Privacy policy

Ordia is a tool for running systematic reviews. This policy says what we hold about you, why, and what you can do about it. Questions go to ordiareview@gmail.com.

What we hold

• Your account. Your email address, the name you give us, and a password that is stored only in hashed form by our authentication provider.
• Optional settings. If you tell Ordia which library you belong to, or give it your library's proxy address, we store that so links to papers go through your library.
• Your reviews. Everything you and your team put into a review: imported references, search strategies, screening decisions and notes, uploaded PDFs, extraction data and risk of bias assessments. Each decision is stored with the account that made it.
• Team membership. Which reviews you belong to and in what role. Members of a review can see the name and email address of its other members.
• Payments. When a review is paid for we record which account paid, the amount, the date and Stripe's reference for the payment. Card details go to Stripe and never reach Ordia.
• Error records. When a page fails we record the error message, the page address and the time. We do not attach your account to it.

We do not use advertising or analytics trackers. The only cookies Ordia sets are the ones that keep you signed in, plus a short-lived one that remembers an invitation while you create an account.

Why we hold it

To provide the service you signed up for: signing you in, showing your reviews to you and your team, keeping the record a systematic review needs, taking payment, and keeping the records the law requires.

Who else handles it

• Supabase stores the database, the uploaded files and the sign-in system, and sends account emails such as password resets.
• Vercel hosts the website and briefly logs requests, including IP addresses.
• Stripe processes payments and sends receipts.

To find a legal open access copy of a paper, Ordia sends that paper's DOI or PubMed identifier to Unpaywall, Europe PMC and, if you have chosen a library, LibKey. Those requests carry the paper's identifier and an operator contact address. They do not carry your name, your email or anything about your review.

We do not sell personal data, and we do not use your review content to train models or for any purpose other than running your review.

Where it is

The database and uploaded files are stored in Canada. The website is served, and payments are processed, by providers based in the United States.

How long we keep it

For as long as your account or the review exists. Deleting a review removes its records and files. Deleting your account removes your profile; decisions you made in other people's reviews stay in those reviews, because the review's record depends on them. Backups held by our database provider expire on the provider's own schedule. Error records are deleted after 90 days. Payment records are kept for as long as tax law requires.

What you can do

You can export a review's data from inside the product at any time. You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete your account, by writing to ordiareview@gmail.com. We answer within 30 days.

Uploaded papers and patient data

Do not put information that identifies patients or research participants into Ordia. It is built for published literature, not for clinical records.

Children

Ordia is not meant for anyone under 16.

Changes

If this policy changes in a way that matters, we will tell account holders by email before the change takes effect.