Privacy, in practical terms.

Updated 7 September 2026. Bonita is operated by Luana Micheau, trading as Bonita Index, Ireland. Contact luana@luana.systems about access, correction or deletion.

Browsing and saved research

No patient account is needed. Saved profile IDs and your optional usage-count preference stay in browser storage. No health profile is created. Clear your shortlist or browser storage to remove them.

Contributions and feedback

We store the message and optional name/email you submit in a private moderation queue. We use them to investigate and reply. Do not send medical records or identifying patient information. A correction may require sharing its substance with a clinician for a reply; your identity is not included without your permission.

Consented clinic inquiries

If you choose an approved clinic and explicitly consent, your name, email, procedure, origin, timeframe and question are stored by Bonita and visible to that clinic’s approved members so they can respond. This is different from private editorial feedback. The clinic handles information it receives under its own privacy responsibilities. Do not include medical histories or intimate images.

Photo and video research

Local videos stay on your device; frames are prepared in your browser. Only when you choose a provider action with consent do we send a public post URL to its platform for a cover image, or selected images to Google Cloud Vision for web matching. We do not persist the submitted media or matching results. Downloaded frames remain where you save them. External search sites have their own terms.

Optional usage counts

With your opt-in, we count actions such as opening a source, saving a profile or completing a search. The event body contains only a predefined event name: no page URL, clinician, procedure, email, media, user identifier or free text. We store daily totals, not individual browsing histories. You can turn this off in the footer. Hosting providers still process ordinary network requests.

Feature votes

When you send a feature vote, we store your choice, whether you used the guide or tool, a random response ID and the submission time for up to 90 days. The response ID is saved in your browser when storage is available to prevent accidental repeats; it is used only for this poll. No email, submitted image, searched URL or browsing history is included. Votes are optional and separate from usage analytics. Clearing browser storage removes the local record. Network abuse limits still apply.

Operational records and retention

Contributions and patient inquiries are purged daily once they reach 12 months. Request earlier deletion by email. Clinic records remain while active; request closure by contacting us. Login codes expire after ten minutes, sessions after seven days. Expired authentication records are purged daily; abuse counters are purged daily after approximately 31 days. We use a salted network-identifier hash for abuse limits. Hosting logs may include IP addresses and request metadata under the hosting provider’s retention settings.

Bonita does not offer an email newsletter or collect newsletter subscriptions. Follow our editorial content on Instagram. Instagram processes activity under its own privacy policy.

Service providers and rights

Vercel delivers the site; Cloudflare Workers and D1 serve requests and store submissions. Authentication/moderation email uses Cloudflare Email Service or Resend when configured. Google Cloud Vision is used only for requested image matching. These providers may process data outside your country, including the EU or US. We use their service and data-processing terms. We do not sell submissions or use them to train models.

We rely on legitimate interests to maintain an accurate public research directory, handle factual corrections and protect the service from abuse. Clinic account administration is processed to provide the requested service. Optional usage measurement, external media searches and patient inquiry sharing rely on consent, which you can withdraw by changing the relevant setting or contacting us; withdrawal does not undo processing already carried out. Profile facts come from the public sources linked on each record. We do not use automated processing to decide clinical suitability. You may request access, correction, deletion or export, object to processing, and complain to your data protection authority, including Ireland’s Data Protection Commission (opens a new tab). We aim to respond to rights requests within 30 days. Include enough context to locate your submission without sending extra medical information.