Privacy Notice
This notice explains what information the TED & Graves' Support Community Alliance collects, why we collect it, who can see it, and the choices you have. We have written it in plain language on purpose. If anything here is unclear, write to us and we will explain it.
Who we are
The TED & Graves' Support Community Alliance ("the Alliance", "we", "us") is a support community for people affected by Graves' disease and Thyroid Eye Disease. We are based in Miami, Florida, United States, and we operate this website at tedgravessupport.org.
For any question about this notice or about your information, write to support@tedgravessupport.org. A person on our team reads that mailbox.
An important point about HIPAA
Many people assume that anything they say about their health is automatically protected by HIPAA. That is not how the law works, and we would rather tell you plainly than let you assume otherwise.
HIPAA applies to health plans, health care providers and health care clearinghouses — and to the companies that handle protected health information on their behalf. The Alliance is not a health care provider and is not a HIPAA covered entity. We do not diagnose, treat, or bill for care. That means the health information you choose to share with us is not protected health information under HIPAA.
It is still sensitive, and we treat it that way: encrypted on our own server, never sold, never given to advertisers, and readable only by the small number of people who need it in order to answer you. But you should know exactly what protections apply before you decide what to tell us. Please share only what you are comfortable sharing. You never have to tell us anything about your health in order to contact us.
What we collect
Information you give us
- Contact details you enter in our forms — your first name, email address, and country.
- Your relationship to these conditions, if you tell us — for example, whether you are living with Graves' disease or Thyroid Eye Disease, caring for someone who is, or a healthcare professional.
- Anything else you choose to write to us, including what kind of support or information you are looking for, and whether you would like to hear about clinical research opportunities.
- The content of emails you send us.
Every field on our forms is optional except your email address and the message itself. What you write is up to you.
Information collected automatically
- Standard web server records: your IP address, the pages you requested, the date and time, your browser type and language, and the page that referred you. Our server keeps these to serve the site and to detect and stop abuse.
- When you submit a form, we record the IP address and browser the submission came from, alongside the submission itself. This is how we identify and block automated spam and abuse.
What we do not collect
- We do not use advertising cookies, tracking pixels, session recording, or third-party analytics.
- We do not build advertising profiles or track you across other websites.
- We do not ask for, and you should never send us, Social Security numbers, insurance identification numbers, financial account details, or payment card information.
- We do not use your information to train artificial intelligence models, and we do not give it to anyone else for that purpose.
How we use your information
- To reply to you and provide the support, education, or information you asked for.
- To tell you about resources and community activities.
- If — and only if — you asked about them, to tell you about clinical research opportunities that may be relevant to your situation. You are never enrolled in anything by contacting us, and asking a question creates no obligation of any kind.
- To send you updates, only if you asked to receive them. Every one of those emails includes an unsubscribe link that works immediately.
- To keep the website secure and working, and to understand in general terms how it is used so we can improve it.
- To comply with the law, and to establish or defend legal claims if that ever becomes necessary.
We do not sell your information
We do not sell your personal information, and we never have. We do not share it for cross-context behavioral advertising. We do not trade, rent, or otherwise make it available to data brokers, advertisers, or marketing companies. This is not a promise that expires — it is how the Alliance is built.
We share your information outside our team only in these situations:
- With your explicit permission, and only for what you agreed to. For example, if you ask us to put you in touch with a research site, we will ask you first and tell you exactly what will be shared.
- With the service providers listed below, who help us run the website and our email, and who are permitted to use your information only to provide that service to us.
- When the law requires it — a valid subpoena, court order, or legal process. If that ever happens and we are legally permitted to tell you, we will.
- To protect someone's safety, if we believe in good faith that disclosure is necessary to prevent serious harm.
Who else is involved
Your form submissions are not sent to any third-party form service. There is no Google Form, no Typeform, no marketing platform in the middle. What you write goes straight to a server we control, where it is encrypted. These are the only outside providers involved in running this site at all:
- Hostinger International Ltd. — provides the virtual private server that hosts this website and our email. They can technically access the underlying machine, as any hosting company can. Their privacy policy.
- Let's Encrypt (Internet Security Research Group) — issues the security certificate that encrypts your connection to this site. They do not receive any information about you.
That is the complete list. If it ever changes, we will update this notice.
How long we keep it
We keep what you send us for 24 months after our last contact with you, and then our server deletes it automatically. Website security logs are kept for a much shorter period — generally no more than 90 days — unless they are part of an active investigation into abuse of the site.
If you ask us to delete your information sooner, we will. Deletion means the record is removed from our server, not merely hidden from view.
How we protect it
- The whole site is served over HTTPS with a valid certificate, so your connection is encrypted in transit.
- Everything you send through our forms is encrypted at rest with AES-256-GCM on our own server, and stored outside the public web directory where the website itself cannot reach it.
- It can only be read through a password-protected administration panel on a separate subdomain, limited to the people who need access in order to respond to you. Access is logged.
- The server applies rate limiting, an automatic firewall, and unattended security updates.
No system is perfectly secure, and anyone who tells you otherwise is selling something. Please send us only the detail you actually need to share — and never anything you would not want written down.
If there is ever a data breach
Florida law (the Florida Information Protection Act, Fla. Stat. § 501.171) requires notice to affected individuals within 30 days of determining that a breach of personal information has occurred. We will comply with that requirement, and with the equivalent law of your state or country if it gives you more protection or a shorter deadline. Our notice will tell you what happened, what information was involved, and what we are doing about it.
Your choices and your rights
Whoever you are and wherever you live, you can ask us to:
- Tell you what we hold about you, and give you a copy of it.
- Correct anything that is wrong or out of date.
- Delete your information.
- Stop emailing you — either use the unsubscribe link or just say so.
- Limit what we do with your information, or object to a particular use.
Email support@tedgravessupport.org and tell us what you want. We respond within 45 days, and usually much sooner. We will not charge you, and we will never treat you differently because you exercised a right — you will get the same support either way.
Because we hold very little about you, verifying who you are is usually simple: we reply to the email address the information was submitted from. For a deletion or copy request from a different address, we may ask you a question only the right person could answer. You may use an authorized agent; we will ask for written proof of their authority.
If you live in Florida
The Florida Digital Bill of Rights applies to large for-profit companies that meet specific revenue thresholds. The Alliance does not meet those thresholds, so that law does not impose obligations on us. We extend the rights listed above to you regardless.
If you live in California, Virginia, Colorado, Connecticut, Texas, Oregon, or another state with a privacy law
Several states give residents rights over their personal information, and some of those laws treat information about health as sensitive and subject to extra protection. Whether or not a particular law applies to an organization our size, we honor the rights listed above for everyone who asks.
For California residents specifically: in the twelve months before the effective date of this notice, we have not sold personal information and have not shared it for cross-context behavioral advertising, including the personal information of anyone under 16. The categories of personal information we collect are identifiers (name, email address, IP address), internet activity (pages requested), geolocation at the country level, and — only if you choose to provide it — information about health, which California treats as sensitive personal information. We use sensitive personal information only to respond to you, never to infer characteristics about you. You may ask us to limit its use, though we already limit it to that purpose.
If you believe we have not handled your request properly, you may complain to your state attorney general.
If you live outside the United States
Our servers are located in Europe and our organization is in the United States, so information you send us is transferred internationally and stored under laws that may differ from those of your own country.
If you are in the European Economic Area or the United Kingdom, we rely on your consent to process any health-related information you choose to share and to send you updates, and on our legitimate interest in responding to your message and keeping the site secure. You may withdraw consent at any time, which does not affect anything done before you withdrew it. You also have the right to data portability and the right to lodge a complaint with your national data protection authority.
Children's privacy
This website is intended for adults. We do not knowingly collect personal information from children under 13, in line with the Children's Online Privacy Protection Act, and we do not knowingly collect it from anyone under 16 without a parent's or guardian's involvement.
If you are a parent or guardian and believe a child has sent us information, write to support@tedgravessupport.org and we will delete it promptly.
Email from us
We send email only in reply to you, or because you asked to receive updates. Every update includes a working unsubscribe link, and we honor unsubscribe requests immediately rather than within the ten business days the CAN-SPAM Act allows. Our messages identify us clearly and are never disguised as anything else.
This is not medical advice
Nothing on this website is medical advice, and contacting us does not create a patient–clinician relationship. Always consult a qualified healthcare professional about your own condition and treatment options.
Participation in any clinical research study is always voluntary. Not every clinical trial or treatment option is appropriate for every person, and eligibility is determined by the study protocol and by qualified medical and research professionals — not by us, and not by anything on this site.
If you are having a medical emergency, or a sudden change in your vision, contact your physician or call 911 rather than waiting for our reply.
Changes to this notice
If we change this notice, we will update the effective date at the top of this page. If a change materially affects how we handle information you have already given us, we will tell the community directly rather than relying on you to notice.
How to reach us
TED & Graves' Support Community Alliance
Miami, Florida, United States
support@tedgravessupport.org