Privacy notice

Last updated 6 October 2026

MedAtlas is run by Physiolayer. This page says what the site collects, why, and who sees it. Questions, and requests to see, correct or delete your data, go to admin@physiolayer.com.

Searching for an asset

You do not need an account to look up a brand or generic name or to open a shared map. The name you type is sent to our servers, which pass it to openFDA (the US FDA’s open data service) to find matching label names. We do not save it in a database, but our hosting provider’s request logs can include the address requested, which contains your search term. To stop abuse, each lookup is counted against your IP address for one minute, stored only as a one-way hash that is deleted within minutes. Please do not type personal or confidential information into a search box.

Building maps (reviewers)

Maps are built by signed-in reviewers. When a map is built or refreshed, the confirmed names and terms are sent to PubMed, Europe PMC, OpenAlex and ClinicalTrials.gov as search queries. A map stores the names and terms searched, identifiers, titles, authors, dates and the links between records, and the email address of the reviewer who made each change, so the work can be traced. Abstracts are fetched from the source when someone asks to read one, shortened, and are not kept.

Sign-in

Reviewer pages are behind Cloudflare Access. To sign in, Cloudflare checks your email address and sets an essential session cookie. We receive your verified email address and use it to attribute your work.

Technical data and logs

Like any website, our hosting provider, Cloudflare, processes technical data about each request (such as IP address, browser type, the page requested and the time) to deliver the site, keep it secure and keep operational logs. These logs are kept for a limited period set by the provider.

What we do not store or do

• No full text of publications, and no copies of whole third-party records beyond what a map needs to show.
• No advertising or social-media trackers, no profiling, and no sale of personal data.
• No analytics cookies. The public pages set no cookies of their own. If we add analytics or any non-essential cookie, this notice will change first and, where the law requires it, we will ask for consent.

Who we share data with

With the infrastructure providers needed to run the site, mainly Cloudflare (hosting, storage and sign-in), and with the public sources named above when a lookup or map search is run. We do not sell personal data.

How long we keep it

Maps and reviewer work are kept for as long as the map exists or until it is deleted. Shared map links stay open until a reviewer stops sharing them. You can ask us to delete your data at any time.

Your rights

Depending on where you live, you may have the right to access, correct, delete or restrict the use of your personal data, and to complain to your data protection authority. Write to admin@physiolayer.com and we will reply.

Changes

We will update this page and its date when something changes.