Public drafts stay in the browser
Public drafting tools are designed as browser aids. Visitors can prepare and copy language without creating an account or submitting a medical record to the site.
Privacy policy
Privacy comes before patient data collection.
Pain Care Rights minimizes sensitive data by default. Public drafting tools do not require an account. A website-assistant conversation may be processed by an external response service; it does not itself create an advocacy case. A separately reviewed inquiry form collects the basic details necessary for possible owner follow-up.
Privacy guide
Why the site collects less by default.
Public drafting tools are designed to work without an account. Account access and the contact form use limited security controls, including Cloudflare Turnstile, to reduce automated abuse and preserve an investigation trail when an account is attacked or misused.
Best first route
Use private drafting tools
The tools are designed to help you draft and copy text without submitting it to the site.
Current privacy posture
The site offers public education and browser drafting tools, optional free accounts, a non-urgent contact form and a separate request for possible individual advocacy review. Only a submitted inquiry form can enter the private owner-review queue; chat alone does not submit a case or guarantee acceptance.
Account and abuse-prevention security logs
Account-code requests, account creation, successful sign-ins, rejected codes, blocked accounts, and rate-limit events can create a security record. That record may include a keyed hash of the network address, user-agent/browser family and version, operating-system and device class, language, timezone, platform and viewport supplied by the browser, referrer path, Cloudflare Ray ID/country/edge location when present, Vercel request ID, Turnstile result, and the authentication outcome. Raw IP addresses and MAC addresses are not stored. Security events are normally retained for 180 days and the configured period is limited to 30–365 days.
Contact form and Cloudflare Turnstile
The contact form sends the reply email, optional name or organization, selected reason, and message through the configured transactional email provider. Cloudflare Turnstile verifies that the submission is not automated. Limited browser and Cloudflare request details may be included with the message as an abuse reference. Do not use the contact form for medical records, prescription numbers, government identifiers, passwords, or urgent requests.
Website assistant and external processing
Messages typed into the website assistant may be sent through Vercel to an external language-model service to prepare a response. Conversations are not automatically attached to advocacy case records. The site sends only a limited recent conversation for each reply and requests that the response not be stored by the model provider, but the provider may have separate processing and retention practices. Do not put names, contact information, medical records, prescription numbers, government identifiers or private histories into chat.
Optional advocacy inquiry and owner review
If you deliberately submit the separate Request human review form, we collect the preferred name, reply email, state, issue category, short summary and submission confirmation you review. These details are encrypted within a private database and available only to the two verified Pain Care Rights owners for triage and possible follow-up. Submission creates a pending inquiry, not an accepted case, commitment to respond or scheduled callback. We do not submit the entire chat transcript automatically.
Retention, corrections and deletion requests
Advocacy inquiries and accepted working cases are kept for review and case recordkeeping; a fixed automatic purge period for this private casework is not currently configured. To inquire about your submitted information, ask for a correction or request deletion where permitted, use the Contact page. We review these requests individually and may need to retain limited records when law, security or legitimate recordkeeping requires it.
Private notification metadata
A new submitted inquiry may cause a notification in a private Discord channel containing a generated reference, event type and secure owner-dashboard link. The notification does not include the visitor's name, email address, diagnosis, message, records or other medical details. A reference link does not grant access to private information without the owner's verified account session.
If a feature collects data
Any story submission, contact form, email-list form, forum account, member account, or data-collecting advocacy tool must explain what is collected, why it is collected, how long it is kept, who can access it, and how deletion works before a visitor shares sensitive details.
Sensitive information warning
Avoid sending full medical records, Social Security numbers, account numbers, private insurance identifiers, prescription numbers, home addresses, or names of clinicians/pharmacies unless a secure process specifically requests and protects that information.
Third-party services
Vercel hosts the website and routes assistant requests to external language-model services. Cloudflare Turnstile verifies submitted forms, and the configured transactional email provider handles contact delivery and account codes. Discord receives limited, nonidentifying private alert metadata for new inquiries. Data shared with these providers is limited according to the service being used; review their respective privacy terms before submitting sensitive information.
Privacy-first path
Useful patient tools should not force people to expose more than needed.
This site should stay helpful for people who are sick, rushed, elderly, or afraid of being judged. The privacy standard is simple: collect less, explain more, and keep current drafting tools under the user’s control.
Prepare before sharing
Use the tools to organize facts on your own device, then remove sensitive details that are not needed for the recipient.
Open tools →Keep first messages narrow
Source leads, collaboration ideas, or support questions should not include full records, account numbers, prescription numbers, addresses, or urgent medical requests.
Use contact router →Paid tools need extra controls
Saved packets, accounts, email delivery, and guided help belong behind clear retention, deletion, review, and consent rules.
Review safeguards →Details that should stay out by default
More detail is not always safer. Many first drafts and first contacts work better when unnecessary identifiers are removed.
- Avoid full medical records, full addresses, birth dates, prescription numbers, account numbers, and claim numbers unless a secure process specifically needs them.
- Do not post another person’s private medical details, clinician accusations, or identifying information in a public space.
- Keep payment and supporter account data separate from health-related drafts.
- Review any downloaded or copied packet before sending it through an outside channel.