EvidX · Last updated: 06/07/2026
EvidX — Knowledge Acceleration ToolConvenience translation. This Policy is drafted in Spanish; this English version is provided for convenience only. In case of conflict, the Spanish version prevails.
This Privacy Policy describes how EvidX collects, uses, stores, shares, and protects the User's personal information. It constitutes the Comprehensive Privacy Notice under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations, as well as equivalent regulations in the other Latin American countries where the Service operates.
Data controller: Dr. Julián Treviño González, a natural person with business activity, who operates EvidX. RFC: TEGJ900425FC5. Project co-founders: Dr. Julián Treviño González and Ing. Armando Olivares Olivares. Address: Tepic, Nayarit, Mexico. Privacy contact: [email protected].
By using the Service, the User states that they have read, understood, and given express consent to the processing of their personal data as described in this Policy. If you disagree, you must refrain from using the Service.
EvidX is a knowledge acceleration tool for the study and triage of published scientific literature. It does NOT process patient data. Expressly, EvidX is NOT designed to process patient-identifiable personal information (PII/PHI); does NOT request, store, or process medical records, individual clinical notes, diagnostic images with identifiable data, or any clinical information about specific patients; and only processes published scientific articles uploaded by the User for academic study.
The User expressly undertakes NOT to upload files containing patient personal data. Given the non-clinical nature of the Service, EvidX is not a covered entity under HIPAA in the United States, nor a healthcare provider under NOM-024-SSA3-2012 in Mexico, and does not enter into Business Associate Agreements (BAA) or equivalents.
Biometric data: biometric authentication (fingerprint/Face ID) is processed exclusively on the device via Apple and Android native APIs. EvidX only receives a boolean confirmation of authentication success and does NOT store, process, or access the User's fingerprints or facial features.
Payment data: EvidX does NOT collect or store card or bank information directly; all payments are processed through Apple, Google, and RevenueCat under their own policies.
Sensitive data: EvidX does NOT request or collect sensitive data under the LFPDPPP. Specialty, residency year, and professional role refer to the User's professional/employment status, not their individual health status, and thus are not sensitive data (art. 3, section VI of the LFPDPPP).
Primary (necessary to provide the Service): create and manage the account; process PDFs and generate Analyses and podcasts via the AI provider; enable PubMed search; manage the subscription; provide support; send operational communications; prevent fraud and abuse; and comply with legal and tax obligations.
Secondary (require express consent, revocable at any time without affecting the Service): marketing communications and educational content; aggregated and anonymous statistical analysis; satisfaction surveys. Consent for secondary purposes is given via an affirmative mechanism within the app, separate from acceptance of the Terms and Policy.
Anthropic PBC (AI Provider). To generate the Analyses, the Service transmits the uploaded content (text extracted from the PDF) to Anthropic PBC (San Francisco, California, USA), provider of the Claude model, processed under Anthropic's Commercial Terms of Service, which: expressly prohibit using the content to train or improve their models; retain the content for a maximum of thirty (30) days solely for abuse prevention and security safeguards, after which it is deleted; and subject processing to confidentiality and security obligations. The request is processed pseudonymously with respect to the end User's identity.
| Provider | Purpose | Data shared |
|---|---|---|
| Supabase Inc. (USA) | Database, authentication, Edge Functions, storage | Account, analysis history, podcasts, metadata |
| RevenueCat Inc. (USA) | In-app subscription management | Pseudonymized subscription ID and plan metadata |
| PostHog | Product analytics | Pseudonymized or aggregated usage events |
| Sentry | Crash reporting | App version, device, stack trace (no document content) |
| Apple Inc. / Google LLC | Distribution, payments, push notifications (APNs/FCM) | Transaction IDs, anonymous device token |
| NCBI / PubMed (US government) | Integrated literature search | Queries without identifiable personal data |
When the User chooses Apple Sign In or Google Sign-In, EvidX receives only the minimum data shared by the provider (email —which for Apple may be a private alias— and an identifier). EvidX does NOT use the uploaded content, the Analyses, the podcasts, or any User personal data to train its own or third-party artificial-intelligence models.
Transfers are based on article 36, section IV of the LFPDPPP (transfer necessary to maintain or fulfill the legal relationship) and, additionally, on the User's express consent. For data subjects in other Latin American jurisdictions, transfers follow their national legislation (Decree 1377/2013 in Colombia; AAIP Provision 60-E/2016 in Argentina; Law 19.628 and Law 21.719 in Chile; Supreme Decree 003-2013-JUS in Peru). The User acknowledges and consents that their data is transferred, stored, and processed outside their country of residence, particularly in the United States. EvidX adopts reasonable safeguards: selecting providers with contractual commitments and certifications (SOC 2, ISO 27001 where applicable), standard contractual clauses where required by law, and data minimization.
EvidX does NOT sell, rent, or trade the User's personal data. It only shares information with the providers listed in section 5 (under confidentiality obligations); when required by a competent authority through a valid court order or request; to protect the rights, property, or safety of EvidX, its Users, or third parties; and in the context of an incorporation, merger, acquisition, or corporate reorganization, in which case the User will be notified and privacy commitments maintained.
No transmission or storage system is 100% secure; EvidX cannot guarantee absolute security. The User is responsible for protecting their credentials and using biometric authentication and automatic lock.
Under the LFPDPPP, the User has the rights of Access, Rectification, Cancellation, and Objection over their personal data, as well as portability where the law provides and revocation of consent. To exercise them, send a request to [email protected] including full name and means to receive a response, a document proving identity, and a clear description of the data and the right to be exercised. EvidX will respond within a maximum of 20 business days. Exercise is free, except for justified shipping or reproduction costs. Revoking consent has no retroactive effect and may make it impossible to continue providing the Service.
If the User believes their rights were not duly addressed, they may file a complaint with the competent Mexican data-protection authority —which, since the LFPDPPP took effect on March 21, 2025, is the Anti-Corruption and Good Governance Secretariat— or the equivalent authority in their country of residence.
Users residing outside Mexico have equivalent rights under their national legislation: Colombia (Law 1581/2012 and Decree 1377/2013, SIC); Argentina (Law 25.326, AAIP); Chile (Law 19.628 and Law 21.719); Peru (Law 29733, ANPD). They may use the procedure in section 10.
As a native mobile application, EvidX does not use browser cookies. It uses the unique installation identifier (to keep the session), PostHog anonymous identifiers (usage events), and Sentry technical identifiers (error correlation). EvidX does NOT use the IDFA (iOS) or AAID (Android) advertising identifiers for marketing, profiling, or cross-app tracking, and does not integrate with advertising networks.
The Service is directed exclusively at healthcare professionals and medical students over 18. EvidX does not intentionally collect data from minors. If it detects that it has collected data from a person under 18, it will immediately cancel the account and delete the data. Parents or guardians may contact [email protected].
EvidX may update this Policy periodically. For material changes, it will notify by publishing the updated version with its new "Last updated" date and notice via registered email or in-app, at least 15 calendar days in advance. Continued use after the modifications take effect constitutes acceptance.
Privacy Officer: Dr. Julián Treviño González, Co-founder.
📧 [email protected] · Tepic, Nayarit, Mexico.
EvidX — Evidence, Decoded.