Privacy Policy

#0. Privacy at a Glance

The full text follows below, but here are the essentials:

What we don't do: we don't sell your data, don't share it with pharmaceutical companies or research institutes, don't build aggregated data products from it, don't show ads, don't profile you, and don't make automated decisions about you. Details in Section 2.6.

#1. Data Controller

The controller of your personal data is:

INITAR IT
ul. Mieczyslawa Karlowicza 13/5
40-145 Katowice
e-mail: initar-it@outlook.com

We have not appointed a formal Data Protection Officer (DPO). For any questions about how we process your data, contact us at the address above. As the service grows, we may appoint a DPO and will update this document accordingly.

#2. What Data We Collect

#2.1 Account Data (Google Sign-In)

You can only sign in via Google Sign-In. We receive and store exactly the following fields from your Google account:

• email address,
• display name (as set in your Google profile),
• profile picture URL,
• your Google account identifier (the sub claim) — used solely as described in Section 8.

We never have access to your Google password or any other Google account data beyond what's listed above.

#2.2 Health Data

By its nature, the app processes health data within the meaning of Article 9 GDPR (special category of personal data):

• the names of medications you take, dosage, and dose units,
• your reminder schedule (times, days of the week),
• your intake history: when a dose was scheduled, and whether/when it was marked as taken, skipped, or snoozed.

When you snooze a dose, we additionally store a short note about when it was postponed to. If you use the "when I get home" or "when I get to work" option, we store the value HOME or WORK respectively — this is a text label only and contains no geographic coordinates, but it is an indirect signal about your daily context, which is why we list it explicitly here.

All of the above data, including your complete intake history, is synced to our server (see Section 5) so that it survives changing or losing your device.

This data is processed solely on the basis of your explicit consent (Article 9(2)(a) GDPR). You give that consent by entering your medication details into the app yourself — a voluntary act unambiguously tied to the app's only purpose, which is reminding you to take them. The app obtains this data from no other source.

We plan a dedicated consent screen that will make this moment more explicit and let us record the date and version of the documents you accepted. Until it ships, the basis remains the voluntary entry of data described above; we will update this document when the screen arrives.

You can withdraw consent at any time by deleting your account (see Section 8) — withdrawal does not affect the lawfulness of processing carried out before it.

#2.3 Location Data

The app lets you save two named reference points ("Home", "Work") with geographic coordinates. This section describes in detail what happens when you do — including what happens outside our own infrastructure.

What we store: only two pairs of coordinates, saved locally on your device. They are never transmitted to our servers or synced across devices. You can change or delete them at any time in the app's settings.

What goes to Google. The place-picker screen uses Google's maps and location services. This means:

• the map — displaying the map fetches map tiles from Google's servers, along with information about which area you are viewing,
• address search — if you type a place name or address into the search field, the text you type is sent to a geocoding service (on devices with Google services, this is Google's service) in order to convert it into coordinates,
• converting coordinates to an address — the point you select is sent to the same service so we can show you a readable street name instead of numbers,
• your current position — the first time you open the place picker, if you have no location saved yet, the app reads your device's last known position in order to center the map on it. This is a one-off read at your request.

These operations are governed by Google's privacy policy, not ours. If you'd rather they didn't happen, simply don't use the "Home" and "Work" feature — it is not required for reminders to work.

What this data is used for. To display the saved place on a map in the settings, and for the arrival-triggered reminders described below.

Arrival reminders — when we check your location. If you snooze a reminder with "when I get home" or "when I get to work", the app asks Android to notify it when you come within 150 metres of the saved point (the geofencing mechanism in Google Play Services). The following rules apply:

• Monitoring is switched on only while a specific dose is waiting. It starts when you defer that dose to a place and ends automatically once you mark the dose, or once the fallback time passes. Outside that window the app does not ask for your location at all.
• We do not record where you are or where you have been. The system tells the app only that "the user is near the saved point". We do not receive your coordinates, we build no movement history, and none of this leaves your device — the reminder is shown locally.
• It requires a separate system permission for "all the time" (background) location access. We ask for it only after explaining what it is for, in Settings → My locations. You can revoke it at any time in Android settings.
• Refusing the permission does not cost you the reminder. Every "home"/"work" snooze also arms an ordinary alarm at a fallback time (4 hours by default, configurable in Settings → Notifications). Without the location permission that alarm alone does the job. Geofencing is a convenience, never the only route to a medication reminder.

#2.4 Trial and Subscription Data

We store the status of your 14-day free trial and — once billing is implemented — your subscription status (active/expired/renewing). Payments are handled entirely by Google Play; we never store or process your payment card data — that data goes directly to Google.

#2.5 Data Processed Incidentally

For full transparency, we also list data we do not collect deliberately but which arises technically from how the app works:

• Your profile picture is fetched directly from Google's servers (googleusercontent.com) each time it is displayed. This means your device's IP address is visible to Google at that moment. We do not store the image itself — only a link to it.
• Server logs. The server functions responsible for sign-in and account deletion write a user identifier and a partially masked email address (in the form j***n@gmail.com) to technical logs. This serves error diagnostics only. Logs are subject to our infrastructure provider's retention period (see Section 6).
• IP address is visible to our infrastructure provider on every connection to the server — an inherent property of network communication. We do not build any profiles or statistics from it.

#2.6 Data We Do NOT Collect, and Our No-Monetization Commitment

The app does not collect:

• advertising identifiers or IMEI. Crash reporting uses its own random installation identifier, which we never link to your account — see below,
• data from analytics, statistics, or advertising tools — the app contains no analytics or advertising SDK; there is no Google Analytics, Firebase Analytics, or any equivalent in the code. It does contain a crash-reporting tool, described in detail below,
• data from server-sent push notifications — all reminders are generated locally on your device (via the system AlarmManager); our server never initiates a notification and does not know whether or when one was displayed,
• your weight, height, diagnoses, doctor, pharmacy, or insurer — the app has no fields for such information.

Furthermore, we commit that we:

• do not sell or rent your data to anyone,
• do not share it with pharmaceutical companies, research institutes, insurers, data brokers, or advertising networks,
• do not build aggregated or anonymized data products from it for resale or for sharing with commercial partners,
• do not run marketing based on your health data and do not use that data to target any promotional content.

This is a contractual commitment arising from this policy, not merely a statement of intent. Should we ever decide to introduce analytics tools, we will update this policy before deploying them and notify you in the app.

#2.7 Crash Reporting (Firebase Crashlytics)

The app includes Firebase Crashlytics, a Google tool used solely to detect crashes. In an app whose job is to remind you to take a medication, a crash means a missed dose — which is why we consider knowing about crashes relevant to your safety.

What we send when the app crashes:

• the stack trace — a technical description of where in the code the error occurred,
• your device model, Android version, and app version,
• memory state and whether the app was in the background,
• a random installation identifier assigned by Crashlytics.

What we deliberately do NOT send — and why this is more than a promise:

• no health data whatsoever — no medication names, doses, times, or intake history,
• no content from our own diagnostic messages. This needs explaining: our internal logs do contain medication names, because they exist to diagnose reminders. A standard Crashlytics integration would attach them to the crash report. We deliberately do not — only the exception itself reaches Crashlytics. This is enforced by the CrashReportingTree class in the app's source, not by a setting that could be changed by accident,
• no user identifier or email address — we never call setUserId, so a crash report cannot be tied back to your medical account.

Recipient and processing location. Google acts here as a processor under the Firebase data processing terms. Crash report data may be processed outside the EEA, relying on Google's compliance mechanisms. Crashlytics retains reports for 90 days.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in keeping the app stable. Because the reports contain no health data, Art. 9 GDPR does not apply to them.

#3. Legal Bases for Processing

#4. App Permissions

Below is the full list of permissions the app requests, with their purpose. Permissions marked as unused are not used by any feature — they are leftovers from earlier development stages and will be removed.

#5. Where We Store Data and Who We Share It With

#5.1 Storage Location

Synced data — your account, medications, and complete intake history — is stored in a Supabase database, in a data center located in Frankfurt am Main (Germany, European Union). The data stays within the European Economic Area and is not transferred outside the EEA by us.

Stored only locally on your device: the "Home" and "Work" coordinates, notification settings, and a cached copy of your subscription status. Note, however, Section 5.3 — the notification settings and the "Home"/"Work" coordinates do end up in a Google backup.

#5.2 Processors and Recipients

• Supabase — provider of database and authentication infrastructure; acts as a processor on our behalf under a data processing agreement.
• Google LLC — as a processor for crash reporting (Firebase Crashlytics, Section 2.7), under the Firebase data processing terms.
• Google LLC — as an independent controller for: Google Sign-In, eventually Google Play payments, maps and geocoding (Section 2.3), and serving your profile picture (Section 2.5). Google processes this data under its own privacy policy and may process it on servers outside the EEA, relying on its own compliance mechanisms (standard contractual clauses / adequacy decisions).

We do not sell, rent, or share your data with any advertising or analytics companies or any other third parties beyond the providers listed above that are necessary to operate the service — consistent with the commitment in Section 2.6.

#5.3 Android System Backup

The app uses the Android system backup mechanism (Android Auto Backup), but the local database holding medication names, doses and intake history is excluded from it. Your health data therefore goes neither into the backup on your Google Drive nor into the direct device-to-device transfer performed when setting up a new phone. Once you sign in on the new device, it is fetched from our server (Section 5.1).

What the backup does include are the app settings stored locally: notification settings and the saved "Home" and "Work" coordinates (Section 2.3). This means you do not have to configure the app again after switching devices.

This is a standard Android system mechanism, and the backup goes to your Google account, not to us — we have no access to it. It is governed by Google's privacy policy and by your device's backup settings.

If you do not want those settings included in the backup either, you can disable it in Android system settings (typically Settings → Google → Backup, or Settings → System → Backup) — for the whole device or for this app alone, depending on your Android version and manufacturer.

#5.4 Family Sharing (Planned)

We plan to introduce an optional feature allowing you to share your medication data with a person of your choosing (e.g. a caregiver). This feature is not yet available. When we implement it, we will update this policy and describe the sharing rules in detail; such sharing will always require your explicit, separate consent.

#6. Data Retention

• Active account data — for as long as you use the app, until you delete your account. We do not apply a predetermined multi-year retention period: while you use the service, the data is needed to deliver it; when you delete your account, it goes away.
• After account deletion — medication data, intake history, profile data, and your sign-in account are deleted immediately from production systems (see Section 8). There is no grace period during which an account could be restored.
• Database backups — our infrastructure provider takes daily backups, retained for 7 days. This means that after you delete your account, your data may remain in a backup for up to 7 more days before it is automatically overwritten. Backups serve solely to restore the service after a failure — we never use them to reinstate a deleted account. (The Android system backup on your own Google account, described in Section 5.3, is a different thing and remains under your control.)
• Technical logs (Section 2.5) — retained for 7 days, then deleted automatically.
• The pseudonymized technical record described in Section 8 — indefinitely, solely to prevent abuse.

#7. Your Rights

Under the GDPR you have the following rights:

• Right of access to your data,
• Right to rectification of inaccurate data — available directly in the app (editing medications, profile),
• Right to erasure ("right to be forgotten") — see Section 8,
• Right to restriction of processing,
• Right to data portability — on request sent to our contact address we will provide a copy of all your data in a structured, commonly used, machine-readable format (JSON), within the timeframe stated below. Export directly from the app is in preparation and will appear under Settings → Privacy,
• Right to object to processing based on legitimate interest,
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal,
• Right to lodge a complaint with a supervisory authority — in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw.

To exercise these rights, contact us at the address given in Section 1. We respond without undue delay and at the latest within one month of receiving your request (Art. 12(3) GDPR). In particularly complex cases this period may be extended by a further two months — we will inform you of the extension and its reasons within the first month.

#8. Account Deletion

Account deletion is available directly in the app (Settings → Delete account) and requires confirmation.

What we delete. Your profile data, medication list, and complete intake history, along with your sign-in account. Deletion cascades at the database level, meaning that deleting your account automatically and irreversibly removes every associated medication and intake record. Your session ends immediately, and local data on the device (including the "Home" and "Work" coordinates and notification settings) is cleared.

One exception: for up to 7 days your data may still exist in a routine database backup before it is overwritten — see Section 6.

What we retain. Indefinitely, and solely to prevent abuse through repeated account creation aimed at obtaining another free trial, we retain the following set of data in pseudonymized form:

• a one-way cryptographic hash (SHA-256 with a salt) of your Google account identifier — irreversible; it does not allow anyone to establish your identity or link back to your Google account without access to our secret key,
• a technical marker of how the account was deleted (currently always "deleted at the user's request"),
• the account deletion date,
• the trial start date and whether the trial was used,
• whether an active subscription existed at the time of deletion, and which provider it came from,
• the account's age in days (from creation to deletion).

This set does not contain your email, name, profile picture, medication list, or intake history — those are deleted irreversibly.

The legal basis for retaining this record is our legitimate interest (Art. 6(1)(f) GDPR) in protecting the trial model against abuse. The hash still constitutes personal data under the GDPR (pseudonymized, not anonymized) — you have the right to object to this processing, provided you demonstrate grounds relating to your particular situation.

#9. Data Security

We apply the following technical and organizational measures:

• Encryption in transit — all communication between the app and the server uses HTTPS/TLS.
• Encryption at rest at our provider's infrastructure level (storage-level encryption in the data center).
• Row-level data isolation (Row Level Security) — server-side rules make it impossible to read another user's data even if the app itself has a bug.
• Authentication secrets kept outside the source code and outside the repository.
• No diagnostic logging in production builds of the app — technical logs are active only in development builds.
• Server-side identity verification on every operation performed by our server functions.

In the interest of honesty, we also state the limitations of these measures:

• Data in the database is not additionally encrypted at the individual column level or end-to-end. This means that, as the controller, we have the technical ability to access your data — we use it only where strictly necessary to resolve a fault or handle your support request.
• The local database on your device is not additionally encrypted by the app. Its protection relies on Android's app sandboxing and on your device's storage encryption — we recommend using a screen lock.
• We hold no formal security or compliance certifications (such as ISO 27001, SOC 2, or HIPAA) and do not claim to hold any.

No system is 100% secure — in the event of a personal data breach likely to result in a high risk to your rights, we will notify you as required by the GDPR (Art. 33–34).

#10. No Profiling or Automated Decision-Making

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

The app does not analyze your health data to draw conclusions about your medical condition, does not score your "medication adherence" in any way that carries consequences, and does not use artificial intelligence to process your data. Reminders are triggered solely by the schedule you enter yourself.

#11. Cookies, Tracking, and External Links

The MedsReminder mobile app uses no cookies and no tracking technologies whatsoever. We use no advertising identifiers, tracking pixels, or device fingerprinting.

If you visit a website hosting this policy (outside the app), it may be subject to separate, limited rules arising from the hosting technology — but we use no cookies for tracking or profiling purposes.

The app and website may contain links to external resources (e.g. the Google Play Store, Google help pages). We are not responsible for the privacy practices of third parties — once you follow such a link, that site's own privacy policy applies. We encourage you to read it.

We do not respond to browsers' "Do Not Track" signal, because we carry out no tracking that such a signal could affect.

#12. Children

The service is not directed at individuals under 16 years of age. People under 16 may use the app only through an account created and managed by a parent or legal guardian, who consents to the processing of data on their behalf and is responsible for the use of the service.

For transparency: we do not perform any technical age verification — we do not ask for a date of birth and do not check a user's age in any other way. We rely on the declaration made by the user when accepting the Terms of Service.

If you are a parent or guardian and believe your child under 16 has provided us with personal data without your consent, contact us — we will delete such data promptly.

#13. Changes to This Policy

We may update this privacy policy from time to time, particularly in connection with new app features (e.g. family sharing, diagnostic tooling, payments).

We will notify you in the app at least 14 days in advance of any material change taking effect. If a change affects the processing of health data beyond the scope of your existing consent, we will ask you for new, separate consent — continued use of the app alone will not suffice in that case.

The last-updated date and version number appear at the top of this document. Previous versions are available on request.

#14. Controlling Version

This document was prepared in Polish and English. In case of any discrepancy, the Polish version prevails, unless mandatory provisions of the law applicable in your place of residence require otherwise.

#15. Contact

For any matters concerning the protection of personal data, contact us at:

initar-it@outlook.com