Privacy policy

Who we are

This site is operated by 10xAnd (“we”, “us”). We will send our postal address on request. Questions about this policy, or a request to see or delete your data, can be sent through any form on this site — the one on our homepage is simplest. Start the message with “Privacy request” and a person will handle it.

The short version

• We do not set cookies, and we do not run advertising or tracking pixels on this site. Embedded videos load only when you press play.
• Analytics are aggregate and cookieless. We cannot identify you from them.
• If you send us a form, it reaches us as an email and we reply to it. We do not add you to a mailing list — we do not run one.
• The free tools run in your browser. What you type into them is not sent to us.
• If you type into the Ask Amp chat, your messages go to our server and to the AI providers named below so they can be answered. We do not store them.
• We do not sell personal data, and we do not share it except with the processors named below.

Analytics

We use Plausible Analytics, a cookieless analytics service, to count visits and understand which pages people read. Plausible does not use cookies, does not collect personal data, and does not track visitors across sites or over time. It records aggregate data such as the page viewed, the referring source, approximate country, and device type, and it derives a daily, non-reversible identifier that cannot be used to recognize you tomorrow or elsewhere.

We also use Cloudflare Web Analytics as a second, independent count of page views and page load speed. It is likewise cookieless, does not use local storage or fingerprinting, and does not track visitors across sites.

We also record custom events on this site — for example, that a page was scrolled to 75%, that a FAQ item was opened, or that a link to another service page was clicked. These events are aggregate counts. They carry the page and the element interacted with; they do not carry anything about you.

Forms and scoping review requests

When you submit a form on this site — a question, a request for a one-pager, or a request for a scoping review — you give us your email address and whatever else you choose to write, such as your company, the service you are interested in, and times that suit you. Along with it we record which page the form was sent from and, if you arrived from one of our campaigns, which campaign. That tells us which material to send and which of our pages are useful.

Forms are relayed by Formspree, which delivers each submission to our inbox as an email and keeps a copy in our Formspree account. We use what you send to reply to you and to discuss the work you asked about. We do not add you to a mailing list and do not send you a newsletter. We do not sell, rent, or trade your address.

Scoping reviews are arranged by email. We do not use a third-party scheduling service.

Videos

Some pages offer a tool walkthrough hosted on YouTube. Nothing is requested from YouTube or Google until you press play. Until then the page shows a still image stored on our own server. If you do press play, the video loads from youtube-nocookie.com, and from that point YouTube's own privacy policy applies to that playback — it may set storage in your browser and will know that a video was watched. If you never press play, no request is made and nothing is set.

The free tools

None of the free tools asks you to sign in, and none of them sends what you type to us. They work in one of three ways.

Some run entirely in your browser against data that shipped with the page, and make no network request at all.

Some query public databases directly from your browser — for example FDA’s openFDA service (api.fda.gov), the NLM’s Global UDI Database, PubMed, or OpenAlex. Your query goes to that public service, not to us. Our analytics may record that a search happened and, at most, the FDA product code searched — never the text of a device or company search.

A few offer optional AI features that use your own API key. If you choose to enter a Google Gemini key, requests go from your browser directly to Google under your own account and Google’s terms. The key is kept in your browser and never sent to us.

Browser storage, not cookies. Several tools keep your answers, settings, or cached results in your browser’s session storage or local storage so a reload does not lose your work. That storage is readable only by this site, is never sent to us, and can be cleared from your browser settings at any time.

Our tools inside AI assistants

Some of the same tools are available to AI assistants such as ChatGPT and Claude as the app MedTech by 10xAnd, through a connector at 10xand.com/mcp. When you use them that way, the assistant sends your tool request to our server, which looks it up in the public database (for example openFDA) or in data that ships with this site, and returns the answer. Your assistant’s own provider sees your conversation under its terms, not ours.

What we receive: only the tool request the assistant writes, such as a product code, a 510(k) number, a device or company name, a UDI string, a part description or bill-of-materials lines. It carries no account, name or email address. Who else receives it: lookups against FDA data pass the search terms to the U.S. FDA’s public APIs (openFDA and GUDID); quotes and supplier searches run on our own server and go nowhere else. How long we keep it: we store none of it. Your controls: because nothing is stored, there is nothing to look up or delete; you can disconnect the app in your assistant’s settings at any time. Questions: [email protected].

Our server does not log the text of these requests and keeps no record of who made them. Answers from public databases may be held in our hosting provider’s cache for up to six hours so a repeated question is not sent again. Like any website, our hosting provider (Cloudflare) may process standard request data such as IP address for security and delivery. These tools only read public information; none of them sends email, uploads files, or contacts anyone.

If you attach a drawing or a bill of materials and ask for a budgetary quote, your assistant reads the file itself and sends us only what it read (process, material, quantity, tolerances, a short description, or the BOM lines) along with the file’s name and type. The assistant also passes a temporary link to the file; our server never opens that link, and nothing about the drawing is stored or logged. To get firm quotes under NDA, you send the drawing to us yourself through the request form on this site.

Ask Amp, the chat on this site

Ask Amp is the chat in the corner of this site. It answers from the same read-only tools as above: public FDA records and our budgetary Prototype Atlas model.

What is sent: when you send a message, your conversation so far (up to the last 20 messages) and the title and address of the page you are on go to our server. Who receives it: our server sends your latest message to TypeSafe (or, if TypeSafe is unavailable, to Cloudflare Workers AI) to sort what kind of question it is, and sends the conversation to Meta’s Model API to write the answer. Lookups pass search terms to the FDA’s public APIs, as above. While you type, after a short pause, the text in the box so far goes to TypeSafe to suggest a finished question. How long we keep it: we store none of it and log no message text. To limit how many long answers one visitor gets each day, we keep a count per visitor per day under a one-way, keyed hash of your IP address and the date. The address itself is never stored, the hash changes every day, and the counts are deleted after 90 days. The conversation is kept only in your browser’s session storage, so it follows you between pages and is gone when you close the tab; “New chat” clears it sooner.

For most questions we use the tier of Meta’s Model API under which, by Meta’s terms, prompts are not used to train its models. Questions about MAUDE adverse event reports are the exception: they are answered on Meta’s Contributor tier, under which Meta may use the conversation and the answer to improve its products. A message that looks like it contains confidential details is kept off that tier. TypeSafe states that it does not train on requests. Each provider still processes your text under its own terms. Please do not type confidential design details or anyone’s health information into the chat; for work under NDA, use the scoping review form. Our analytics count when the chat is opened, when a question is sent and which link is followed, never what was asked.

The component navigator

The navigator on our component pages currently runs entirely in your browser against data already on the page. Nothing you pick or type into it is sent anywhere. If that changes, this section will say so before it does.

Prototype Atlas requests and files

When you press Send request on the Prototype Atlas, your email, the description and settings are emailed to our sourcing desk (through Formspree) so we can reply, and shared with a supplier only to get your quote. A drawing or CAD file you attach is stored privately on Cloudflare R2. It can be opened only through a signed link that expires after 30 days, and it is deleted automatically 90 days after upload. Nothing you type or attach leaves your browser before you press Send request.

Processors

We share data only with the services required to run this site:

• Cloudflare — hosts and serves the site. Like any web host it processes technical request data (IP address, requested URL, browser type) to deliver pages and protect against abuse, under its own policy.
• Plausible Analytics — aggregate, cookieless site analytics.
• Cloudflare Web Analytics — a backup, cookieless count of page views and load speed.
• Formspree — relays form submissions to us as email.
• YouTube (Google) — video playback, only if you press play on a walkthrough.
• Meta (Model API) — writes the answers in the Ask Amp chat. Only if you use the chat.
• TypeSafe — sorts each Ask Amp message by topic before it is answered, and suggests a finished question while you type. Only if you use the chat.
• Cloudflare Workers AI — stands in for TypeSafe when it is unavailable.

Each of these processes data under its own privacy policy. Some are located in, or transfer data to, the United States.

Your rights

We rely on your request when we reply to a form you sent, and on our legitimate interest in running and improving the site for aggregate analytics. Wherever you are, you can ask us what we hold about you, ask us to correct or delete it, and object to how we use it. Where the GDPR applies you also have the right to data portability and to complain to your local supervisory authority. Where the CCPA or CPRA applies you have the right to know, to delete, and to opt out of sale — noting that we do not sell personal data.

To exercise any of these, send us a form starting “Privacy request”. We will respond within 30 days.

Retention

Form submissions are kept for as long as we are in conversation with you and for our ordinary business records afterward, and are deleted from our inbox and our Formspree account when you ask. Aggregate analytics contain no personal data and are retained indefinitely.

Children

This site sells engineering services to businesses. It is not directed to children, and we do not knowingly collect data from anyone under 16.

Changes

If this policy changes materially we will update the date at the top. Where a change affects how we use an email address we already hold, we will tell you by email rather than quietly amending this page.