements
• Restriction of processing in certain circumstances
• Data portability — receive your data in a structured, commonly used format
• Object to processing based on our legitimate interests

Our lawful basis for processing personal data is legitimate interest (maintaining and improving the website) and consent (forum submissions, account registration). To exercise any of these rights, contact us at the email address below. We will respond within 30 days.

California (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and sell
• Delete personal information we have collected from you
• Opt out of the sale or sharing of your personal information (note: we do not sell or share personal information for cross-context behavioral advertising)
• Non-discrimination for exercising your privacy rights

To exercise these rights, email us at the address below or submit a request through our website. We will verify your identity and respond within 45 days.

Cookies & Tracking Technologies

Trouvera does not use cookies for tracking, analytics, or advertising purposes. We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts.

Our website may use minimal, strictly necessary cookies for basic functionality (e.g., remembering session state for the clinical login). These cookies:

• Do not track you across websites
• Do not contain personal information
• Are not shared with any third party
• Expire when you close your browser or within 24 hours

Because we do not use tracking cookies, we do not display a cookie consent banner. You can configure your browser to block all cookies from this site without affecting your ability to read our guides.

Children's Privacy

Trouvera is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has submitted information to us, please contact us and we will delete it promptly.

Third-Party Links

Our guides may contain links to external websites, including government agencies (NIH, FDA, ClinicalTrials.gov), medical institutions, and research organizations. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any external site you visit.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the website after any changes constitutes acceptance of the updated policy.

Contact

For questions about this Privacy Policy or to request deletion of your data, please contact:

Trouvera
Email: customerservice@trouvera.health