Privacy Policy
Last updated November 8, 2026
Gript Technologies LLC (“we”) runs CodeSet Workbench at algmd.com and app.algmd.com. This policy explains what personal data we collect, why, who we share it with, and your choices. Questions or requests: support@gript.io.
No patient data
CodeSet Workbench is built to describe cohorts in general terms. Don’t enter protected health information, patient identifiers or any data about individual patients. We don’t want it and the Service isn’t designed to protect it.
What we collect
| Data | Why we use it |
|---|---|
| Account details: username, email, country, organization, a hashed password (never the password itself) | To create and secure your account, send account emails such as confirmation links, and understand which organizations use the Service |
| Google sign-in: your Google account ID and email, if you choose “Sign in with Google” | To sign you in |
| Your work: cohort descriptions, code sets, overrides and notes | To run the Service and keep your saved sets |
| AI request logs: the prompts sent to our AI provider for your requests and its responses | To debug problems and keep an audit trail of how each code set was drafted |
| Usage counts: how many AI drafts you run per day and month | To apply plan allowances and prevent abuse |
| Subscription status: your plan and Paddle customer and subscription IDs | To give you the features you paid for |
| Technical data: IP address and request logs kept by our hosting provider | To operate and secure the Service |
We never see or store your card details; Paddle handles payment information.
Cookies
We use one strictly necessary cookie to keep you signed in. We don’t use advertising or analytics cookies or third-party trackers. The landing page loads fonts from Google Fonts.
Who we share data with
We don’t sell personal data. We share it only with service providers that help us run the Service:
- Render (hosting, United States) — stores the Service and its database.
- Anthropic (AI processing, United States) — receives your cohort descriptions and the candidate codes to draft decisions. Under its commercial terms, API inputs aren’t used to train its models.
- Paddle (payments) — our Merchant of Record. Paddle processes checkout, billing and tax under its own privacy policy.
- Google — only if you use “Sign in with Google”.
- Our email delivery provider — to send account emails.
We may also disclose data if required by law or to protect our rights and users.
International transfers
We and our providers process data in the United States. Where data from the EU, UK or Switzerland is transferred, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
Legal bases (EU/UK)
We process data to perform our contract with you (running your account and the Service), for our legitimate interests (security, abuse prevention, improving the Service), and to meet legal obligations.
How long we keep it
We keep account data and saved sets while your account is open. When you delete your account, we delete your personal data within 30 days, except where we must keep records by law. Hosting logs are kept by Render for a limited period under its own policies.
Your rights
Depending on where you live, you can ask to access, correct, export or delete your data, or object to or restrict how we use it. Email support@gript.io and we’ll respond within 30 days. In the EU or UK you can also complain to your data protection authority.
Security
We use HTTPS throughout, store passwords only as salted hashes, sign session cookies, and limit access to production data.
Children
The Service is for professionals and isn’t directed at anyone under 16.
Changes
We’ll post updates here and change the date above. For material changes we’ll tell you by email or in the app.