Consumer Health Data Privacy Policy
Last updated: July 13, 2026
Current status: Analytics is fully live as described in this policy. The opt-in consent banner is shown on your first visit unless your browser sends a Global Privacy Control signal, in which case analytics stays off automatically. If you accept, aggregated usage data is sent to our dedicated Google Analytics 4 property, configured to match every commitment below: 14-month data retention with no reset on continued activity, Google Signals off, and account-level data sharing with Google (benchmarking, technical support, business recommendations) all turned off.
This policy exists as its own distinct page — separate from any general terms of use — because some of what this site does (helping you figure out whether your medication has a support program) can be considered "consumer health data" under state laws like Washington's My Health My Data Act (MHMDA), Nevada's consumer health data law (SB 370), and California's CCPA/CPRA. We've written this policy to meet the strictest of those standards, and we apply it to every visitor, regardless of which state you're in.
If and when analytics is enabled on this site (via Google Analytics 4), we collect aggregated, on-device usage information — not a personal profile. Examples: that a search was performed, that zero results were found for a search, that a particular drug's detail card was opened, that a filter was used, that someone clicked through to a manufacturer's support-program page, or that the print button was used.
We do not collect and will never ask you to submit: your name, date of birth, insurance ID, contact information, or any information that identifies you personally. We do not require an account or login to use this site, and we never combine a drug lookup with any other field that could identify who performed it.
Solely to understand which medications and support programs people are actually looking for, to find gaps in our database (searches that return nothing), and to see whether links to manufacturer programs are working. This is a "secondary" use beyond simply delivering your search result to you, which is why it requires your separate opt-in consent under MHMDA — not a byproduct of the site's core function.
If your browser sends the Global Privacy Control signal, we detect and honor it as an opt-out of data collection and sharing — you will not see the consent banner attempt to opt you in, and analytics will remain off automatically.
The only third party we share aggregated usage data with is Google LLC, acting as our analytics processor (Google Analytics 4). We do not sell consumer health data to anyone, for any purpose, under any circumstance. We disable Google Signals and ad personalization features in our analytics configuration — this site has no advertising use case, so there is no reason to enable them.
Analytics event data, once collection begins, will be retained for a maximum of 14 months — the shortest retention period Google Analytics 4 allows us to configure — after which it is automatically deleted from Google's systems.
We do not use your location to target advertising or content, and we will never geofence this site's content around healthcare facilities. We have no plans to add location-based features; if that ever changes, this policy will be updated first.
You can ask us, at any time, what categories of data this site collects, request that we stop sharing your data with Google, or ask questions about this policy. Email contact@findmysupportprogram.org and we'll respond directly.
If this policy changes in a material way — for example, if we ever add a new third-party processor, or begin collecting a new category of data — we will update the "Last updated" date above and summarize the change here. We do not backdate changes or apply them retroactively to data already collected under a prior version of this policy.
