Privacy Notice

Effective October 14, 2026

2 Minute Medicine, Inc. (“2MM,” “we,” or “us”) runs 2minutemedicine.com and the 2 Minute Medicine apps for iPhone and Android. This notice explains what information we collect, how we use and share it, and the choices you have. It applies wherever our services are offered. For privacy questions or requests, email in**@*************ne.com.

Summary

We collect account, membership and payment details to run your membership, and what you submit to EvidencePulse™ and HypeCheck™ to answer you.
We do not sell personal information for money. We do not use what you type into EvidencePulse or HypeCheck for advertising, and advertising tags never load on those pages, at checkout or on your account pages.
On the website, analytics and advertising cookies are optional. In the European Economic Area, the United Kingdom and Switzerland they run only if you accept them. Elsewhere you can turn them off in Cookie settings, and we honor Global Privacy Control.
Our NPI Lookup shows public U.S. government records about health care providers. Providers can ask us to hide their details there.
You can ask us to access, correct, export or delete your information.

Information we collect

Account and membership

When you create an account or subscribe, we collect your name, email address, password and the billing address you enter at checkout, plus your answers to “What best describes your role?” and “Specialty.” We keep your account identifier and membership status. You may also give us a job title. If you choose to give us your National Provider Identifier (NPI), we check it against the U.S. government’s public NPPES registry to verify professional status. We share your NPI with sponsors or other partners only if you agree to that when you provide it.

In the iPhone app you can use Sign in with Apple. Apple then gives us an identifier for your Apple sign-in and may give us your name and email address; if you choose Hide My Email, that address may be an Apple private relay address. We use this information to connect the same 2MM membership across the website and apps.

Purchases

On the website, card payments are processed by Stripe and by WooPayments (Automattic), which also offers Google Pay. We do not receive your full card number. We keep the resulting order, billing contact details, subscription status and renewal dates. TaxJar uses your billing address to calculate sales tax.

If you subscribe in the iPhone app, Apple handles the purchase and your payment method. We receive the details needed to verify and manage access, such as the product, transaction identifiers, status, renewal setting and access period, and connect a verified purchase to your 2MM account. The Android app does not sell subscriptions.

Reading and saved content

We receive article requests and count free articles to apply reading limits. The apps can store downloaded articles, favorites and reading progress on your device for offline use.

EvidencePulse and HypeCheck

We handle the questions, claims, article links, text, attachments and feedback you choose to submit, together with the answers, reports, projects, conversation history and use counts needed to provide these tools. What you submit can include health-related or other sensitive information, so please share only what you have the right to share. Our AI and search service providers process these requests for us, and the tools may retrieve and read public sources relevant to your request. Your tool history is stored with your account. Guests are identified by a random ID kept in the browser or app. The apps may also keep recent results in an encrypted, account-specific cache on your device.

NPI Lookup

When you use the NPI Lookup, we log what you do in it so we can run it, keep it fast and fair, stop abuse and improve it: the searches you run and their filters, the provider records and sections you open, the links and buttons you use (such as EvidencePulse, profile searches and 2MM+ offers), the NPIs and number of providers in a download (not the file itself), errors, and whether you were signed in or a 2MM+ member, together with your IP address, browser and device type, the page that referred you and a random ID for that page visit. We keep IP addresses, browser details and visit IDs for 90 days and the rest of these records for up to 400 days. Lists of NPIs you paste or upload are kept for 7 days unless you are a 2MM+ member and save them; saved lists and your watchlist stay with your account until you delete them. If you watch providers, we email you when their records change, and you can turn these emails off in your watchlist. When you open a question in EvidencePulse from the NPI Lookup, the provider’s public details are placed in the EvidencePulse page for you to review; nothing is submitted until you choose to ask. Your recent searches are kept only in your browser.

Device, usage and cookies

When you use our services, our hosting and security providers receive technical information such as your IP address, browser or device type, the pages or features requested, the referring page, and error details. The website uses cookies and similar technologies, described in our Cookie Policy:

Necessary: sign-in, checkout, free-article limits, fraud prevention (Stripe, WooPayments and its partner Sift), bot and spam protection (Cloudflare, Google reCAPTCHA, CleanTalk, Wordfence) and remembering your cookie choice.
Analytics (optional): Google Analytics, Clicky and Cloudflare Web Analytics measure visits and how pages are used. WooCommerce records how you reached us, such as a search or campaign, so a subscription can be credited to it. If you choose a 2MM+ offer in the NPI Lookup, a first-party cookie lets us credit a membership bought within 7 days to that offer.
Advertising (optional): Google Ads measures sign-ups from our ads and lets us show our ads to past visitors. Sponsor ads come from Lasso and its ad partners, such as Xandr (Microsoft), which may use cookies to deliver and measure them.

App analytics

The iPhone and Android apps use Google Analytics for Firebase and Clicky to measure app visits, screens, button actions, report views, feature use, and sign-in and checkout outcomes. Google uses an app-installation identifier and receives app and device information, approximate location derived from network information, and these usage events. Clicky receives the connection IP address, app version and platform, and the limited events sent through our server. These events do not include your name, email address, password, AI questions or claims, uploaded files, or Apple sign-in tokens or receipts. Advertising identifiers and ad personalization are turned off. You can stop app analytics in the iPhone app under Account › App settings › Usage analytics, and in the Android app under Account › Usage analytics.

Notifications

If an app offers notifications and you turn them on, we handle a device token from Apple or Google and your selected topics, linked to your signed-in account, to deliver them.

Email

We send account and membership emails, such as receipts, renewal notices and password resets. We send newsletters through Mailchimp; when you become a 2MM+ member, we add you to our 2MM+ member list. Every newsletter has an unsubscribe link, and unsubscribing does not affect account emails. We keep support emails you send us.

How we use information

We use information to provide articles, AI tools and the NPI Lookup; sign you in and manage your membership, payments and renewals; apply free-use limits and rate limits; verify professional status when you give us an NPI; save your choices and history; answer feedback and support requests; send account emails and, if you have not unsubscribed, newsletters; understand how the services are used so we can improve them; measure our advertising and show sponsor ads where you allow advertising cookies; keep the services secure and prevent fraud and spam; and meet billing, tax and other legal obligations.

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases: performing our contract with you (your account, membership and the tools you use); our legitimate interests in keeping the services secure, preventing fraud and improving the services; your consent, where the law requires it, such as for optional website cookies; and compliance with legal obligations. You can withdraw consent at any time.

How we share information

Service providers that act for us: WP Engine (website hosting), Cloudflare (security, content delivery and web analytics), Render (Apple purchase verification), AI and search service providers (AI processing, research search and reading submitted article links), Stripe, WooPayments (Automattic) and Sift (payments and fraud prevention), Google Pay, TaxJar (sales tax), Mailchimp and our email delivery provider, CleanTalk, Google reCAPTCHA and Wordfence (spam and security), Google Analytics and Clicky (analytics), and Apple and Google (app distribution, sign-in and notifications). They receive what they need for those functions.
Advertising partners (Google Ads, Lasso and its ad partners) receive cookie and device data from the website only where advertising cookies are allowed.
Sponsors and partners receive your NPI only if you agree to that when you provide it.
Legal and safety: we may disclose information to comply with law, enforce our terms, or protect the rights and safety of 2MM, our users or others.
Business transfers: if 2MM is involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction.

We do not sell personal information for money. Some U.S. state laws treat advertising cookies as “selling” or “sharing” personal information for targeted advertising. To opt out, turn off advertising in Cookie settings or turn on Global Privacy Control in your browser.

Health care provider information in the NPI Lookup

The NPI Lookup displays information that U.S. government agencies publish about health care providers and organizations: the National Provider Identifier registry (NPPES) and Medicare enrollment, ordering and referring, opt-out, deactivation and Open Payments data from the Centers for Medicare & Medicaid Services; the exclusion list of the HHS Office of Inspector General; exclusion records in SAM.gov from the General Services Administration; and publications and studies listed by the National Library of Medicine (PubMed) and ClinicalTrials.gov. We show this information as published, with the date it was checked, so people can look up and verify providers. We do not buy or sell it, and we do not combine it with information about you as a reader.

The NPI Lookup is not a consumer reporting agency and its information is not a consumer report. It must not be used to decide anyone’s eligibility for employment, credit, insurance, housing or any other purpose covered by the Fair Credit Reporting Act.

If you are a provider (or act for one) and want us to hide your details in the NPI Lookup, email in**@*************ne.com or, where it is offered, use the removal request form below the tool. We ask you to confirm the request from your email address, and we can hide either your whole record or your street address and phone numbers. We keep your NPI, email address and request for as long as the request is in effect, so we can keep honoring it. To change the record itself, update it with CMS in NPPES (nppes.cms.hhs.gov); we show the registry as CMS publishes it.

Health-related information

What you enter into EvidencePulse or HypeCheck may relate to health. We use it only to provide the tool you asked for and keep your history. We do not use it for advertising or share it with advertisers. Advertising tags never load on those pages, and analytics there record only the page address, not anything you type.

Your choices and rights

Cookies: use Cookie settings (also linked in the website footer) or your browser settings. We honor Global Privacy Control as an opt-out of advertising cookies.
Email: use the unsubscribe link in any newsletter, or email us.
App analytics: use the Usage analytics switch described above.
Your information: email in**@*************ne.com to access, correct, export or delete information linked to your 2MM account. We verify requests by confirming them from the email address on the account.
Deleting your account in an app: in app versions with Account › Delete account, you can request deletion without emailing us. Choose to delete now, including during paid access, or after your verified paid access ends. We complete deletion of your account and associated AI history within 30 days of the request or of the end of paid access, stop website subscription renewal, and tell you when it is done. Legally required billing and tax records may remain.
NPI Lookup records: providers can ask us to hide their details in the NPI Lookup, as described above.
Subscriptions: cancel a website-billed membership online at any time in My Account › Subscriptions. Cancel Apple-billed subscriptions in Apple’s subscription settings; deleting an app or a 2MM account does not cancel Apple billing.

Depending on where you live, you may have more rights. In the European Economic Area, the United Kingdom and Switzerland, you can ask us to access, correct, delete, restrict or transfer your information, object to processing based on legitimate interests, withdraw consent, and complain to your local data protection authority. In California and other U.S. states with privacy laws, you can ask to know, access, correct or delete your information and opt out of selling, sharing or targeted advertising. You can use an authorized agent, and we will not treat you differently for exercising these rights. If we decline a request, you can appeal by replying to our decision. We respond within the time the law requires.

Retention and security

We keep information for as long as needed to provide the services, protect them, respond to requests and meet billing, tax and other legal obligations. Some records, such as legally required billing and tax records, may remain after an account is deleted. Cookie lifetimes are listed in our Cookie Policy. We use encrypted connections. The apps store sign-in credentials in the iPhone Keychain or the Android Keystore and encrypt certain offline content and recent AI results on the device. No internet service or device storage is completely secure.

Children

Our services are intended for adults 18 or older and are not directed to children. We do not knowingly collect personal information from children under 13, or under 16 in the European Economic Area and the United Kingdom. If we learn that we have, we delete it. If you believe a child has given us information, email in**@*************ne.com.

International use

2MM operates from the United States. Information may be processed in the United States and in other countries where our providers operate, which may have different data protection laws. Where the law requires it, we rely on safeguards such as standard contractual clauses for these transfers.

Other websites

If you open a journal, source, sponsor or other outside website from our services, that site handles information under its own privacy practices.

Changes and contact

We may update this notice as our services change. We will post the current version on this page with its effective date. Questions or requests: in**@*************ne.com.