Orinyx Privacy Policy

Effective November 8, 2026

Orinyx is run by Orinyx Inc. This page explains what we collect when you use Orinyx, why, and what you can do about it. It covers the orinyx.io website, the Orinyx API and the hosted Orinyx connector.

Orinyx accounts are for developers in the United States. If you are outside the US, please don't sign up yet.

Orinyx is for synthetic data only. Do not submit real patient information. Orinyx does not connect to any electronic health record, and it is not for clinical use.

The API refuses an order that looks like it contains an identifier, such as a phone number, a numeric date or a long number. That check does not catch names, addresses, dates written in words or short record numbers. It is a backstop, not permission.

What we collect

  • Account details. Your email, name and organization, used to create your account and sign you in. We also keep your account type and plan, when the account was created and when you last signed in. Your password is stored only as a hash. We use your email to run your account and to send the updates described on the form you signed up with.
  • What you tell us when you sign up. The sign-up form on orinyx.io also asks for your role, what your AI system does, which client you use, and any notes. It records the page you signed up from and any campaign tag in the link. The website saves each sign-up in its own database and emails it to our team. It also keeps a log of the emails it sent you and a hashed copy of your IP address to limit repeated sign-ups.
  • What you submit. The order text you send for a check, any label, tool name and version sent with it, and the result. If you are invited to the Arena preview, your answers and scores are kept too. All of it is kept under your account.
  • Activity records. Each check is stamped with your account email. Each request to the API records the time, the kind of request, the result code, your account, the key used and the IP address it came from. Through the hosted connector, that address may belong to your AI service and not to you.
  • Sign-in data. Sign-in sessions, API keys and connector tokens, so your tools can connect. They are stored as hashes.
  • Website visits. orinyx.io uses Lovable's built-in analytics to count visits. It uses cookies or similar storage, and it receives your IP address, browser type, screen size, language, approximate country, the page address, the page you came from, and what you click on the site. The site loads fonts from Google, and Cloudflare sets a security cookie. The Orinyx API and the connector set no cookies.

Why we keep an audit record

Orinyx results need to be traceable. Each check adds entries to an event log. The database is set to refuse edits and deletions to that log, and each entry carries a hash of the one before it, so an edit to an entry would show when we check the chain. The order text and results are stored beside the log. They are not covered by that lock or that chain, and they have no expiry. That is what makes a result traceable, and it is also why some data can't be deleted today (see below).

We may read stored checks to fix problems and to find drug names Orinyx could not read.

Who else handles your data

We use these providers to run Orinyx.

  • Fly.io hosts the Orinyx API, the hosted connector and the database in Chicago, United States.
  • Lovable and Supabase run the orinyx.io website and its sign-up database. The website sends account email, such as your set-password link, through Lovable's email service.
  • Google provides the website's fonts. Cloudflare sits in front of the website.
  • GitHub receives the bug and security reports you file on our public repository.
  • Your AI client (for example, Claude) sends each order to Orinyx. It keeps its own copy of your conversation under its own terms.

We do not sell or rent your information, and we do not use it for advertising. We do not use what you send to train AI models.

How long we keep it

Sign-in sessions end after 12 hours. Connector tokens last one hour and renew automatically while you use the connector. A connector sign-in ends after 30 days without use. Account details, checks, activity records and website sign-ups have no expiry today.

Your choices

  • Closing your account. Email hello@orinyx.io and we will close it. Closing stops every way of signing in: password, sessions, API keys and connector sign-ins. If you ask, we will also remove your name and email from your account details.
  • What we can't delete yet. Order text, results, the email stamped on your checks (separate from your account details), IP records, and the website's sign-up records (your sign-up, the log of emails sent to you, and the copy emailed to our team) are kept, and we have no process to delete them today. We're building a way to honor deletion requests without breaking the audit record. Until it ships, please don't put anything personal in what you submit.
  • Questions and requests. To ask what we hold about you, or to make any other request, email hello@orinyx.io.

Children

Orinyx is a tool for software developers and is not meant for children. We do not knowingly collect information from anyone under 18.

Security

To report a security issue, use private vulnerability reporting on our GitHub repository, lexthirteen-ai/orinyx-mcp. SECURITY.md there has the steps.

Changes

If this policy changes, we'll update the date at the top and note what changed.

Contact

Orinyx Inc.
800 E 18th St
Kansas City, MO 64108
hello@orinyx.io