Eight tools you can set up in an afternoon. Free or low cost, from named nonprofits and independently audited projects, chosen by patient advocates. A companion to the Light Collective Internet Safety Guide.
Support groups, diagnosis searches, and patient forums do not stay between people and their communities. Advertising trackers, social platforms, and even hospital and telehealth websites collect that activity and sell access to it. The Markup found the Meta Pixel on the websites of a third of the top 100 US hospitals, sending patient data to Facebook. GoodRx was fined $1.5 million by the FTC for sharing prescription information with Google and Facebook.
The Markup’s Blacklight tool has documented ad trackers, session recorders, and Meta and Google pixels embedded on hospital, telehealth, and patient advocacy websites. Data can leave before anyone hits “submit.”
Password reuse and unencrypted messaging mean one leaked login can expose years of private conversations, patient portal history, and community admin access. The EFF’s Surveillance Self-Defense guide walks through what actually helps.
Leaked health details can affect insurance, employment, immigration, family relationships, and access to care. Communities cannot organize freely when their conversations can be surveilled or sold. Read more in the Patient AI Rights Initiative.
The eight tools below are what patients and support communities can put in place today. No jargon. Free or low cost. Set up in an afternoon.
Work through the cards from 01 to 08. Each one takes fifteen minutes or less. Everything here comes from a named nonprofit, an independently audited project, or a research group with a public record. If you want the outside references first, Privacy Guides and the EFF Surveillance Self-Defense guides are where we cross-check our picks.
Free messaging run by a nonprofit foundation. End-to-end encryption means the messages are readable only on the sending and receiving devices. Not even Signal can see them. Works for one-on-one and group chats, with disappearing messages when you want them. Invite your inner circle first, then your community. EFF’s how-to guide walks through setup.
Firefox comes from Mozilla, which is backed by a nonprofit foundation. It blocks many known trackers by default through Enhanced Tracking Protection. Using a browser that is not made by an advertising company is a strong first switch. Pick either Firefox or Brave. You do not need both.
Brave blocks more by default than most browsers, including many ads and cross-site trackers, without changing settings. If you want the strongest out-of-the-box protection, use Brave. The company is not funded by advertising, and its privacy notice is unusually direct.
A free browser extension from the Electronic Frontier Foundation. Instead of relying on a fixed blocklist, it watches which companies track you across sites and blocks them automatically. One-click install for Firefox, Chrome, Edge, and Brave.
DuckDuckGo does not save or profile your searches. Health questions you type into a search engine should not follow you around the internet as ads. Set it as your default search engine, or install the app for a single-tap browser with tracking protection built in.
A free real-time inspector from The Markup, a nonprofit newsroom. Paste any website address and it scans for ad trackers, third-party cookies, session recorders, and pixels reporting to Facebook and Google. Run it on a health site before you sign up. Then run it on your own community site.
A password manager creates and remembers a strong, unique password for every account, so one leaked password cannot unlock the rest of your life. Bitwarden is free, open source, and independently audited. 1Password is a well-regarded paid alternative. Either way, turn on multi-factor authentication for email, banking, and community admin accounts. EFF’s password guide explains why.
A VPN, or virtual private network, hides what you do online from the network you are on (hotel, airport, clinic) and from your internet provider. Know its limits. A VPN does not make you anonymous, and it does not block trackers on its own. Skip free VPNs, which often make money by selling the data you are trying to protect. The three below are recommended by Privacy Guides, publish independent audits, and keep no activity logs.
We pick tools with public accountability. The Light Collective has no financial relationship with any product on this list. We cross-check our picks against Privacy Guides, EFF Surveillance Self-Defense, and Consumer Reports’ Digital Lab.
Signal Foundation, Mozilla, the Electronic Frontier Foundation, and The Markup all run tools on this list. None of them make money by profiling you.
Bitwarden, Proton, Mullvad, and IVPN publish outside security audits and keep no activity logs. The results are public.
Every recommendation was reviewed by advocates and community leaders in the Light Collective network. If a tool changes ownership, gets acquired, or stops publishing audits, we drop it. Send suggestions to hello@lightcollective.org.
Patient communities are welcome to adapt and share this resource with attribution. Pair it with the Internet Safety Guide, run it inside a bootcamp, or send it to the next advocate learning how to organize online. Read more of our work on our roadmap.
Prepared by The Light Collective. Facts checked and updated in July 2026. Patient communities are welcome to adapt and share this resource with attribution. The Light Collective has no financial relationship with any tool listed here. This resource is educational and is not legal advice.
© 2026 Light Collective.
