Privacy policy

Last updated 2026-09-05

Who is responsible

Prognyx is operated as a sole practice by Rali Filali (see About). Prognyx is not currently an incorporated company. For any privacy question, request or complaint, write to hello@prognyx.com — it reaches the person responsible directly. A postal address is available on request.

What is collected

1. What you type into a form

The sample-brief form collects your name, company, work email, and optionally an asset, target or indication and a message. The download form on the sample-brief page collects an email address only. Both include a hidden field that only automated bots fill in; if it is filled, the submission is discarded.

Purpose: to reply to you and to send the brief you asked for. Nothing else: a contact request never puts you on a list. The newsletter is a separate signup, described next.
Legal basis: your request (GDPR Art. 6(1)(b), steps taken at your request prior to a contract).
Retention: enquiries are kept while the conversation is live and for up to 24 months afterwards, so a later reply still has its context.

2. The Watchtower by email (newsletter)

If you subscribe to the newsletter, Prognyx stores your email address, the language you chose, the page you subscribed from and the channel that brought you there, the country your request came from (read from the edge network's header, never your IP address), and the timestamps of your request, your confirmation and, later, your unsubscription.

Subscription is double opt-in: nothing is sent to an address until the person who controls it clicks the confirmation link, and an unconfirmed address receives that one email at most. Every newsletter email carries a one-click unsubscribe link, and the major inbox providers expose it as their own button.

No open or click tracking. The links in the emails are plain links to prognyx.com. There is no tracking pixel, so Prognyx cannot tell whether you opened an email, and it does not know which links you followed.

Purpose: to send you each briefing the day it publishes. Nothing else.
Legal basis: your consent (GDPR Art. 6(1)(a)), given by the confirmation click and withdrawable at any time through the unsubscribe link.
Retention: while you are subscribed. When you unsubscribe, the address is kept marked as unsubscribed so that nothing further can reach it; ask at the address above and it is deleted outright.

3. Anonymous audience measurement

Prognyx uses PostHog, hosted in the European Union, to count how pages and briefings are actually used — which pages get read to the end, which call-to-action gets clicked, whether a form is started and finished.

Since 6 September 2026 the measurement also keeps a random anonymous identifier in your browser's local storage (no cookie, never linked to a name or an email address, never shared) so that a return visit is recognised as such, and it records how a page is used, scrolling, clicks and hesitations, with every form field masked, so we can see where readers stop or hesitate. This is what tells us whether a briefing is read to the end and whether people come back. Turn on Do Not Track in your browser and nothing at all is measured.

It is configured to be cookieless: the visitor identifier lives in memory for the duration of the page only, and nothing is written to your browser storage. A returning visitor is not recognised. Nothing you type into a form is sent to analytics, and URLs are stripped of query strings before being recorded. If your browser sends a Do Not Track signal, analytics does not load at all.

One declared exception: briefing links in emails Prognyx sends to named professionals may carry a short reference code in the link. It tells Prognyx that this specific email brought its reader to the page. Analytics only ever sees the opaque code; the list matching codes to recipients stays on Prognyx's own systems and is never shared. The code is removed from the address bar on arrival, so a copied or forwarded link does not carry it.

Purpose: to know whether the site works. Before this existed there was no way to tell.
Legal basis: legitimate interest in strictly anonymous first-party audience measurement (Art. 6(1)(f)). Because no identifier is stored on your device, this does not require consent under the ePrivacy Directive. For the email reference code: legitimate interest in measuring Prognyx's own professional outreach (Art. 6(1)(f)) — you can object at any time via the contact address on this page.
Retention: aggregated event data, per PostHog's default retention.

4. Server logs

The site is hosted on Vercel, which records standard technical request logs (IP address, timestamp, requested URL, user agent) for security and to keep the service running. These are Vercel's operational logs, retained on their schedule, and Prognyx does not use them to build profiles.

What is not collected

• No cookies of any kind, first- or third-party — which is why there is no consent banner to dismiss.
• No advertising or social trackers. No Meta pixel, no Google Ads tag, no LinkedIn Insight tag.
• No third-party fonts. Typefaces are served from this domain, so loading a page sends nothing to Google Fonts.
• No session recording, no heatmaps, no keystroke capture. Explicitly disabled.
• No special-category data. Prognyx analyses public information about companies and drug programmes. It never asks for, and must never be sent, patient-level or health data about identifiable individuals.

Who else processes your data

Where a processor is US-based, transfers rely on the standard contractual clauses and equivalent safeguards in that provider's data-processing terms. No processor is authorised to use your data for its own purposes. Prognyx does not sell, rent or trade personal data, and has no affiliate or data-broker relationships.

Your rights

If you are in the EU, EEA or UK you have the right to access, correct, delete, restrict, port and object to the processing of your personal data, and to withdraw consent at any time. Similar rights exist in many other jurisdictions and Prognyx applies them to everyone regardless of where you are.

To exercise any of them, email hello@prognyx.com. No form to fill in, no identity-verification hoop beyond confirming you control the address in question. You will get a reply within 30 days and normally within a few days. If you are unsatisfied, you may complain to your national data-protection authority.

Leaving the newsletter takes one click — the link at the bottom of every email, effective immediately. If you have written to Prognyx, or subscribed, and want your address deleted rather than marked, ask at the address above and it is deleted, not merely flagged.

Security

The site is served over HTTPS with HSTS. Form submissions travel over TLS to an inbox protected by a strong unique credential and two-factor authentication. Prognyx is a sole practice, so the practical control that matters most is scope: beyond an email inbox it holds one small dataset, the newsletter list (a few fields per address, hosted in the EU, readable only with a server-side key that never reaches a browser), and it does not ask clients for confidential unpublished data as a matter of course.

Children

Prognyx is a business-to-business service for pharmaceutical and biotechnology professionals. It is not directed at anyone under 16 and does not knowingly collect their data.

Changes

Material changes will be reflected in the "last updated" date above, and anything that changes what is collected or why will be described here rather than quietly amended.

This policy describes the actual behaviour of this website as of the date above. It is a plain-language notice, not legal advice.