01Who we are
Library Medicine® (“we”, “us”) provides an online platform for designing data-collection forms, collecting research data online or offline, and analysing it, together with companion apps for Windows, macOS and Android and free calculators for researchers. This policy covers the website at librarymedicine.online, the apps and any related emails.
If you have a question about this policy or about your data, contact us at info@librarymedicine.online.
02Our two roles
We handle two different kinds of information, and our responsibility differs for each:
Account and usage data (we are the controller). Information about the people who sign up and use Library Medicine®: your name, email, sign-in details, plan and how you use the service. We decide why and how this is processed, and this policy explains it.
Research data (the project owner is the controller; we are the processor). Everything entered into a project’s forms, including information about study participants. The research team that owns the project decides what to collect, the legal basis and who may see it. We store and process it only to provide the service to them, under their instructions.
03What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored only as a secure hash), profile details, chosen plan | You, when you register or update your profile |
| Sign-in with Google or ORCID | Name, email address and the account identifier returned by that provider | The provider, only when you choose to use it |
| Security | Two-factor settings, sign-in times, IP address, browser and device type, connected desktop devices, API tokens | Generated when you use the service |
| Research data | Form answers, uploaded files, GPS points, consent records and calculated values | Research teams and the participants or data collectors they invite |
| Activity & audit | Records of views, edits, exports and settings changes inside projects | Generated automatically for accountability |
| Payments | Plan, amount, currency, payment status and transaction reference | You and our payment provider; we never see or store full card numbers |
| Messages | What you write to us through the contact form and our replies | You |
| Google Sheets sync | Access to the specific spreadsheets you connect, used only to send project data you choose to sync | Google, only when an authorised user connects it |
The free calculators on the website (such as the Medical Calculator and free statistical tests) run entirely in your browser: what you type into them is not sent to us.
04How we use it
- To provide the service: create and secure your account, run your projects, forms, offline sync, statistics, exports and reports.
- To keep it safe: verify email addresses, offer two-factor sign-in, detect abuse and duplicate records, and keep audit trails.
- To communicate: send verification codes, password resets, invitations, scheduled reports, plan and payment notices, and replies to your messages.
- To process payments for paid plans and keep the records accounting law requires.
- To improve and support the service using operational information such as error logs.
We do not sell personal or research data, we do not use research data to build advertising profiles, and we do not use your research data for our own purposes.
05Legal bases
Where data-protection law requires a legal basis (for example Rwanda’s Law No. 058/2021 on the protection of personal data and privacy, or the EU/UK GDPR for users there), we rely on:
- Contract: to provide the service you signed up for.
- Legitimate interests: to secure the platform, prevent fraud and improve the service, balanced against your rights.
- Legal obligation: for example keeping payment records.
- Consent: where we ask for it, such as optional sign-in providers; you can withdraw it at any time.
For research data, the research team is responsible for having a valid legal basis, ethics approval and participant consent where needed. Library Medicine® provides tools to record consent and manage data-subject requests.
06Who we share it with
We share information only as needed to run the service:
- Your research team: project data is visible to the members the project owner invites, according to their role.
- Service providers who process data for us under confidentiality obligations: hosting and backup storage, email delivery, and our payment provider (Flutterwave, including mobile-money payments).
- Services you connect: Google (sign-in and Sheets sync) or ORCID, only when you choose to use them.
- Legal requirements: when the law, a court order or the protection of someone’s safety requires it. Where allowed, we tell the affected project owner first.
- Business changes: if Library Medicine® is reorganised or acquired, data would move only under this policy or an equally protective one, and we would tell you.
07How we protect it
- All traffic is encrypted in transit with HTTPS.
- Identifying fields that a project marks as sensitive, and uploaded files, are encrypted at rest (AES-256 with message authentication).
- Passwords are stored only as strong one-way hashes; two-factor sign-in is available by authenticator app or email code.
- Role-based access means people see only what their project role allows; personal identifiers can be masked from roles that do not need them.
- An audit trail records who created, viewed, edited or exported records.
- Automatic daily backups protect against data loss.
No system is perfectly secure. If we learn of a breach affecting your data, we will notify you and the relevant authorities as the law requires.
08How long we keep it
| Data | How long |
|---|---|
| Active accounts | For as long as your account is open. |
| Unverified accounts | Deleted automatically if the email address is not confirmed within 3 days of registration. |
| Research data | As long as the project owner keeps it. Deleted projects and records go to a trash area first so they can be restored, then can be removed permanently. |
| Backups | Kept for about 7 days on a rolling basis, then overwritten. |
| Payment records | As long as tax and accounting law requires. |
| Audit trails | Kept with the project for accountability, as research regulations often require. |
09Your rights
Depending on where you live, you have rights over your personal data. Tap a right to read more.
Access
Ask what we hold about you and get a copy. Signed-in users can download their account data themselves from Account settings.
Correction
Update your profile at any time, or ask us to correct anything that is wrong.
Deletion
Ask us to delete your account and personal data. Some records may be kept where the law requires it.
Portability
Receive your data in a common, machine-readable format.
Objection & restriction
Object to processing based on legitimate interests, or ask us to limit it while a concern is checked.
Withdraw consent
Where we rely on consent, withdraw it at any time without affecting earlier processing.
Complain
Contact your data-protection authority, for example Rwanda’s National Cyber Security Authority (NCSA), if you are unhappy with how we handle your data.
Our response time
We reply within 30 days, and tell you if we need more time or more information to confirm your identity.
To use any right, contact us at info@librarymedicine.online. If your request concerns research data, we will pass it to the research team responsible and help them answer it.
10Study participants
If you answered a form shared by a research team, that team is responsible for your data in its study. Contact them first: their details are usually in the form or consent information. You can also contact us and we will forward your request.
Every form shared through Library Medicine® follows our consent policy: you are told what is collected and why, only authorised team members can see your answers, every access is recorded, and you can withdraw at any time.
11Cookies & local storage
We use only what the service needs to work. We do not use advertising or cross-site tracking cookies.
| Name or type | Purpose | Duration |
|---|---|---|
| rdp_session | Keeps you signed in and protects forms against cross-site request forgery | Session / until sign-out |
| Theme and display preferences | Remembers light or dark mode and similar choices (browser local storage) | Until you clear them |
| Offline storage | Lets forms work without a connection and syncs saved records later (service worker and browser storage) | Until synced or cleared |
| Calculator favourites | Remembers your favourite and recent calculators on this device only | Until you clear them |
12International transfers
Our servers and service providers may be located in a different country from you. When data is transferred across borders, we use providers that offer appropriate safeguards as required by applicable law, such as contractual protections.
13Children
Accounts are for adults and professionals. We do not knowingly create accounts for children. Research projects may legitimately collect information about children (for example paediatric studies); in that case the research team is responsible for parental or guardian consent and ethics approval.
14Changes to this policy
We may update this policy as the service or the law changes. The date at the top shows the latest version. If a change is significant, we will tell signed-in users by email or in the app before it takes effect.
Questions about your privacy?
Write to us at info@librarymedicine.online. We answer privacy requests within 3 days.
