Privacy policy

Section 1

Who we are

RedMontMed is an independent online medical research platform operating at redmontmed.com. We provide AI-assisted research to help patients find the most relevant physicians, surgeons, treatments, clinical trials and support groups across Canada, the USA, the UK, the European Union, the EEA and Switzerland.

Our servers are located in Switzerland, hosted by KreativMedia in ISO 27001-certified datacentres in Zurich. Swiss data protection law (nFADP) applies to all data we hold, in addition to the applicable laws of the jurisdictions we serve.

For all privacy matters, contact us at: hello@redmontmed.com

Section 2

What data we collect — and what we do not

We collect the absolute minimum necessary to deliver your access. The table below shows everything we hold and everything we do not.

Section 3

How we use your data

Your email address is used for three purposes only:

To deliver your access link. After payment, we generate a cryptographically random access token and email it to you as a magic link. This is the only email you will receive unless you contact us directly.

To respond to support enquiries. If you email us at hello@redmontmed.com we will use your email to respond.

To validate your access. When you use your access link to search, we check that your token is valid and has not expired. We do not log what you search.

We never sell, rent or share your data with third parties for marketing purposes, analytics or any commercial purpose. We never send marketing emails. We never contact you after your access expires unless you initiate contact.

Section 4

Legal basis for processing

We process your data on the following legal bases:

Contract performance — to deliver the access you have purchased. Without your email we cannot send your access link.

Legitimate interests — to maintain platform security, validate access tokens and prevent abuse.

Legal obligation — to retain payment records as required by applicable accounting and tax law.

Section 5

How long we keep your data

We keep your data for the shortest time necessary:

Email address and access token — retained while your access is active, then deleted automatically when your token expires. There is no account to close. Your access simply expires quietly and your record is removed.

Stripe payment reference — retained for seven years as required by applicable accounting and tax legislation. This is a transaction reference only — we hold no card details.

Anonymous search logs — retained for up to 24 months for the purpose of improving result quality. These logs contain no email, no IP address and no identifying information of any kind.

Support correspondence — emails sent to hello@redmontmed.com are retained for up to 24 months then deleted, unless there is an ongoing legal or support matter.

You may request deletion of your data at any time by emailing hello@redmontmed.com. We will respond within 30 days.

Section 6

Your rights

Depending on your jurisdiction, you have some or all of the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate data we hold about you.
• Deletion — request deletion of your personal data (right to be forgotten).
• Restriction — request that we restrict processing of your data in certain circumstances.
• Portability — request a copy of your data in a portable format.
• Objection — object to processing where we rely on legitimate interests as the legal basis.

To exercise any of these rights, email hello@redmontmed.com. We will respond within 30 days.

Section 7

Third-party services

We use two external services to operate the platform:

Stripe — payment processing. Stripe handles all card transactions on our behalf and has its own privacy policy at stripe.com/privacy. RedMontMed never sees, receives or stores your payment card details. Stripe may store your payment data in accordance with their own policies and applicable financial regulations.

Anthropic Claude — AI-assisted research. When you perform a search, the condition name and country you searched are sent to Anthropic's API to generate and rank results. No personal data — no email, no IP address, no identifying information of any kind — is ever sent to Anthropic. Anthropic's privacy policy is available at anthropic.com/privacy.

We use no analytics services, no advertising networks, no social media tracking pixels and no third-party cookies of any kind.

Section 8

Data security

All data is transmitted over HTTPS with TLS encryption. Our servers are located in ISO 27001-certified datacentres in Zurich, Switzerland, operated by KreativMedia. Access tokens are cryptographically random and cannot be guessed. Payment data is handled exclusively by Stripe's PCI-compliant infrastructure.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of it, in accordance with our obligations under applicable law.

Section 9

Cookies and browser storage

We use no cookies of any kind — not functional, not analytical, not marketing. No cookie banner is displayed because there is nothing to consent to.

We use no browser localStorage, sessionStorage or any other client-side storage mechanism. Your access token is held in memory during your active browser session only. It is not written to disk, not stored in your browser, and disappears when you close the tab. This means you will need your original access link email to return to the platform in a new session.

Section 10

Changes to this policy

We may update this policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page shows when it was last updated. We will notify you by email if we make any material changes that affect your rights, provided we hold your email address at the time of the change.