The fine print

Claims are tied to peer-reviewed sources indexed in PubMed (citation metadata courtesy of the U.S. National Library of Medicine, which does not endorse this site). Despite that grounding, NephTox is maintained by a small team and may contain errors. Content is provided “as is,” without warranty of any kind, express or implied, including accuracy, completeness, or fitness for a particular purpose. If you spot an error, please use the Flag an error button on a drug page or the feedback form.

Most of NephTox works without telling us anything. If you just read the atlas, we collect no personal information from you.

• Aggregate usage analytics. Two complementary counters, neither of which builds an individual browsing profile. Vercel Web Analytics counts page views, referrers and a few named interactions (a figure opened, a filter applied), with no personal properties; it is cookieless and does not identify you. We also count visits ourselves: each page view, and each named interaction we count, records the page path, the referring site, a coarse browser, operating-system and device family, a country code, and whether you were signed in, tied to an anonymous identifier re-derived every day from a rotating key held only on our server — so the stored records cannot link yesterday’s visits to today’s. Raw IP addresses and full browser details are never stored, and these records are deleted after 90 days. If you explicitly allow analytics cookies (see Cookies & local storage), a random identifier additionally lets us count your return visits accurately; declining never reduces what the site does. We do not use third-party advertising trackers, and we don’t sell data.
• Newsletter: if you subscribe, we store the email address you provide so we can send occasional updates. Every email includes an unsubscribe link.
• Feedback & error reports: the message you send, and an email address only if you choose to provide one for a reply. Don’t include personal health information.
• Accounts (optional): if you create an account we store your name, email, and password credentials (handled by our authentication library — we never see or store your plaintext password after signup). The “about you” fields — role, career stage, country, institution, primary interest, and how you heard about us — are optional, and we record when you accepted the terms.
• Saved content: signed in, you can star agents to a watchlist, and save regimen checks or teaching cases. These store only your account email plus catalog drug IDs, fixed-vocabulary findings, and a short label — the schemas are deliberately designed with no fields for patient identifiers, and labels are validated to reject anything that looks like a name, date, or record number.

Never enter patient information. NephTox is not a system of record and must not hold protected health information (PHI). The interactive tools tell you the same thing in place.

The site runs on infrastructure that processes data on our behalf: Vercel (hosting and the aggregate analytics above), Supabase (database, image storage, and the first-party usage counts above), and Resend (transactional email — verification, digests, feedback notifications). Queries you type into the research tools (Scout) are relayed server-side to PubMed/NCBI, openFDA, and ClinicalTrials.gov to fetch evidence, and — for the graded cross-organ verdict — to Anthropic’s API. Your free-text queries are not stored by us and are redacted from our error logs; enter drug, organ, or trial identifiers only. Each provider processes data under its own terms.

Reading the atlas sets no cookies unless you sign in or answer the consent banner. Answering it stores only your answer, whichever it is; the identifier cookies below exist only after you choose “Allow”. Your theme choice and dismissed banners are remembered in your own browser’s local storage and never leave your device. There are no advertising or cross-site tracking cookies.

Decline — or simply ignore the banner — and only the anonymous daily counting described above happens. If your browser sends Global Privacy Control or Do Not Track, we treat that as a decline automatically, never ask, and set no cookie: the anonymous daily count still happens, exactly as for a decline. You can change your answer below at any time, or clear these cookies in your browser; the banner then asks again on your next visit. Left alone, your answer expires after 12 months and the question returns then.

You can read the entire site without an account. Unsubscribe from any email via its footer link. If you have an account, you can delete it — along with your profile, watchlist, saved regimens, and teaching cases — directly from your account page, effective immediately. To access, correct, or delete anything else you submitted (a feedback record, or a newsletter subscription made without an account), contact us through the feedback form and we will act on reasonable requests.

This page may be updated as the site evolves. Material changes will be reflected here. Continued use of NephTox indicates acceptance of the current version. Last updated: August 30, 2026.