Privacy Policy
Pouchy.org is an educational website. We collect as little information as practical, never sell data, and use no third-party tracking or advertising. This page explains exactly what happens to any data you share with us.
What we collect
Contact form
When you submit the contact form, we collect: your name, email address, the reason for contact you select, and your message. This data is stored in a Cloudflare D1 database accessible only to site administrators.
Ask AI feature
When you type a question into the Ask AI feature, your question is transmitted to our server for processing and returned as an answer. Queries may be retained in aggregate, stripped of identifiers, for service-quality review. We do not tie queries to your identity.
Server logs
Cloudflare, our hosting provider, maintains standard HTTP access logs (IP address, user agent, timestamp, URL) for security and diagnostic purposes. See Cloudflare’s privacy policy. We do not analyze or export these logs.
What we do NOT collect
- No account creation is required, we don’t ask for usernames, passwords, or any credentials
- No third-party analytics (no Google Analytics, Facebook Pixel, Hotjar, etc.)
- No advertising trackers
- No tracking cookies. The site uses no cookies that require consent banners
- No medical or health information beyond what you voluntarily type into a question or message
How we use your data
- Contact form submissions are used solely to respond to your inquiry.
- AI queries are used to generate the answer you see and, in aggregate and de-identified form, to improve the service.
- We never sell, rent, or trade your data.
- We never share data with third parties other than Cloudflare (hosting).
Data retention
- Contact form messages: retained until you request deletion, or for up to 2 years, whichever is shorter
- AI query logs: stripped of identifiers after 30 days
- Cloudflare access logs: retained per Cloudflare’s policy (typically 7 days)
Your rights under GDPR (EU/EEA users)
If you are a resident of the European Union or European Economic Area, the General Data Protection Regulation (GDPR) grants you the following rights:
- Right to access, request a copy of the personal data we hold about you
- Right to rectification, request correction of inaccurate or incomplete data
- Right to erasure (“right to be forgotten”), request deletion of your data
- Right to restrict processing, request we pause processing
- Right to data portability, request an exportable copy
- Right to object, object to processing based on legitimate interest
- Right to withdraw consent, withdraw previously-given consent at any time, as easily as you gave it
- Right to lodge a complaint, with a supervisory authority in your EU member state
To exercise any of these rights, email webmaster@pouchy.org with subject line “GDPR Request”. We’ll respond within 30 days.
Legal basis for processing
- Consent, for any future AI query data use (when Ask AI launches); for contact form submissions
- Legitimate interest, for anonymous usage analytics via Cloudflare Web Analytics; for site security
Data controller
The data controller for Pouchy.org is Stefan D. Holubar, MD, MS, acting as an individual on behalf of the iPouch Consortium educational initiative. Contact: webmaster@pouchy.org.
International data transfers
Our servers are located in the United States (Cloudflare). If you access this site from the EU/EEA, your data will be transferred to the US. Cloudflare participates in the EU-US Data Privacy Framework and provides GDPR-aligned Standard Contractual Clauses as the transfer safeguard.
Cookies & client-side storage
Pouchy.org does not currently use tracking, advertising, or third-party analytics cookies. Cloudflare Web Analytics is cookieless. The site uses a sessionStorage item to remember whether you have acknowledged the disclaimer and a localStorage patient-education accept flag. Neither is shared with third parties and both can be cleared via your browser settings.
Future: When the Ask AI feature launches, an authentication cookie may be used if accounts are offered. Any such change will be disclosed here and in a prominent notice on the site.
Data breach notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk, we will also notify affected users directly via the email address on file.
Request data deletion / withdrawal of consent
You may withdraw consent or request deletion of any personal data we hold at any time.
We will confirm receipt within 7 days and complete deletion within 30 days, per GDPR Article 17.
Children’s privacy
This site is intended for adults seeking information about J-pouch surgery. We do not knowingly collect data from children under 16. If you believe we have inadvertently done so, please contact us and we will delete it.
Jurisdiction
Pouchy.org is operated from the United States. By using this site you consent to your data being processed in the U.S. Content is based on U.S. medical standards and may not apply in your jurisdiction.
Changes to this policy
If we change how we handle data, we will update this page and the “Last updated” date at the top. Material changes will be noted on the site’s front page for at least 30 days.
Contact
Questions about this privacy policy: webmaster@pouchy.org