What stays on this device

Photos of boxes and labels, the recognised text, your medicine list with the names on the boxes and, for a scanned box, its lot number, your settings, the tokens of the outcome loop and of donations, and reminders. They live only in this browser; Janus has no account.

What is sent to Janus

Product codes (only the GTIN, the expiry and the national product number of a pack code; never its serial or lot number), NDCs, the words you type or choose for a search, the ids of the medicines you confirmed with their start months, and the choices you make. Not the photos, not the recognised text as a whole and not the names on the boxes. Requests are not stored.

What is stored

Only if you choose: a donated report (age band, optional sex, region, medicines, event, kind, week, consent version), and the doctor's answers to a note's QR code. Janus also keeps a code of used or withdrawn notes until they expire, so a link cannot be used twice.

Where donated data are stored

The storage region cannot be shown right now.

For how long

Donated reports and doctors' answers: at most 24 months. Outcome-loop links: about five weeks (28 to 35 days).

How to delete

A donation: with its deletion token. Outcome-loop data: withdraw with the note's token. Everything on this device: Settings › Delete everything on this device.

• Delete a donation
• Withdraw outcome-loop data
• Delete everything on this device

How shared numbers are protected, and the limits

Counts from donations and doctors' answers are shown only for groups of at least 20, with random noise added (Hidden under 20, noise added). This is not formal differential privacy for the release as a whole.

Known limits: comparing a set of counts in two steps, (A) − (A,B) − (A,C) + (A,B,C), is not covered. Until rate limits exist (Phase 5), someone who can add donations can pad a group and re-draw its noise; anyone can create note tokens and report outcomes, so a group of doctors' answers can be padded in the same way.

Legal frame

In the EU, donations rely on explicit consent under the GDPR; in Türkiye, on explicit consent under the KVKK. In the US, Janus is not a HIPAA covered entity and follows the strictest of these rule sets. No outside body has audited Janus, and Janus is not a medical device.

Network provider

Janus is delivered through Cloudflare, which carries the encrypted connection between your browser and the Janus server and blocks attacks. To do this, Cloudflare processes technical data of each request, such as your IP address, browser type and time, and may set a short-lived technical cookie that tells people apart from automated traffic. Janus adds no analytics, no advertising and no tracking cookies, and its own server does not record IP addresses.

Data sources

openFDA (NDC Directory and FAERS / FDA AEMS), TİTCK (Türkiye), BDPM (France), CIMA by AEMPS (Spain), Wikidata, the PIPC list of prescribing cascades, Crossref and Retraction Watch for retraction checks, and MedDRA terms in report statistics (MedDRA® trademark is registered by IFPMA on behalf of ICH). Each result shows its source and date; none of these publishers endorses Janus.