Plainly stated
Privacy policy
What we collect, why, who else sees it, and how to see, change, or delete yours. Written to be read, not skimmed past.
Last updated: 4 September 2026
Who we are, and what this covers
My Kidney Story is a website where people who need a living kidney donor can tell their story and ask their community to consider donating. This policy covers My Kidney Story’s website — every page on it — and every email we send from it.
What we collect, by who you are
My Kidney Story has several different kinds of visitor, and each one hands over something different. Find yourself below.
- Campaign owners
Your account email, name, and either a password — stored as a hash we cannot reverse, never as plain text — or the fact that you signed in through Google, LinkedIn, Facebook, or a one-time email link. If you use one of those, we never see or store a password at all.
The content you choose to publish: the first and last name of the person who needs a kidney, the organ needed, city and state, a postal code, a headline, a short summary, the story itself, and any photographs you upload. Which tone and theme you picked for your page. Your progress through the campaign-building wizard, saved automatically as you go so a dropped connection never costs you what you wrote. The moment you accepted the consent to make your page public.
If a page is run for someone else, we hold that person’s email address so they can confirm the page and take it down. We use it for those two emails and nothing else, we never show it on the page or to anyone else, and it is not included in a copy of your own data, because it is theirs rather than yours.
Organ needed is the only health-related field anywhere on My Kidney Story, and it is on your page because you chose to publish it. We never collect blood type, test results, medications, or a diagnosis — the forms have no field for any of them, and there is nowhere to type one in.
- People running a page for someone else
If you are setting up a page on behalf of someone who needs a kidney, we also collect your own name, so the page can say who is doing the asking. Everything about the beneficiary — their name, organ needed, city, state, and the rest above — is collected the same way either way.
- Champions
If someone invites you to be a champion — an advocate who helps spread their page — we collect your name, your email, and the invitation itself. If you keep an outreach list of people you have talked to about donating, we store it: a name as you think of them (“Dave from five-a-side”), how you reached them, where things stand, and any notes you add. That list is private to you. Nobody else, including the person you are championing for, can see it.
- Prospective donors who enquire
Your name, email, phone number if you give one, whatever you choose to write, and which campaign brought you here. We email these details to the person at My Kidney Story who writes back to you, and we keep them so the reply can be tracked. We never show an enquiry to the patient — that promise is built into the product, not just this policy.
- Support-wall posters
Your name and message, shown publicly on the page you posted to. An email address, if you give one — we keep it in case a message needs following up, but we never display it anywhere.
- Followers and newsletter subscribers
Your email, your name if you give one, and when you agreed to hear from us.
- Mentors
Your name, email, city and state, the year you donated or received a transplant, your bio, and which topics you are willing to talk about. If someone writes to you through the site, we relay the message to you and keep a copy — mostly so there is a record if anyone ever misuses that line to you.
- Everyone
Standard server logs. A visitor hash — a scrambled combination of your IP address and browser, rebuilt fresh every day so it cannot be matched to any hash from a previous day — used to count page views once per visitor and to slow down abuse. When you open a campaign page or its donor questionnaire, a second scrambled value is kept with that record so the page can count how many different people it has reached over time. It is specific to that one page, cannot be matched to any other page, and is deleted with the record after twelve months. We never store a raw IP address.
A referral code in a cookie for 30 days, if you arrived through a partner’s link. A session cookie while you are signed in. And, only while the site is invite-only, a preview-access cookie — it normally is not.
How we use it
To run the page you or someone else published. To get a donor enquiry to a person who writes back within a day. To send followers an update when one is posted. To slow down abuse. To see whether pages are actually being read and shared. And to improve the product itself.
That is the whole list. We do not run advertising, we never sell or rent anyone’s personal information, we never share data between campaigns, and we never use one partner’s data to benefit another.
AI assistance
If you use the story-writing assistant while building your page, your interview answers and the draft it produces are sent to Anthropic’s API to generate text. If a visitor uses the donor guide chat to ask questions about donating, that conversation is sent to Anthropic’s API too — but My Kidney Story does not save it anywhere, on either end.
Anthropic’s own privacy policy, covering what happens on its side, is at anthropic.com/privacy.
Who else processes your data
A handful of providers do specific jobs for us. None of them can use your data for anything other than the job listed here.
- Vercel
- hosting, serverless functions, and photo storage through Vercel Blob
- Neon
- the Postgres database everything else is stored in
- Resend
- sending the emails described above
- Anthropic
- the AI writing and chat features described below
Public by design
A published campaign page, its photographs, and its share image are public on the internet. Search engines may index them, and social platforms may cache them when a link is shared — that is what makes sharing work at all. Appearing in the /discover directory is a separate choice, off by default, and yours alone.
Pausing a page takes it down. We will not pretend that removes every trace of it: a copy someone already shared, a cached version somewhere else on the web, or a photograph at the direct address it was served from, can outlive the page itself. If that happens, a deletion request through /help is how we handle the rest.
Retention and deletion
Your account, campaign, photos, and updates are kept for as long as your account exists. You can download or delete all of it, at any time, from your account settings.
Page-view and click records for a campaign are deleted twelve months after they are recorded; they never contain your name or address, and the daily visitor token in them cannot be linked across days.
A donor enquiry is kept while it is unanswered, and for twelve months after a person marks it contacted or closed, then deleted. Messages sent to a mentor through the site are deleted ninety days after they are relayed.
The record of which follower emails were sent is kept for twelve months. Notes left on a support wall keep their text; the email address and visitor token attached to them are removed after twelve months. Progress records from the campaign wizard are deleted after ninety days. Records of when the writing assistant was used on a page — which step, and whether it worked, never what was written or who wrote it — are deleted after ninety days.
Where a transplant program invited someone to the site, the alerts that tell their coordinator something has changed are kept for six months. Those records hold no words from the page, only which kind of change it was. The coordinator’s notes on a page — the topics they suggested, and whether they have read the draft — are removed with the page itself.
Administrative audit records and the log of counts reported back from a transplant program are kept for twenty-four months.
Deleting an account removes everything above that belongs to it immediately, except records a law requires us to keep, which we do not currently hold.
To delete a campaign run on someone else’s behalf, a donor enquiry, a support message, a follow, or a mentor listing, write to us through /help. A person actions it and confirms it back to you by email, within 30 days.
Your choices and rights
You can pause or edit a page at any time, with no approval needed. Every follower and newsletter email carries a one-click unsubscribe link. For access, correction, deletion, or a copy of your own data, /help reaches a person who handles it.
Residents of Washington, Nevada, and Connecticut have additional rights under those states’ consumer health data laws over what they call “consumer health data” — which, on My Kidney Story, means one specific thing: the fact that a named person needs an organ. If that applies to you, the same channel above is how you exercise those rights, and we do not sell consumer health data to anyone.
Children
My Kidney Story is built for adults. We do not knowingly collect information from anyone under 18. If you believe a child’s information has ended up on My Kidney Story, tell us through /help and we will remove it.
Security
Every page on My Kidney Story is served over HTTPS. Passwords are stored as hashes we cannot reverse, never as plain text. Photographs have their location data stripped out the moment they are uploaded, before they are ever stored. Your data lives with the providers named above, under their own security practices.
We are a small platform, not a hospital system or a bank, and we will not claim protections we have not built. My Kidney Story is not a HIPAA-covered entity and does not hold medical records.
Changes, and how to reach us
If this policy changes in a way that matters, we will say so on this page. Questions about any of it go to /help, which reaches a real person.