Privacy policy

Who we are

FirstPass is run by Kaleb Lovingier (FirstPass Interactions) in Washington State. Contact: FirstPassInteractions@gmail.com.

Do not enter patient information

FirstPass is an educational reference. It is not built to hold patient data and is not a HIPAA covered entity or business associate. Do not enter names, record numbers, dates of birth or any other protected health information (PHI). Use drug names and teaching toggles only.

What stays in your browser

The drugs on your desk, host toggles, any amounts you type, study marks, lab-book answers, saved briefs, recent trays, watch pins, a search-shortcut setting and your license key are kept in your browser's local storage. They are not sent to a FirstPass database (there is none). Clearing site data for this site removes them.

Your license key is sent to the server when it is checked. The server checks its signature and does not store it.

What reaches the FirstPass server

Live lookups: catalog drug names or ids. The server asks public sources (OpenFDA, NLM RxNorm and RxClass, PubChem, DailyMed, ClinicalTrials.gov, PubMed, CPIC, PsychonautWiki, TripSit) by drug name. Host toggles and typed amounts are not sent.

"Ask the three readers": only when you press it, a short brief built from the check on screen (drug names, top rows, sources) is sent to xAI's API. Answers are kept in server memory for up to 10 minutes.

Program inquiry form (/for-programs): your name, work email, organization and message are emailed to the FirstPass inbox through Resend, with your email as reply-to. The form does not store them in a database. They then live in the FirstPass email inbox.

Lost-key recovery (/recover): Lost-key recovery checks only card purchases, and card checkout is switched off. If you paid by Venmo, Cash App or PayPal, email FirstPassInteractions@gmail.com to have your key resent.

Abuse limits: the recovery and inquiry forms count requests per IP address and per email in server memory only. Those counters are not written to disk and reset when a server instance restarts.

FirstPass's own server logs record event names, status, timing and counts, and are designed not to record request contents, emails or keys. Vercel, our host, keeps its own request logs (which include IP addresses) under its own policy.

Payments and the Founding license

Founding is paid by Venmo, Cash App or PayPal. The payment happens in that app, so FirstPass never sees your card or bank details. The operator matches the payment and emails the Founding key. Stripe checkout is built but switched off. If card checkout is added later, this policy will be updated first.

Venmo, Cash App and direct PayPal payments are handled by hand. The operator sees the payer's name, handle and the amount in that app and in the payment emails it sends, and uses them to issue the key.

Founding keys are emailed through Resend to the purchase email, with a blind copy to the FirstPass inbox.

Who else handles data

Vercel (hosting and request logs), Venmo, Block (Cash App) and PayPal (payments), Stripe (Stripe checkout is built but switched off), Resend (email delivery), Google (Gmail inbox for FirstPass email; Google Fonts, which sees your IP address and browser when pages load fonts), xAI (only when you use the readers), and grok.com, which serves a "Created with Grok" badge script on desk pages. FirstPass does not sell or share personal information for advertising.

How long we keep it

Browser data: until you clear it. Rate-limit counters: until the server instance restarts, and at most a day. Reader answers: up to 10 minutes. Emails (key deliveries, inquiries, payment notices): in the FirstPass inbox until deleted. Venmo, Cash App and PayPal records: kept by those companies under their own rules, which include legal record-keeping. Vercel logs: per Vercel's retention.

Your rights

You can ask what we hold about you, ask us to correct it, or ask us to delete it, by emailing FirstPassInteractions@gmail.com. We will answer within 45 days. We may keep payment records where the law requires it. We will not treat you differently for asking.

Washington's My Health My Data Act: FirstPass does not ask for or knowingly collect consumer health data. The desk's toggles and drug lists stay in your browser. If anything you send us (for example an inquiry message) contains health information about you, you can ask us to delete it, and we will not sell it or share it except with the processors above to answer you.

California and other states with privacy laws: the same access, correction and deletion requests are open to you at the same address. We do not sell or share personal information as those laws define it.

Children

FirstPass is for healthcare professionals and health-professions students. It is not intended for children under 13, and we do not knowingly collect their information.

Changes

We will update this page and its effective date when practices change. Effective October 19, 2026.