Privacy policy

Evidencesway is run by Fliar Business Intelligence Private Limited (“we”, “us”), C-32, Arya Samaj Road, Karol Bagh, New Delhi, India. Email: b2b@fliarbi.com.

This one policy covers the website evidencesway.com, its label checker panel, the Evidencesway browser extension and the Evidencesway Android app. Evidencesway was called SupplementsWay until 3 November 2026. The same service also answers at its earlier addresses, supplementsway.com and medapp.fliarbi.com, and this policy covers them too.

• There are no ads. Your first report of the day needs no account; to keep checking you sign in with Google (see “Your account”); we keep your name, email address and picture address only to count your free checks, and you can delete your account at any time. Our network provider counts page views and measures how fast our pages load (see “Analytics”); it sets no cookie for this.
• We receive the text of a label only when you ask for a check.
• Label photos you scan in the Android app (unless you switch off “Accurate label reading”), and the product photos the extension’s “Read the label photo” button points to when you click it, are read for us by an AI service run by another company. We do not keep the photos.
• Five checks a day are free on the website and in the extension, and 25 in the Android app, counted for your account. As a second count, our service gives your browser or app a random id, kept in one cookie and in the page’s storage. It says nothing about who you are.
• If you enter a Prism API key, checks have no daily limit and are paid from your Fliar BI account. The key is sent to our server and checked with Fliar BI’s key service; we do not store it.
• We never receive the address of the shop page you are on, your browsing history, your phone number or device location, or your device’s own ID or advertising ID.
• What we keep about labels is filed by the text, not by person or device. To count free checks and stop abuse, we keep a coded form of your network address and of the random id for up to 2 days, then delete it. To find and fix errors, our request log keeps the start of the label text for 7 days and the rest of each record for 14 days.
• On the website, “What works?” lets you describe a health problem. That text is health information: it is used for that one answer and never written to our logs; we keep only a code made from it, its length and the condition you chose. It is sent to the AI service that suggests possible conditions.
• We do not sell data, and we do not use it for advertising.

On the website

When you paste label text, or type a product or ingredient name, and press “Check”, the page sends that text and name to our service. We read at most the first 12,000 characters.

The page then asks our service for the research on each ingredient and claim it found. These requests carry ingredient names, outcome words (such as “sleep”) and the claim sentences from the label. Some of them put an ingredient name in the web address of the request.

“What works?” on the website

When you describe a problem, condition or symptoms and press “Find what may help”, the page sends that text (at most 600 characters) and any of the optional choices you tapped (age band, sex, pregnant or breastfeeding, on regular medicines) to our service. Our service first checks the words for signs of an emergency, in code, on our server; if it finds one it shows where to get help and nothing else, and sends the text nowhere. Otherwise it sends the text and those choices to the AI service described below, once, to suggest possible conditions and follow-up questions, and checks every suggestion against the research. The AI service's answer (the suggested conditions and questions, not your text) is kept in our cache for up to 7 days, filed under a code made from the text, so the same words give the same answer without asking again.

Your text is never written to our request log, our labels file or the free-checks database: they keep only a code made from it, its length, the condition you chose, whether an emergency sign was found, and timings. Your answers to the follow-up questions and the conditions found are kept in your own browser for the session (a signed code our service hands back, valid for 3 hours), not on our server. One “What works?” search counts as one of your free checks; your answers and the research cards that follow do not count again.

In the browser extension

• On the shop sites it is built for, the extension checks, inside your browser, whether a page is a product page. On a product page it reads only the label: product name, brand, composition, supplement facts, ingredients, claims, directions, warnings and any prescription note. It skips recommendations, sponsored items, reviews and questions. If the page shows no label as text, it reads the product’s own description instead, to find the ingredient names in it.
• On any other site it reads nothing until you click its toolbar button, or press its shortcut (Alt+Shift+L), on that page.
• While you browse, nothing is sent.
• When you open the Evidencesway panel (a page of our website shown by the extension), the panel sends the label text and the product name to our service, then asks for the research as on the website. The label text is at most 6,000 characters. For a medicine, the label text is only its composition line. While the panel is open, it checks the next product you open in that tab, and “Read this page again” reads and sends the label again.
• If the label appears only in the product’s photos, the panel offers a “Read the label photo” button. Only when you click it, the panel sends the web addresses of up to 6 of that product’s photos (not the address of the page) to our service. Our server downloads those photos from the shop’s image server, so the shop sees our server, not you, and has them read as described under “Label photos”.
• The extension downloads its reading rules from our website when it is installed, and after that at most once every 6 hours, when the browser starts or you use the extension. This request carries nothing about you or the pages you visit.
• In Firefox, the extension declares that it collects “website content”. That means the label text, product description and photo addresses described here, and nothing else.

In the Android app

• The app sends label text only when you ask for a check: you tap “Check this label”, share a product link or label text to the app, open a product’s web address in the app, or paste text and tap “Check this label”. It sends the product name and the label it read (at most 6,000 characters), or the text you shared or pasted (at most 20,000 characters). The report then asks for the research as on the website. While the report is open, it checks the next product you open in the app’s browser.
• Scanning a label. When you scan a label with the camera, or choose a photo with Android’s photo picker (which gives the app only the photos you pick), the text on the photo is first recognised on your phone. With “Accurate label reading” on (the default; you can switch it off), the photos of that scan (at most 4, made smaller and re-saved on the phone so they carry no location or camera details) and the product name you typed, if any, are also sent to our service to be read as described under “Label photos”. With it off, the photos never leave your phone. You see the text and can correct it before anything is checked; only that text is used for the check.
• When the app starts, at most once every 6 hours, it downloads its reading rules from our website. This request carries nothing about you or the pages you visit.
• Shop pages you open in the app load directly from the shop, as in any browser. The shop sees what any browser visit shows it, under its own privacy policy. The app’s browser uses Android’s built-in check against unsafe websites.
• The app asks for two permissions: internet access, and the camera, which it asks for only when you first tap to scan and uses only on its scan screen. It has no access to your microphone, location, contacts or files, and sees only the photos you take or choose.

Your first report of the day needs no account. To keep checking labels, or using “What works?”, you sign in with Google. The sign-in runs through Fliar BI, the company’s business account service, so one Fliar BI account works on Evidencesway and on Fliar BI’s other products. Browsing the website, reading our pages and trying the site’s own examples need no sign-in.

• Your free report without an account. Each browser or app gets one report a day without signing in (at most two per network address). Before it, a small “I’m not a robot” box asks your browser to solve a puzzle (it does up to 150,000 calculations, usually in a second or two). The puzzle comes from our own server and is checked there; no other company is involved and nothing about you is sent for it. We keep only a coded form of the solved puzzle, so it cannot be used twice, until it expires (10 minutes).
• What we receive. From your Fliar BI account: its account number, your name, your email address and the web address of your Google profile picture. Fliar BI confirms the account with Google; we never see your Google password, and Google does not tell us anything else about you.
• Why. To count your free checks per person, so they follow you from the website to the extension and the app, and to stop one person using many devices to get more. We do not send you marketing email and we do not share your name or email address.
• Signed in. When you sign in, our service gives your browser or app a random sign-in code. The website and the panel keep it in a cookie named “sw_session” (which page scripts cannot read) and in our site’s local storage; the Android app keeps it in its own storage. Our server stores only a coded form of it. It lasts 90 days from the last time you used Evidencesway; “Sign out” ends it at once.
• How long we keep it. Your account (name, email address, picture address, when it was made and last used) is kept until you delete it. The free-check records linked to it are coded and deleted after 2 days, like all check records. Our request log notes a short code of the account (not your name or email) for each request, and is deleted after 14 days.
• Deleting your account. Choose “Delete account” in the account menu (your initial at the top of the page), in the Android app, or at evidencesway.com/account/delete. It deletes your account, every sign-in on every device, and your free-check count at once. Your Fliar BI account itself is separate: to delete it, email b2b@fliarbi.com.
• Google’s own privacy policy covers the sign-in on Google’s side: Google sees that you signed in to Fliar BI.

We use the text you describe in “What works?” only to suggest conditions to discuss with a doctor and to show what research says helps with them. It is not used to build a profile of you and is not kept with your id.

We use the label text only to show you what published research says about that label. We use request logs only to run the service, keep it secure and stop abuse. We use the random id and the coded network address only to count free checks and to limit how much one visitor can use the service.

• Reading the label. Our service finds the ingredients, amounts and claims in the text. For most labels it sends the text to an AI language model service run by another company, which sends back the list. Medicine composition lines, short ingredient names we already know, and text we have read in the last 7 days are handled without it. Our service may also send that company single ingredient names it does not know, outcome words from the claims, and summaries of published studies to read.
• Label photos. Our server sends the photos to an AI image-reading service run by another company, which sends back the label as text; if that service fails, a second AI service run by another company is asked instead. Our server does not store the photos: it keeps the label text read from them, filed under a code computed from the photos (or from the photo addresses) and reused for 30 days so the same photo is not read twice; after that it is no longer used, but it stays in the cache file until the file is cleared. Under their published terms for businesses using their services, neither of these companies uses what we send to train its AI models unless the customer chooses to allow it, and we do not. One deletes what it receives within 30 days, unless it must keep it longer to enforce its usage rules or by law. The other keeps the requests in our account with it until they are deleted, unless we switch that storage off.
• Research. Research counts and study summaries come from our own research database. Nothing about you is stored with them.
• Cache. We keep the result of reading a label: the product name, serving size, ingredient names and amounts, and the claim sentences. It is filed under a code computed from the exact text, not under you or your device, and the full label text is not kept. A result is reused for 7 days. After that it is no longer used, but it stays in the cache file until the file is cleared.
• Word lists. Ingredient names we did not know, and outcome words from claims, may be added to our ingredient and research word lists, with the time of the lookup. Only the words are kept, with nothing about who sent them.

• Without signing in, each browser or app gets one free report a day (at most two per network address), after a small “I’m not a robot” puzzle (see “Your account”). Each signed-in account gets five free label checks a day (in any 24 hours) on the website and in the extension together; in the Evidencesway Android app it gets 25, and the checks made anywhere count once. A check is one label report you ask for. Opening the same label again within a day, the research inside a report you already opened, the site’s own examples and the extension’s reading of a page before you open the panel do not count. A check that fails, or finds nothing to check, is given back.
• The first time you ask for a check, our service gives your browser a random id. It contains nothing about you. The website and the panel keep it in a cookie named “sw_did” (for up to a year) and in our site’s local storage, and send it with each check. The code of the extension and of the app never reads it.
• Each browser or app also has its own daily count, and everyone on one network address (an office, a home, a mobile network) shares at most 20 free checks a day on the website and the extension, and at most 60 in the app. Our service also limits how many requests one network address can make each minute, hour and day.
• With a Prism API key. In the app you can enter an API key from your Fliar BI account (https://fliarbi.com/radar-api/developer). Checks then have no daily limit; each new label checked draws prepaid credits from that account, and a check that fails or finds nothing is not charged. The key is sent to our server with each check and confirmed with Fliar BI’s key service, which also records the charge. We do not store the key: our check records keep only a coded form of it (made with the same secret key), for up to 2 days.
• For this, our server keeps for up to 2 days: a coded form of your IP address (for a newer IPv6 address, of its network part), a coded form of the random id, a coded form of your account, the time of each check, a code made from the label text (not the text), and the ingredient names found in the labels checked. The coding uses a secret key kept on our server, so the records do not show the address or the id itself. Records older than 2 days are deleted automatically.
• After the free checks are used up, the service shows when your next free check opens, and a link to our guide for the Prism API, for people who check many products.

• All traffic to our website passes through our network and security provider. It sees your IP address, the time and the request. It passes your IP address on to our server, which uses it to limit how many requests and checks one visitor can make, as described under “Free checks and limits”. Our server does not store the address itself.
• Our web server logs each request: the time, the requested address (which can include an ingredient name), the result, the referring page and the browser’s or app’s user agent. Requests reach us through our provider, so the log shows the provider’s network address, not yours. These logs are deleted after about 15 days.
• Our service keeps a request log to find and fix errors. Each record has the time, the requested address, the result and how long it took, whether the request came from the website, the extension or the app (and its version), the coded network address and coded random id described above, a short code of your account if you are signed in (never the sign-in code itself), a coded form of an API key if one was used, the product name, a code made from the label text, its length, and the ingredients and number of claims found. For a label check it also keeps the first 4,096 bytes of the label text in a separate file. The label text is deleted after 7 days and the rest of the log after 14 days; the whole log is also kept under a size limit, oldest first. Photos of labels are never kept: the log records only a code computed from each photo, its size and its dimensions, and, for the extension’s “Read the label photo”, the photo addresses it sent.
• The service’s system log also records the time, the requested address and the result of each request, with counts of what it read, without the label text. Old entries are deleted automatically, oldest first, when this log reaches its size limit. There is no fixed period.
• How long our network provider keeps its own records is set by that provider. We do not control it and cannot state a period. The provider may also ask your browser to report failed connections to it.

Our network and security provider adds a small web analytics script to the pages of our website, including this page and the panel that the extension and the Android app show. Your browser loads the script from that provider’s server. The script measures which of our pages are viewed and how quickly they load, using your browser’s page timing information, and sends this to the provider through our own website address. The provider says this service does not collect visitors’ personal data, sets no cookie and does not track people across websites. It shows us summary figures, such as page views and load times. We use them only to see how our pages are used and how fast they load, never for advertising. The script runs only on our pages, never on shop pages, and it does not send the label text, photos or anything you type.

These companies help us run Evidencesway:

• Our network and security provider carries all traffic to and from our website, as described under Logs, and runs the page analytics described under Analytics.
• A hosting company runs the rented server that receives requests from our network provider.
• An AI language model service run by another company reads label text, ingredient names, outcome words, study summaries and, for “What works?”, the problem you describe with the choices you tapped, as described above. Its own handling and retention of that text are set by its terms; we cannot state a period.
• Two AI image-reading services run by other companies read label photos, as described under “Label photos”: one first, the other only when the first fails.
• A web font service run by another company. Our website, the panel and the app’s report load their fonts from it. When one of our pages opens, your browser contacts that service, which sees your IP address, your browser’s user agent and which of our sites the request comes from. It does not receive the label text or the address of the shop page.

These companies may process data in other countries.

We do not sell data. We share it only as described on this page, to run the service, or when the law requires it.

The use of information received from the Evidencesway browser extension will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

We use the label text, and the photo addresses you send with “Read the label photo”, only to give you the research about that label. We do not use or transfer them for advertising, to decide creditworthiness or for lending, and we do not sell them.

• Website: remembers your colour theme (light or dark) in your browser’s local storage. Once you ask for a check, it also keeps the random id that counts your free checks, in local storage and in the “sw_did” cookie, and, once you sign in, your sign-in code in local storage and in the “sw_session” cookie (see “Your account”).
• Extension: keeps its reading rules, your colour theme and the panel width in the browser’s extension storage. What it read on each tab is kept in session storage and removed when you close the tab or the browser. The panel is a page of our website, so it keeps the same random id as the website. Some browsers keep a separate copy for each shop site.
• Android app: keeps its reading rules and the time it last downloaded them, and your theme choice. It keeps your sign-in code, your last 30 reports (History) and the reports you save (Saved) so they open again without the internet: they stay on your phone, are never sent to us, and you can rename or delete them, or clear History, at any time. If you add a Prism API key, it is kept encrypted with a key from Android’s secure key store and sent only to us with your checks; “Remove key” deletes it. Scan photos are kept in the app’s private storage only while the scan screen is open, and nothing is saved to your gallery. Its browser keeps websites’ cookies and cache on your phone, like any browser, including the random id of our report page. The app’s data is left out of Android’s cloud backups.

• If you do not ask for a check, no label text leaves your device. In the Android app, switch off “Accurate label reading” to keep scan photos on your phone.
• To remove what is stored on your device, including the random id: clear this site’s data in your browser, or uninstall the extension. For the app, open Android Settings, then Apps, Evidencesway, Storage, Clear storage, or uninstall the app. A new id is given at your next check; the free checks already used that day still count for your network address.
• To ask us to delete data, or with any privacy question, email b2b@fliarbi.com with the subject “Privacy”. Delete your account yourself as described under “Your account”; that removes your name, email address and your free-check count. Nothing else we hold is linked to your name, email or phone, so we cannot find it by them. The check records delete themselves after 2 days, label text in the request log after 7 days and the rest of that log after 14 days. If you send the exact text you checked, we will delete the cached result for that text; if you send the photo, the label text read from it. If an error message shows a reference (“Ref”), send it to us and we can find that one request.
• Please do not send personal medical details.

Evidencesway is made for adults (18 and over) and is not directed at children. We do not knowingly collect information from children.

The website, the extension and the app talk to our service over HTTPS. The app blocks unencrypted connections, and its browser cannot read files on your phone.

If we change this policy, we will post the new version on this page and change the effective date. If a product is going to send something new, we will update this page first.

Fliar Business Intelligence Private Limited, C-32, Arya Samaj Road, Karol Bagh, New Delhi, India.

Email: b2b@fliarbi.com