Privacy Policy

Plain English summary

We collect only what we need to provide Migrennity. We never sell data. We use Clerk for authentication and Neon for database infrastructure (HIPAA-ready with a BAA enabled). You control what you share and can delete your account.

Controller

This policy applies to Migraine Club and the Migrennity PWA.

Data we collect

Account data

Email, profile details, and authentication identifiers.

Health and diary data (special category)

Migraine attacks, headache-free days, symptoms, meds, questionnaires, and notes you enter. We process this with your explicit consent.

Technical data

Device, browser, IP, and diagnostic logs to keep the service secure and reliable.

Community data

Posts, comments, and interactions you choose to share.

Legal bases

• Contract: to provide the service you request.
• Consent: for special category health data and optional features.
• Legitimate interests: to secure and improve the service.

You can withdraw consent at any time in settings.

Processors

We use vetted providers to run Migrennity:

• Database infrastructure via Neon (HIPAA-ready, BAA enabled). Neon HIPAA docs
• Authentication via Clerk (SOC 2 Type II, HIPAA support). Clerk security
• Analytics: [ANALYTICS PROVIDER], only if enabled.
• Error tracking: [ERROR TRACKING PROVIDER], only if enabled.

We never sell data and never share it for advertising.

HIPAA-ready infrastructure

We enabled Neon HIPAA compliance support and accepted a Business Associate Agreement (BAA) to support HIPAA-ready infrastructure. Neon HIPAA overview.

HIPAA readiness is a shared responsibility. Do not place PHI in logs or metadata.

Security measures

• Encryption in transit (TLS) and at rest where supported.
• Access controls and least-privilege policies.
• Audit logs and monitoring where applicable.
• Regular security updates and incident response procedures.

Data retention

• Account and diary data retained until you delete your account.
• Logs retained for a limited period for security and debugging.
• Backups retained for disaster recovery, then purged.

Your rights

Depending on your location (including GDPR), you may have the following rights:

• Access and receive a copy of your data.
• Correct inaccurate or incomplete data.
• Delete your data and close your account.
• Restrict or object to processing.
• Data portability.
• Withdraw consent for health data.
• Lodge a complaint with a supervisory authority.

To exercise your rights, contact support or use in-app controls.

International transfers

Your data may be processed outside your country. We use contractual safeguards where required.

Contact

Questions about privacy? Contact us at [email protected]