Privacy policy

Last updated 2026-09-28

Who is responsible

Prognyx is operated as a sole practice by Rali Filali (see About). Prognyx is not currently an incorporated company. For any privacy question, request or complaint, write to hello@prognyx.com, it reaches the person responsible directly. A postal address is available on request.

What is collected

1. What you type into a form

The sample-brief form collects your name, company, work email, and optionally an asset, target or indication and a message. The download form on the sample-brief page collects an email address only. Both include a hidden field that only automated bots fill in; if it is filled, the submission is discarded.

Purpose: to reply to you and to send the brief you asked for. Nothing else: a contact request never puts you on a list. The newsletter is a separate signup, described next.
Legal basis: your request (GDPR Art. 6(1)(b), steps taken at your request prior to a contract).
Retention: enquiries are kept while the conversation is live and for up to 24 months afterwards, so a later reply still has its context.

2. The Watchtower by email (newsletter)

If you subscribe to the newsletter, Prognyx stores your email address, the language you chose, the page you subscribed from and the channel that brought you there, the country your request came from (read from the edge network's header, never your IP address), and the timestamps of your request, your confirmation and, later, your unsubscription.

Subscription is double opt-in: nothing is sent to an address until the person who controls it clicks the confirmation link, and an unconfirmed address receives that one email at most. Every newsletter email carries a one-click unsubscribe link, and the major inbox providers expose it as their own button.

No open or click tracking. The links in the emails are plain links to prognyx.com. There is no tracking pixel, so Prognyx cannot tell whether you opened an email, and it does not know which links you followed.

Purpose: to send you each briefing the day it publishes. Nothing else.
Legal basis: your consent (GDPR Art. 6(1)(a)), given by the confirmation click and withdrawable at any time through the unsubscribe link.
Retention: while you are subscribed. When you unsubscribe, the address is kept marked as unsubscribed so that nothing further can reach it; ask at the address above and it is deleted outright.

3. Anonymous audience measurement

Prognyx uses PostHog, hosted in the European Union, to count how pages and briefings are actually used, which pages get read to the end, which call-to-action gets clicked, whether a form is started and finished.

Since 6 September 2026 the measurement also keeps a random anonymous identifier in your browser's local storage (no cookie, never linked to a name or an email address, never shared) so that a return visit is recognised as such, and it records how a page is used, scrolling, clicks and hesitations, with every form field masked, so we can see where readers stop or hesitate. This is what tells us whether a briefing is read to the end and whether people come back. Turn on Do Not Track in your browser and nothing at all is measured.

The analytics configuration uses local storage, not cookies. Returning visits can be recognised through that random identifier. Form inputs are masked in session replay and query strings are stripped from recorded page URLs. Enable your browser's Do Not Track setting to prevent the analytics script from loading, or use the analytics opt-out link. Clearing this site's browser storage removes the locally stored identifier and visit history.

One declared exception: briefing links in emails Prognyx sends to named professionals may carry a short reference code in the link. It tells Prognyx that this specific email brought its reader to the page. Analytics only ever sees the opaque code; the list matching codes to recipients stays on Prognyx's own systems and is never shared. The code is removed from the address bar on arrival, so a copied or forwarded link does not carry it.

Purpose: to know whether the site works. Before this existed there was no way to tell.
Legal basis: legitimate interest in strictly anonymous first-party audience measurement (Art. 6(1)(f)). For the email reference code: legitimate interest in measuring Prognyx's own professional outreach (Art. 6(1)(f)), you can object at any time via the contact address on this page.
Retention: aggregated event data, per PostHog's default retention.

MCP server

The Prognyx MCP server (/mcp) takes public research terms from your AI client and sends them to ClinicalTrials.gov, or searches the published briefing index. It sends nothing to a language model of ours, sets no identifier and has no account. The tool name and the terms may appear with a timestamp in hosting function logs, to identify topics to cover; the IP address is held only in memory, briefly, to limit abuse, and our code does not write it to those logs; the host keeps its own technical logs. Your AI client and its provider process your conversation under their own terms.

Live landscape searches

On Live Landscape, PostHog, visitor identifiers and session replay are disabled. Public search terms are sent to ClinicalTrials.gov. For the AI reading, the search term and selected public registry records are also sent to Google Gemini through Antigravity; no email address or IP address is included in that model request. Use public terms only, never personal, patient-level or confidential information. A private Supabase queue and cache retain queries, processing status and readings for up to eight days; local evidence logs have the same retention. Antigravity maintains its own execution history under its settings. Readings are reused within the UTC day. To control abuse, a daily keyed hash of your IP address reserves limited generation slots in this private storage; raw IP addresses are not stored there. Do Not Track disables demand analytics, not the processing necessary to return your requested reading. Unless Do Not Track is enabled, search text and timestamp may also appear in hosting function logs to identify topics to cover. The page also logs only named steps of the free journey and their timestamps (such as search, result, source click or contact click), without search text or a visitor identifier in these step logs. Hosting technical logs have their own retention. Google processing is subject to the applicable Antigravity account terms and data settings; do not submit confidential research.

4. Server logs

The site is hosted on Vercel, which records standard technical request logs (IP address, timestamp, requested URL, user agent) for security and to keep the service running. These are Vercel's operational logs, retained on their schedule, and Prognyx does not use them to build profiles.

What is not collected

• Cookieless analytics. The local-storage identifier and session replay used on analytics-enabled pages are described above.
• No advertising or social trackers. No Meta pixel, no Google Ads tag, no LinkedIn Insight tag.
• No third-party fonts. Typefaces are served from this domain, so loading a page sends nothing to Google Fonts.
• Form inputs are masked in session replay. Session recording and heatmaps are enabled on analytics-enabled pages; they are disabled on Live Landscape. The MCP endpoint serves data and does not run browser analytics.
• No special-category data. Prognyx analyses public information about companies and drug programmes. It never asks for, and must never be sent, patient-level or health data about identifiable individuals.

Who else processes your data

Where a processor is US-based, transfers rely on the standard contractual clauses and equivalent safeguards in that provider's data-processing terms. Prognyx does not sell, rent or trade personal data, and has no affiliate or data-broker relationships.

Your rights

If you are in the EU, EEA or UK you have the right to access, correct, delete, restrict, port and object to the processing of your personal data, and to withdraw consent at any time. Similar rights exist in many other jurisdictions and Prognyx applies them to everyone regardless of where you are.

To exercise any of them, email hello@prognyx.com. No form to fill in, no identity-verification hoop beyond confirming you control the address in question. You will get a reply within 30 days and normally within a few days. If you are unsatisfied, you may complain to your national data-protection authority.

Leaving the newsletter takes one click, the link at the bottom of every email, effective immediately. If you have written to Prognyx, or subscribed, and want your address deleted rather than marked, ask at the address above and it is deleted, not merely flagged.

Security

The site is served over HTTPS with HSTS. Form submissions travel over TLS to an inbox protected by a strong unique credential and two-factor authentication. Prognyx is a sole practice, so the practical control that matters most is scope: beyond an email inbox it holds one small dataset, the newsletter list (a few fields per address, hosted in the EU, readable only with a server-side key that never reaches a browser), and it does not ask clients for confidential unpublished data as a matter of course.

Children

Prognyx is a business-to-business service for pharmaceutical and biotechnology professionals. It is not directed at anyone under 16 and does not knowingly collect their data.

Changes

Material changes will be reflected in the "last updated" date above, and anything that changes what is collected or why will be described here rather than quietly amended.

This policy describes the actual behaviour of this website as of the date above. It is a plain-language notice, not legal advice.