Privacy policy

Who is responsible

GreenGuruAI is operated by GREENGURUAI LTD, a private company limited by shares and registered in England and Wales under company number 17361381. GREENGURUAI LTD is the data controller for centrally processed personal information.

Contact hello@greenguruai.com for privacy questions or requests.

The patient companion is intentionally local-first. GreenGuruAI does not receive the medication, appointment, supply or evidence information that remains only in your browser.

Adults aged 18 and over

GreenGuruAI is intended only for people aged 18 or over. We do not knowingly invite or collect early-access email addresses or patient-discovery situation messages from anyone under 18. The signup and situation forms require an 18+ confirmation.

If we learn that an under-18 user has submitted centrally held personal information, we will take reasonable steps to remove it. Contact hello@greenguruai.com if this needs to be reviewed.

Early-access emails

If you join early access, we send your email address to MailerLite so it can add you to the GreenGuruAI early-access group and send the welcome email, product news and patient-guide updates you explicitly requested.

The signup form uses an unticked consent box. Your address is added only after you actively tick that box and submit the form. There is no separate confirmation-email step. You can withdraw consent at any time by unsubscribing through an email or contacting us. Addresses are kept while you remain subscribed; limited suppression information may be retained so an unsubscribe request continues to be respected.

Clinic and pharmacy record-change alerts

If you choose “Get notified” on a published clinic or pharmacy record, GreenGuruAI stores the email address you provide, the type and identifier of the public record you follow, the alert status and relevant confirmation, unsubscribe and notification timestamps. We also store one-way hashes of confirmation and unsubscribe tokens, a hash of the public record state and a limited snapshot of the public fields needed to identify what changed. If you are already signed in to a GreenGuruAI Watch account and use the same email address, the alert may also be linked to that account identifier.

The alert service does not ask for or store your diagnosis, prescription, medicine, treatment history, clinic relationship or other patient health information. Following a clinic or pharmacy record does not mean you are a patient of that provider, and GreenGuruAI must not infer that relationship.

Supabase stores the alert subscription. Resend delivers the confirmation and later change-alert emails. You must confirm the request by email before the alert becomes active. These messages are requested service notifications only: requesting a record alert does not add you to MailerLite, does not create marketing consent and is not used to send newsletters or promotions.

Our intended lawful basis is our legitimate interest in securely providing the specific record-change service you requested, balanced by confirmation, data minimisation and one-click stopping of the alert. You can stop following a record through the link in a service email or contact us. An unconfirmed request expires after 24 hours and is removed during routine cleanup; active alerts are kept while you continue to follow the record; unsubscribed alert records are deleted within 30 days unless a legal, security or rights-request reason requires a documented temporary exception.

Patient-discovery situation feedback

If you use the situation-feedback form on our Rights & Responsibilities page, we collect the situation description you choose to submit, together with limited delivery and security information needed to operate and protect the form. Please do not include medical records, prescription numbers, medicine names, diagnoses or other identifying health information.

Your situation description is processed by GreenGuruAI’s Vercel-hosted server and Resend and delivered to the monitored GreenGuruAI inbox at hello@greenguruai.com. It is not stored in our application database or browser storage and is not sent to analytics, MailerLite, GitHub or public documents. Resend stores the message content while it delivers it and retains it for up to 30 days, after which it is deleted from Resend’s systems. Our hosting and mailbox providers may retain limited operational records under their applicable service terms. Access to the delivered message is limited to the authorised inbox owner and designated backup owner.

We delete situation messages as soon as review is complete and no later than 90 days after receipt, unless a specific legal obligation, active rights request, complaint or security investigation requires a longer period. Any exception is documented with a reason, owner and revised deletion date.

Providing an email address is optional and separate from submitting a situation. If you enter an email address and consent to updates, only that address is sent to MailerLite under the email-updates process described above. It is not included in the situation message.

It is not monitored for urgent help and cannot provide individual medical or legal advice. Despite that warning, free text may still contain personal information supplied by the sender, so access is limited as described above and messages must not be copied into analytics, tickets or public materials.

Patient companion and encrypted browser storage

The patient companion stores medication entries, evidence-checklist choices and prescription-supply totals in an encrypted vault in the current browser on this device. The vault is protected by the PIN you set, and its unlocked encryption key is kept in browser memory only while the vault is open. Installation preferences, feedback-prompt timing and first/last visit timestamps remain separate browser preferences.

This information is not uploaded to GreenGuruAI and is not a secure cross-device medical record. Encryption protects the patient-vault records while the vault is locked, but it cannot protect information while the vault is unlocked or from a compromised device, browser, extension or malicious page code. Anyone who knows the vault PIN or can access the same unlocked browser profile may be able to view it.

You can export a decrypted JSON backup, restore an eligible backup, or delete all patient-app data using the controls in the app. Clearing browser data may also remove the encrypted vault. GreenGuruAI cannot recover the PIN, decrypt the vault remotely or restore deleted local records.

Downloaded JSON backups and printed or saved summaries are not protected by the browser vault. They are controlled by you and may be copied into downloads folders, cloud backups, printer queues or shared locations outside GreenGuruAI’s control.

Treatment administration planner

The private treatment administration planner stores up to twelve fixed task categories, review dates and completed/open states in local browser storage on the current device. It does not ask for a medicine, condition, dose, clinic or pharmacy name, address, contact detail or free-text health note.

Planner task actions, dates and completion states are not sent to GreenGuruAI analytics or another organisation. The planner does not send notifications, emails or messages. You can delete individual tasks, completed tasks or the full plan from the planner page.

The planner record is separate from Patient Companion and pharmacy-tracker backups and deletion controls. Copying or printing the plan creates a new copy controlled by you and your device.

Pharmacy handoff tracker

The private pharmacy handoff tracker stores a current administrative stage, a fixed issue category, stage timestamps and up to six archived handoffs in local browser storage on the current device. It does not ask for medicine names, symptoms, doses, clinic or pharmacy names, addresses, payment details or free-text notes, and tracker actions are not sent to analytics.

You can delete the current handoff or clear the archive using the controls on the tracker page. Its records are separate from the Patient Companion export and backup tools. Clearing browser storage may remove them, and GreenGuruAI cannot retrieve or restore them remotely.

Copying a timeline, printing it or saving it as a PDF creates a new copy controlled by you and your device. Review the timeline before sharing it with a clinic, pharmacy, courier or another person.

Clinic and pharmacy comparison workspace

The private service comparison workspace stores up to three service labels, a clinic-or-pharmacy type, fixed comparison statuses, quoted or published cost figures and update timestamps in local browser storage on the current device. It does not ask for patient names, diagnoses, medicines, symptoms, doses, addresses, payment-card details or free-text clinical notes.

Workspace interactions are not sent as custom analytics events. You can remove an option or clear the complete comparison using the controls on the page. The workspace is separate from the Patient Companion, administration-planner and pharmacy-tracker records, and GreenGuruAI cannot retrieve, verify, rank or restore the locally stored comparison.

Printing or saving the workspace as a PDF creates a copy controlled by you and your device. Service names and costs may still be commercially sensitive to you, so review the document before storing or sharing it.

Other patient tools

Information entered into browser-only planning tools such as appointment preparation remains in the current browser session or local browser storage only where the tool clearly says so. It is not sent to GreenGuruAI or included in analytics. Printing, downloading or saving is handled by your browser and chosen device or destination.

Analytics and product feedback

We use Vercel Web Analytics to understand aggregated page visits and broad feature use. It does not use third-party advertising cookies and is configured so URLs are reduced to their route without query strings before collection. Admin and professional-review routes are excluded.

We also use Google Analytics 4 on public pages only when you actively accept the Analytics category in the CookieYes consent banner. The Google tag is not loaded before that analytics consent is granted. If you reject or later withdraw Analytics consent, GreenGuruAI disables GA4 collection. Advertising storage, advertising user-data use, advertising personalisation and Google Signals are disabled in our GA4 implementation.

Metricool web analytics is also loaded only after you accept the Analytics category. Metricool’s current visit-tracker documentation states that its tracker does not use cookies or assign unique visitor identifiers; the JavaScript makes an asynchronous request to Metricool, and the viewed page and country are derived from the request, including the IP address used for country detection.

For GA4, page locations are reduced to the site origin and route without query strings, same-site referrers are reduced to route level, and external referrers are reduced to their origin before events are sent. Automatic GA4 page-view collection is disabled so GreenGuruAI can use the same filtered event path for page views and product events.

Analytics may include a page route, reduced referrer, approximate location, device type, operating system and browser. We also record fixed, non-clinical product events such as whether a signup succeeded, whether the patient app was opened, whether a first general action category was completed, a broad returning-user time bucket, and structured helpful/not-helpful feedback categories.

We do not put email addresses, medication amounts, product names, prescription text, patient notes, planner dates, task states, service-comparison entries, situation descriptions, timestamps or free-text health information into analytics events. Event names and properties are restricted to a bounded allowlist. Our intended lawful basis for consent-gated GA4 and Metricool processing is consent. Where minimal Vercel analytics processing is personal data, our intended lawful basis is our legitimate interest in operating, securing and improving the service with minimal privacy impact.

You can change or withdraw Analytics consent through the CookieYes consent preferences. Detailed patient-discovery messages use the dedicated inbox flow described above rather than analytics. Other detailed feedback may be offered through an email link. Do not include medical or prescription information unless it is genuinely necessary for your message. Read Vercel’s Web Analytics privacy information, Google’s privacy information and Metricool’s privacy information.

Processors, sharing and international processing

MailerLite processes early-access email addresses. Supabase stores requested clinic/pharmacy record-alert subscriptions and associated service metadata, and may store account information where an account feature is enabled. Resend processes record-alert service emails and patient-discovery situation messages for delivery. Vercel hosts the website and provides web analytics and runtime request handling. Google processes GA4 analytics data only when the visitor has accepted the Analytics category. Metricool processes consented web-visit analytics for public pages. GitHub supports source control and deployment workflows. These providers may use approved subprocessors and may process operational information outside the UK under their applicable contractual and transfer safeguards.

We do not sell identifiable patient information, use patient-entered health information for advertising, or share local Patient Companion, administration-planner, pharmacy-tracker or service-comparison records with clinics, pharmacies, employers, insurers or other organisations. A request to follow a provider record is not shared with that clinic or pharmacy. We maintain a processor register and review access, contracts, retention and transfer arrangements as the service changes.

Security and retention

We use HTTPS, restricted administration routes, defensive browser security headers, non-cacheable admin and API responses, service-worker exclusions, secret stores, limited access and tested release controls. Patient Companion medication, evidence and supply records use versioned AES-GCM encryption at rest in the browser vault while it is locked. Record-alert confirmation and unsubscribe tokens are stored as one-way hashes rather than reusable plaintext tokens. No online or local security control can promise absolute protection.

Operational logs and support, security or patient-discovery correspondence are retained only as long as reasonably needed for service operation, investigation, legal obligations and documented accountability purposes. Record-alert retention follows the periods described in the record-change-alert section above. Patient-discovery situation messages are deleted from the recipient mailbox as soon as review is complete and no later than 90 days after receipt, under the documented correspondence-retention process and the exception handling described in the patient-discovery situation feedback section above. Local patient information remains on the device until you delete it or the browser removes it; GreenGuruAI cannot retrieve or restore it.

Your data-protection rights

For centrally held personal information, you may ask for access, correction, deletion, restriction, portability where applicable, or object to processing. You may withdraw marketing consent at any time. You can separately stop a clinic or pharmacy record alert through the service email without changing any marketing preference. Some rights depend on the circumstances and applicable law.

Because local Patient Companion, administration-planner, pharmacy-tracker and service-comparison information is not received by GreenGuruAI, we cannot search for, access or delete it remotely. Use the relevant tool controls or browser settings on the relevant device.

Contact hello@greenguruai.com. You also have the right to raise a concern with the UK Information Commissioner’s Office at ico.org.uk.

Data-protection complaints

If you believe GreenGuruAI has handled your personal information incorrectly, you can make a data-protection complaint by emailing hello@greenguruai.com. You can also raise a complaint through another reasonable contact route you use to reach us.

We will acknowledge a data-protection complaint within 30 days of receiving it. We will begin appropriate enquiries without undue delay, keep you appropriately informed about progress where needed, and tell you the outcome without undue delay when our investigation is complete.

Please describe the privacy issue and provide only the information reasonably needed for us to identify and investigate it. Do not send medical records, prescription details, medicine names, diagnoses or other sensitive health information unless it is genuinely necessary to the complaint.

Where we need proportionate evidence of identity or authority to protect personal information, we will explain what is needed. A complaint may be handled alongside a data-protection rights request where appropriate, but we will not deliberately delay the data-protection complaint simply to wait for unrelated issues.

If you remain dissatisfied, you may raise the matter with the UK Information Commissioner’s Office at ico.org.uk.

Legal identity and contact details

GreenGuruAI is operated by GREENGURUAI LTD, registered in England and Wales under company number 17361381.

Registered office and correspondence address: 5 Brayford Square, London, E1 0SG, United Kingdom.
Email: hello@greenguruai.com.

Changes and future features

We will update this notice when processing materially changes. Accounts, cloud synchronisation, automated reminders, document uploads, clinic sharing or AI analysis of patient information will not be introduced under this notice without a fresh privacy assessment, appropriate safeguards and updated transparency information.