A lab, not a brochure.
Medical Affairs talks a lot about digital transformation and ships very little of it. mafflab exists to close that gap the only way that works: by building small things, in public, and letting people try them.
The manifesto
Show, don't tell. Every idea here is either a working tool you can open in your browser, or a note on the board waiting for one. Slides don't count.
Small beats big. A micro-tool that saves an MSL one hour a week is worth more than a platform that launches next year. Each tool does one job well and installs on its own.
Open by default. Every tool ships with its source code, its reasoning and its known limits, under MIT for code and CC BY 4.0 for content. Copy it, adapt it, take it inside your company.
Privacy is the architecture, not a policy. No accounts, no cookies, no analytics, no ads. Anonymous by design, so there is nothing to leak, sell or subpoena.
Compliance-aware, not compliance-paralysed. Every blueprint names the MLR questions up front. Prototypes are proofs of concept and never replace your internal review.
The privacy ledger
Everything this site keeps, why, and for how long. If it isn't in this table, it isn't stored.
| Data | What is kept | Where and how long |
|---|---|---|
| Cookies | None. Not for sessions, not for preferences, not for analytics. | Nowhere. |
| Analytics and ads | None. No pixels, tag managers, fingerprinting or third-party scripts. | Nowhere. |
| Your IP address | Never stored. To stop spam, a keyed hash of it is counted for 10 minutes. The key rotates every day and is then destroyed, so old hashes can't be reversed. | Server memory when the host supports it, otherwise a short-lived database row. Gone within 10 minutes. |
| Notes and sketches | The text or drawing, its colour and position, and the alias shown on it. | Public on the board until someone erases it. |
| Comments | The text and the nickname or alias shown on it. | Public on the project page until removed. |
| Likes and votes | A counter per tool or note. Your own like state stays in your browser's local storage, which never leaves your device. | Counters on the server; your state on your device. Clear it any time. |
| Your session alias | A random name like Anon_MSL, generated in your browser. | Your browser's session storage, gone when you close the tab. |
| Contact | Nothing. Submissions and ideas go through LinkedIn messages, outside this site. | On LinkedIn, under LinkedIn's own privacy policy. |
| Hosting logs | The hosting provider may keep standard access logs, outside this site's code. | Kept to the minimum the host allows. |
Don't trust us. Verify.
The panel on the right is measured live in your browser from this page's own performance data: every request it made, every cookie it can see, every key it keeps on your device.
To check by hand, open your browser's developer tools. The Network tab will show requests only to this domain. The Application tab will show no cookies. Every page also carries a Content Security Policy that tells the browser to refuse connections to any other host.
House rules
- Be specific and kind. Critique tools, not people.
- No patient data, no confidential company information, no promotion. This is a public board.
- Anyone can erase anything on the board. Erase spam, not opinions. Erasing can be undone for five minutes.
- Notes are capped at 140 characters. Links are switched off on notes and comments.
- A basic profanity filter and rate limits run on the server. Comments reported three times are hidden automatically.