Effective July 22, 2026

Privacy policy

RecalledMeds collects only the information a person supplies or the service needs to perform a requested feature. Health-adjacent activity is separated from advertising and marketing systems.

Information used for a package check

A check may include a product name, manufacturer, NDC, barcode, lot number, expiration date or a processed package image. Anonymous check inputs are not added to a personal watchlist. Signed-in users can explicitly save a check or watchlist item.

Accounts

Accounts use an email address, display name, password handled by Supabase Auth and an adult age attestation. RecalledMeds does not request a date of birth. Saved checks, watchlists, alert settings and optional saved images are kept in private application schemas with access controls.

Images

The raw upload is decoded in memory, then discarded. The processed derivative has metadata stripped, is stored privately and is scheduled for deletion after one hour. Raw images are not sent to an external large language model. Image extraction remains unavailable until an approved OCR provider is configured.

Advertising and analytics

Advertising and behavioral analytics are disabled at launch. Any future contextual ads may appear only on anonymous educational pages and stable public recall pages. They remain prohibited on package checks, results, authenticated pages, watchlists, history, uploads, reviewer pages and admin pages. Medication details, lots, images, saved results and approximate location are never used for advertising targeting.

Service providers

Supabase provides database, authentication and private storage. Vercel hosts the application. Resend provides transactional email. GoHighLevel is disabled until separately configured; if enabled, it is limited to general business, recruiting and support workflows and never receives medication, lot, image, watchlist or personalized result data.

Retention and deletion

Source evidence and public recall provenance are retained as public-interest records. User-owned data can be exported or deleted through account controls. Security and audit records are retained only as needed for abuse prevention, legal compliance and incident investigation, with actor attribution removed when permitted.

Contact

Privacy requests can be sent to privacy@recalledmeds.net. The production support channel will verify account ownership before releasing or deleting private account data.