Legal
Privacy policy
Short version: the only personal data Prognyx collects is what you type into a form. No cookies, no advertising trackers, nothing sold, ever.
Last updated 2026-07-25
Prognyx sets no cookies and stores nothing on your device. Fonts are served from this domain, so visiting does not contact Google. Audience measurement is anonymous and cookieless. The only personal data collected is what you deliberately type into the contact form, and it is used solely to reply to you. It is never sold, rented, or shared with advertisers.
Who is responsible
Prognyx is operated as a sole practice by Rali Filali (see About). Prognyx is not currently an incorporated company. For any privacy question, request or complaint, write to hello@prognyx.com — it reaches the person responsible directly. A postal address is available on request.
What is collected
1. What you type into a form
The sample-brief form collects your name, company, work email, and optionally an asset, target or indication and a message. The download form on the sample-brief page collects an email address only. Both include a hidden field that only automated bots fill in; if it is filled, the submission is discarded.
Purpose: to reply to you and to send the brief you asked for. Nothing else — there is no mailing list and no marketing sequence.
Legal basis: your request (GDPR Art. 6(1)(b), steps taken at your request prior to a contract).
Retention: enquiries are kept while the conversation is live and for up to 24 months afterwards, so a later reply still has its context.
2. Anonymous audience measurement
Prognyx uses PostHog, hosted in the European Union, to count how pages and briefings are actually used — which pages get read to the end, which call-to-action gets clicked, whether a form is started and finished.
It is configured to be cookieless: the visitor identifier lives in memory for the duration of the page only, and nothing is written to your browser storage. A returning visitor is not recognised. Nothing you type into a form is sent to analytics, and URLs are stripped of query strings before being recorded. If your browser sends a Do Not Track signal, analytics does not load at all.
Purpose: to know whether the site works. Before this existed there was no way to tell.
Legal basis: legitimate interest in strictly anonymous first-party audience measurement (Art. 6(1)(f)). Because no identifier is stored on your device, this does not require consent under the ePrivacy Directive.
Retention: aggregated event data, per PostHog's default retention.
3. Server logs
The site is hosted on Vercel, which records standard technical request logs (IP address, timestamp, requested URL, user agent) for security and to keep the service running. These are Vercel's operational logs, retained on their schedule, and Prognyx does not use them to build profiles.
What is not collected
- No cookies of any kind, first- or third-party — which is why there is no consent banner to dismiss.
- No advertising or social trackers. No Meta pixel, no Google Ads tag, no LinkedIn Insight tag.
- No third-party fonts. Typefaces are served from this domain, so loading a page sends nothing to Google Fonts.
- No session recording, no heatmaps, no keystroke capture. Explicitly disabled.
- No special-category data. Prognyx analyses public information about companies and drug programmes. It never asks for, and must never be sent, patient-level or health data about identifiable individuals.
Who else processes your data
| Processor | What it handles | Where |
|---|---|---|
| Vercel | Hosting and request logs | EU edge, US company |
| PostHog | Anonymous, cookieless analytics events | European Union |
| OVH | Email hosting, and delivery of form submissions to the Prognyx inbox | European Union |
Where a processor is US-based, transfers rely on the standard contractual clauses and equivalent safeguards in that provider's data-processing terms. No processor is authorised to use your data for its own purposes. Prognyx does not sell, rent or trade personal data, and has no affiliate or data-broker relationships.
Your rights
If you are in the EU, EEA or UK you have the right to access, correct, delete, restrict, port and object to the processing of your personal data, and to withdraw consent at any time. Similar rights exist in many other jurisdictions and Prognyx applies them to everyone regardless of where you are.
To exercise any of them, email hello@prognyx.com. No form to fill in, no identity-verification hoop beyond confirming you control the address in question. You will get a reply within 30 days and normally within a few days. If you are unsatisfied, you may complain to your national data-protection authority.
Prognyx does not run a mailing list. The briefings are published openly on the site; there is nothing to unsubscribe from. If you have written to Prognyx and want your address deleted, ask at the address above and it is deleted, not merely flagged.
Security
The site is served over HTTPS with HSTS. Form submissions travel over TLS to an inbox protected by a strong unique credential and two-factor authentication. Prognyx is a sole practice, so the practical control that matters most is scope: it does not maintain a customer database of personal data beyond an email inbox, and it does not ask clients for confidential unpublished data as a matter of course.
Children
Prognyx is a business-to-business service for pharmaceutical and biotechnology professionals. It is not directed at anyone under 16 and does not knowingly collect their data.
Changes
Material changes will be reflected in the "last updated" date above, and anything that changes what is collected or why will be described here rather than quietly amended.
This policy describes the actual behaviour of this website as of the date above. It is a plain-language notice, not legal advice.