Privacy Policy

Last updated: 11 October 2026. Incorporated by reference into the Terms of Service and the Legal Disclaimer.

1. Who we are

ChronoPill is published by ChronoPill, an individual developer established in France, who is the data controller. For any privacy-related question or data-rights request, write to dpo@chronopill.com.

2. What data we collect and where it lives

2.1 On your device

Your medication data is stored locally on your device (iPhone, iPad or Android phone). It is sent to a server only through the online features described in Section 2.2, when you use them. ChronoPill does not sync your data between devices: an iPhone and an iPad each keep their own list. Data stored on the device includes:

• Medication names, dosages, schedules, and reminders
• Adherence history (doses taken, skipped, or missed)
• Family member profiles you create
• Optional profile details you choose to enter (for example height and weight)
• Side effect logs and symptom notes
• Dose notes you write, and how each dose was recorded (for example from a notification or entered later)
• Status days you set (Away or Doses given by others, with their dates)
• The medications whose reminders you pause during a status
• Visits you add (date, doctor, reason, place, reminder and your questions)
• The date you last confirmed each medication's stock count
• Legal disclaimer acceptance and app preferences

Storage technology: Apple SwiftData (a managed CoreData store) inside the app's iOS sandbox, encrypted at rest by iOS and excluded from iCloud and device backups. Sensitive tokens (if any) are stored in the iOS Keychain.

On Android: a Room database inside the app's private storage, excluded from Android and Google device backups. Session tokens are encrypted with the Android Keystore.

Encrypted backup file. You can create a backup file of your data in Settings > Backup. It contains the data you entered in the app (medications, dose history, prescriptions, side effects, health profile, family members, contacts, doctors, pharmacies and appointments), is created only when you ask, and is encrypted on your device with a password you choose (AES-256-GCM) before you decide where to save it (for example Files, iCloud Drive or Google Drive). ChronoPill never uploads this file and cannot open it or recover a forgotten password. Storing it in a third-party cloud drive is your own choice and is governed by that provider's terms. Restoring a file replaces the data on the device only after you confirm, and a safety copy of the previous data is kept so that the restore can be undone.

2.2 Online features (only when you use them)

Barcode lookups, drug sheets and same-substance lists abroad are read from the country packs stored on your device: no lookup is sent to a server.

Nothing is sent before you tap the Key points (AI) button. You can withdraw this consent at any time in Settings; after that, no leaflet text is sent. Box photos are sent only when you take them in the box identification camera.

When you save a medication identified from box photos, the photos are kept on your device only, with their metadata removed; they are not uploaded.

Each optional feature can be turned off at any time in Settings. Disabling it prevents any further outbound requests of that kind.

AI key points (optional)

Key points (AI) summaries are generated only when you tap the button, after a one-time consent screen. The request contains the official text of the section on screen, the product name, the country and the reading level. It contains no installation ID, no medication list and no health profile; limits against abuse use a one-way hash of your IP address. The standard level sends no account information. For the premium and professional levels, the request also carries a proof of purchase (Apple's signed transaction or the Google Play purchase token) and, if you are signed in, your sign-in token, only to check the subscription (see Section 4).

Recipients: the ChronoPill backend (AWS Lambda, us-east-1), then AI models run by Amazon Bedrock (AWS, in the United States: us-east-1, us-east-2 or us-west-2), which draft the summary (GLM-5, OpenAI gpt-oss-120b or Kimi K3, with Amazon Nova as a last resort). Kimi K3 on Amazon Bedrock then checks the summary against the official text. These models run in accounts operated by AWS: their makers (Z.ai, OpenAI, Moonshot AI) have no access to the text or to the summary. The product name stays on the ChronoPill backend and is not passed to any model. Amazon Bedrock does not store the text and does not use it to train models.

Verified summaries are cached on our servers, keyed only by a hash of the official text, the section and the reading level, never by user. Transfers to the USA rely on the EU Standard Contractual Clauses. Legal basis: your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time in Settings > Privacy.

Usage analytics (optional, off by default)

On iPhone, you can allow usage analytics in Settings > Privacy. It stays off until you turn it on, and the analytics SDK (Google Analytics for Firebase) is not started before that. Events sent by ChronoPill: onboarding steps completed, medication added (entry method only, never the medication name) and paywall shown. The SDK also records events on its own (first open, sessions, screens viewed) and sends with them the app instance ID it creates, the identifier for vendor (IDFV), the device model and the system and app version; Google derives an approximate location (country and city) from your IP address. ChronoPill never sends your account ID to Google Analytics, and dose, side-effect and interaction events are never sent. No advertising identifier is collected. Legal basis: your consent, which you can withdraw at any time with the same switch. The Android app contains no analytics SDK.

Caregiver dashboard (optional, iPhone, Pro)

Your medication list (name, dose, unit, times and stock), today's doses, the names and relationships of family members and the low-stock list are encrypted on your iPhone (AES-256-GCM) before they are sent. For a share created with the current version of the app, the key comes from a secret created on your iPhone that is only in the link you give your caregiver, after the # sign, which browsers never send to a server: our server cannot decrypt the dashboard. A share created with an earlier version uses a key derived from the share code, which our server also receives, so anyone who holds that code, our server included, can read it; the app offers to replace such a share with a new code.

The number of doses taken and planned today, the percentage and the last sync time are stored unencrypted so that the dashboard can show a summary. Each request also carries your installation ID, an App Attest check and, to check the Pro subscription, Apple's signed transaction and, if you are signed in, your sign-in token. None of them is stored with the share: our server does not record which account a share belongs to.

Deleting your account in the app on the iPhone that shares the dashboard (ChronoPill 1.5.2 or later) also deletes the caregiver share. If you delete your account another way, tap Revoke access in the caregiver dashboard screen first; otherwise the share is deleted when the access time you chose ends, and at the latest 30 days after the last sync.

2.3 Apple Health (optional, iPhone)

If you grant access, ChronoPill reads your date of birth, sex, height and weight from Apple Health to fill your optional profile, and refreshes them each time you open it. On iPhone, if you turn on Import my medications, ChronoPill also reads the medications you choose to share in Apple Health and the doses and reminders recorded there, to show them in ChronoPill. ChronoPill never writes anything to Apple Health. The Android app does not connect to Health Connect. You can revoke access at any time in iOS Settings > Privacy & Security > Health > ChronoPill. This health data never leaves your device through ChronoPill.

2.4 Optional account (email + password or Sign in with Apple)

An account is not required to use ChronoPill: you can install the app and manage medications without ever signing in. If you choose to create an account (to back up your Premium entitlement or contact support; your medication data is never synced through your account), the following is collected and stored on our backend (AWS Lambda and DynamoDB in the United States, us-east-1):

• Email address (or the relay address Apple provides if you choose Hide My Email with Sign in with Apple).
• Password hash (salted PBKDF2-SHA256; your password is sent over an encrypted connection and never stored in plain text).
• Name (only if you provide one, or if Apple shares it the first time you use Sign in with Apple; not required).
• Internal user ID (a random UUID we issue). When you buy on iPhone while signed in, it is attached to the App Store purchase (as the app account token) so that the purchase can be matched to your account.
• Apple user identifier (only with Sign in with Apple): the identifier Apple gives ChronoPill for your Apple Account, stored on your account record so that Apple can sign you in again.
• Subscription entitlement state (product, level, expiry date and whether it is still active), tied to the App Store transaction ID or to a one-way hash of the Google Play purchase token; we never see card, Apple ID or Google account payment data.
• Promo codes you redeem on chronopill.com: the code is recorded on your account record and keeps your internal user ID until you delete your account; the code then stays marked as used, without your ID.

Verification codes and password-reset emails are sent to your address through Amazon Simple Email Service (AWS, us-east-1).

This information is linked to your account record. We use it solely for: signing you in, restoring your purchase across reinstalls, replying to support requests, and processing privacy-rights requests. We do not use it for advertising, profiling, or any third-party disclosure. Account data is encrypted at rest by AWS and in transit (HTTPS, TLS 1.2 or higher).

You can delete your account at any time from Settings > Account > Delete Account inside the app (see Section 5.4 below). Doing so erases the account record on our backend and wipes all local data on the device.

2.5 Siri and Shortcuts (iPhone, optional)

If you use a ChronoPill phrase with Siri or run a ChronoPill shortcut, Apple handles the request under Apple's own privacy policy, and Siri may process it on Apple's servers. When you log a dose, Apple passes ChronoPill the medication name it recognized; ChronoPill looks it up in the data stored on your iPhone and records the dose there. Nothing about the request is sent to the ChronoPill server. Because Siri may speak or show medication names, ChronoPill asks for your iPhone to be unlocked first.

Siri and Shortcuts can also skip or snooze a dose, and tell the next dose time, the doses left today, the units left from the stock you entered and when a dose was last recorded. These actions read and write the data on your iPhone only, and each one asks for your iPhone to be unlocked first. ChronoPill does not share your doses with Siri Suggestions and does not add them to Spotlight search.

On Android, the app icon shortcuts (Log next dose, Today, Scan a barcode) work on the data on your phone. Scan a barcode looks up the code only in the offline country packs on your phone.

2.6 Reminder health and Discreet mode

Reminder health reads, on your phone, the settings that can affect reminders (for example notification permissions, Do Not Disturb, battery and background settings). These readings stay on the phone and are never sent. A test reminder contains no medication name and records nothing.

Discreet mode hides medication and person names on the lock screen and in notifications, and on iPhone also in widgets, the Live Activity and on Apple Watch. It is on by default for new installs. The setting is stored on your device and is never sent to analytics.

2.7 Status days, dose notes and visits

Status days, dose notes, the way each dose was recorded, visits and the date you last confirmed a stock count are stored on your device only. They are included in your encrypted backup file and in the data export you create in Settings, which tells you that it contains your notes and status days. They are never sent to analytics and never included in the caregiver dashboard.

Your dose notes are added to a Doctor Report only when you turn on Include my notes. A visit reminder only says Visit reminder and You have a visit soon: it never shows the doctor or your medications.

Add to Calendar hands the date, doctor, place and reason of a visit to your calendar app, which saves the event only when you confirm it there. ChronoPill never reads your calendar and asks for no calendar permission.

When you pause reminders during a status, the medications you picked are stored with the status on your device and are part of your encrypted backup file. The notice sent when reminders come back contains no name.

Check-ins are planned on your device. The morning plan shows only the number of doses and the first and last time, never a medication name, and the evening and weekly check-ins use fixed texts. The calm mode setting (Show progress numbers) is stored on each device. None of these settings is sent to analytics.

3. What we do NOT collect

• No advertising identifier (IDFA).
• No usage analytics unless you opt in (Section 2.2), and no crash reporting to third parties.
• No social media tracking pixels.
• No location tracking: your position is read only while you use the app and only if you allow it, to pick your country's database, for Travel and Fasting Modes, for the address on the Emergency Card PDF you create and to show nearby pharmacies; it is never sent to ChronoPill.
• No payment card or billing data: Apple (App Store) and Google (Google Play) handle all transactions.

4. In-app purchases

Subscription and purchase transactions are handled directly by Apple (App Store) or Google (Google Play). ChronoPill never sees your credit card number, billing address, Apple ID or Google account password.

For paid features (premium Key points levels, box photo recognition and the caregiver dashboard), the app sends Apple's signed transaction (or, on Android, the Google Play purchase token) and, if you are signed in, your sign-in token to our server only to check the entitlement. These proofs are not stored, and our server logs are designed not to contain them. When you are signed in, your purchases are also registered with your account (Section 2.4) until you delete it. Refund, revocation and expiry notices from Apple are kept for 400 days as a list of transaction IDs with the product, the type of notice, the store environment (test or production) and the dates, without your name, email address or account ID.

See Apple's privacy policy.

On Android, see Google's privacy policy.

5. Your rights

Because the app stores data locally by default, you exercise most rights directly on your device:

• Access: all your data is visible inside the app. Export it as a PDF report (Settings > Export).
• Deletion (local data): uninstalling the app deletes all local data. iOS then wipes the sandbox immediately. In-app: Settings > Data & Privacy > Clear All Data.
• Account deletion (server data, if you created an account): Settings > Account > Delete Account permanently erases your account record on our backend and wipes all local data on the device. See Section 5.4.
• Rectification: edit or delete any medication record in the app.
• Objection: disable optional cloud features in Settings at any time.
• Withdrawing consent: turn off Key points (AI) or usage analytics in Settings > Privacy at any time.
• Complaint: you may lodge a complaint with your local data protection authority (the CNIL in France, ChronoPill's lead authority; other EU/EEA DPAs; CNDP in Morocco; your State Attorney General in the US; the Personal Information Protection Commission in Japan; the Office of the Privacy Commissioner of Canada).

5.1 European Union & United Kingdom (GDPR / UK GDPR)

EU/UK residents have the rights of Access, Rectification, Erasure, Restriction, Portability, Objection, and the right not to be subject to automated decision-making with legal effects. International transfers to AWS US East (N. Virginia) rely on Standard Contractual Clauses (see Section 8). Data controller: ChronoPill, an individual developer established in France; lead supervisory authority: the CNIL.

5.2 United States - State Privacy Rights

ChronoPill honors the rights below for all US users, regardless of state of residency, because the underlying data-minimisation choices are the same across jurisdictions: almost all data stays on your device, we do not sell it, we do not share it for advertising, and we do not profile you for automated decisions with legal effects.

5.3 How to exercise your rights

• In the app (fastest - no identity verification needed since data is local): Settings → Data & Privacy → Export Data / Clear All Data, or Settings → Account → Delete Account for the server-side account record.
• Email: contact@chronopill.com with subject "US Privacy Request - [Know / Delete / Correct / Portability / Appeal]" and your state of residence.
• Response time: receipt confirmed within 10 business days, substantive response within 45 days (extendable once by 45 days under CCPA §1798.130(a)(2)). VA, CO, CT, UT, OR, MT, TX deadlines honored per their statutes.
• Authorized agents may submit requests on your behalf under CCPA §1798.135; we verify the agent's authorization and your identity before acting.

5.4 Account deletion (Apple App Store Guideline 5.1.1(v) and Google Play policy)

If you have created an account inside ChronoPill (email + password or Sign in with Apple), you can permanently delete it directly inside the app, without having to email us, write a letter, or visit a website. The deletion path is the same on iPhone and Android:

Settings → Account → Delete Account → confirm in the dialog

When you confirm, ChronoPill:

• Calls our backend to permanently erase your account record (email, password hash, name, internal user ID, Apple user identifier) and the purchases registered with it from our live systems at once (copies in our database backups are gone within 35 days), and removes your internal user ID from any promo code you redeemed (the code stays marked as used).
• Cancels all scheduled local notifications.
• Wipes all locally stored data (medications, schedules, dose history, Health Profile, family profiles, app preferences) from your device.
• Removes any tokens or credentials stored in the iOS Keychain or the Android Keystore.
• Returns the app to its first-launch state.

Caregiver dashboard. When you delete your account in the app on the iPhone that shares the dashboard (ChronoPill 1.5.2 or later), the app sends the share code with the request and the share is deleted at once. Our server does not record which account a share belongs to: if you delete your account another way, tap Revoke access in the caregiver dashboard screen first; otherwise it is deleted when the access time you chose ends, and at the latest 30 days after the last sync.

Support requests. They are kept apart from your account and deleted automatically 24 months after they are written. To have them deleted sooner, email contact@chronopill.com.

On Android, a Google Play subscription is not cancelled either: cancel it in Google Play under Payments and subscriptions.

Apple subscriptions are billed by Apple, not by us. Deleting your account does not cancel an active App Store subscription. To stop a recurring charge, also cancel the subscription in iOS Settings > Apple ID > Subscriptions > ChronoPill. Refund requests must be filed with Apple at reportaproblem.apple.com.

Some records are kept after deletion: the security and audit logs of our servers (at least 6 years, Section 13), which are designed not to contain your medications or the content you sent, and any record that the law requires us to keep (for example tax records).

If you cannot use the in-app flow (for example because you lost access to your device), you can request account deletion by emailing contact@chronopill.com from the address tied to the account; we respond within 30 days.

Step-by-step instructions: Delete your ChronoPill account.

5.5 Shine the Light (California Civ. Code §1798.83)

California residents may request once per calendar year a list of third parties to whom we disclosed personal information for their direct marketing purposes. We disclose to no such third parties, so any such request will receive confirmation of that fact.

5.6 Washington & Nevada - My Health My Data Act (MHMDA)

Your Health Profile is "consumer health data" under RCW 19.373 (Washington) and SB 370 (Nevada). We process it only with your affirmative opt-in consent, never geo-fence you around a healthcare facility, and never sell it.

5.7 Japan (APPI)

For users in Japan, ChronoPill handles personal information under the Act on the Protection of Personal Information (APPI). The health information you enter (medications, doses, health profile) is special care-required personal information: it stays on your device and reaches our service only through an online feature you choose to use, which is your consent for that use. We use personal information only for the purposes described in Section 2 and do not provide it to third parties, except the service providers named in Section 8 or where the law requires it.

Transfers outside Japan: when you use an online feature, the data described in Section 2.2 is processed in the United States by Amazon Web Services (including the Amazon Bedrock AI models that write Key points (AI) summaries) and, if you opt in, by Google for usage analytics. The United States has no single federal law equivalent to the APPI; personal information there is protected by sector-specific federal laws and by state laws such as the California CCPA. These providers process the data under contractual confidentiality and security terms.

You may ask us to disclose, correct, add to, delete, stop using or stop providing your personal information, and to disclose the records of any provision to third parties, by writing to contact@chronopill.com; most of these requests can be done directly in the app (Section 5). Security measures: on-device encryption with iOS Data Protection and encrypted connections (TLS) for every online feature. The name and address of the business operator and of its representative are provided on request at the same address. You may also contact the Personal Information Protection Commission (PPC).

5.8 Canada (PIPEDA and Quebec Law 25)

For users in Canada, ChronoPill handles personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector as amended by Law 25. Your medication and health data stay on your device; online features run only when you choose them, and you can withdraw your consent at any time by turning them off in Settings or deleting your account (Section 5.4). When you use an online feature, your data is processed in the United States by the service providers named in Section 8 and may then be accessible to courts and authorities there under US law.

You may request access to the personal information we hold about you and ask for its correction; we answer within 30 days. Quebec residents also have the right to receive their computerized personal information in a structured, commonly used format (Settings > Export). The person responsible for the protection of personal information at ChronoPill can be reached at contact@chronopill.com. You may file a complaint with the Office of the Privacy Commissioner of Canada or, in Quebec, with the Commission d'accès à l'information.

6. Children

ChronoPill is not directed to children under 13. If a parent manages medications for a child via the Family Care feature, the parent is the data controller for that profile and assumes responsibility for lawful basis and consent.

7. Security

On your device. On iPhone, your data is encrypted by iOS file protection, which relies on your device passcode; on Android, it is kept in storage that only the app can access. You can add an app lock (Face ID, Touch ID or another biometric unlock, or a PIN). Sign-in tokens are kept in the iOS Keychain or encrypted with the Android Keystore. Backup files are encrypted on your device with the password you choose (AES-256-GCM).

On our servers. Connections use HTTPS with TLS 1.2 or higher. The data we store is encrypted at rest by AWS. Caregiver dashboards are encrypted on your iPhone before they are sent and are stored with AWS Key Management Service encryption. Each server function runs under its own access role. Box photos are not stored, and Key points (AI) summaries are cached without any link to you.

No system is perfectly secure. More detail on how we protect data: Security.

Security documentation is available to healthcare organisations on request: contact@chronopill.com.

8. International transfers

Optional cloud requests are processed in AWS US East (N. Virginia). For EU residents, these transfers rely on Standard Contractual Clauses (SCC) per Article 46 GDPR. If you are uncomfortable with US processing, leave the optional cloud features off and the app functions entirely on-device.

Processors: Amazon Web Services (USA and EU) for hosting and the Amazon Bedrock AI models (which write Key points (AI) summaries), and Google (Google Analytics for Firebase) for opt-in usage analytics. Transfers to them rely on the EU Standard Contractual Clauses included in their data processing agreements.

Email sent to our chronopill.com addresses is received by Amazon Web Services and forwarded to a mailbox hosted by Google.

Apple and Google process your purchases as independent controllers. The AlAdhan prayer-times service receives your approximate location only when you use Fasting Mode.

9. Third-party data sources we display

Official medicine information shown in the app comes from public regulatory sources (FDA, NLM DailyMed, ANSM, AEMPS, BfArM, AIFA, PMDA, MHLW, AMMPS, EMA). It is shown verbatim, and we do not re-sell or claim ownership of it. Sources and licences are listed on the Compliance page.

10. Cookies and trackers on this website

chronopill.com uses no cookies and no third-party trackers. The site is static HTML served from Amazon CloudFront.

We count visits only as anonymous daily totals (page viewed, interface language, referring domain): no IP address, no user agent, no cookie and no per-visitor identifier is ever stored, counting is skipped when your browser sends the Do Not Track signal, and if you join the Android waitlist we store only the email address you enter, your interface language and the signup date, used once to announce the Android launch.

Like any website, our content delivery network (Amazon CloudFront) keeps standard access logs (IP address, date and time, page or file requested) for 30 days.

11. HIPAA status

ChronoPill is a consumer app that you choose and install yourself. In that situation ChronoPill is not a "covered entity" under the US Health Insurance Portability and Accountability Act (HIPAA): we are not a health plan, a health care clearinghouse or a health care provider that conducts covered electronic transactions, and we do not act on behalf of one. HIPAA therefore does not govern the information you enter in the app; this Privacy Policy and the consumer protection and health privacy laws described in Section 5 do.

Your medications, dose history and health profile are stored on your device (Section 2.1). The safeguards for the limited information that reaches our servers through the optional features of Section 2.2 are described in Section 7. ChronoPill holds no HIPAA certification.

12. Categories of personal information (California CCPA §1798.140 disclosure)

• Identifiers: a random installation ID for App Attest checks and rate limits; if you opt into usage analytics, the Firebase app instance ID and the identifier for vendor (IDFV); and, if you create an account, your email address, name (optional), an internal user UUID and, with Sign in with Apple, the Apple user identifier (linked to your account record).
• Customer records (Cal. Civ. Code §1798.80): your account record, if you create one (Section 2.4).
• Health information (sensitive personal information): your medication list, dose history, side effects, notes and the optional profile details you enter (for example age, sex, height and weight). It is stored on your device. It reaches our servers only through the optional features of Section 2.2: an encrypted copy of your medication list and of today's doses if you turn on the caregiver dashboard, the name of a medicine and its official leaflet text if you ask for Key points (AI), photos of a medication box if you use box identification, and anything you choose to write to support. Your profile details are never sent to us.
• Geolocation (coarse): if you allow it, used to pick the medication database of the country you are in, in Travel or Fasting Mode, for the address on the Emergency Card PDF you create and to show nearby pharmacies; to turn a position into a country or an address, or to search the map, your iPhone asks Apple's services (Apple receives the coordinates, ChronoPill never does); in Fasting Mode, approximate coordinates are sent to the AlAdhan prayer-times service (Section 2.2), never to ChronoPill; if you opt into usage analytics, Google derives an approximate location (country and city) from your IP address.
• Biometric identifiers: Face ID / Touch ID is evaluated by iOS; ChronoPill only receives a true/false result.
• Commercial information: in-app purchase status validated via Apple or Google Play (we never see your payment card). If you have an account, the subscription entitlement state (active / lapsed) is stored against your account record so it can be restored across reinstalls.
• Inferences: adherence statistics and streak counters computed on-device only.
• Internet or other electronic network activity: opt-in usage analytics events (Section 2.2).

13. Data retention

• On-device data (medications, schedules, dose history, Health Profile): retained until you uninstall the app or tap Clear All Data.
• Account data (email, password hash, name, internal user ID, Apple user identifier, registered purchases): retained for the lifetime of the account. Erased from our live systems when you tap Delete Account or when we process your emailed request; copies in our database backups are gone within 35 days.
• Installation ID (App Attest device check and rate limiting): stored on our servers only as a one-way hash, deleted automatically 90 days after its last use, never stored with your account.
• Backup files: kept only where you save them, under your control; ChronoPill never holds a copy.
• Support requests sent from the app (the ticket, its messages, your email address and name): deleted automatically 24 months after they are written; your email address and name, 24 months after your latest request.
• Support emails (email you send to a chronopill.com address): kept until deleted; you can ask us to delete them at any time.
• Key points (AI): summaries cached without any user link, for at most 30 days; security logs of the request (never the text) kept 6 years.
• Caregiver dashboard snapshot: until you revoke the code or the access time you chose ends, and at most 30 days after the last sync; deleting your account in the app also deletes it (Section 2.2). The times of the views are deleted with it, and at the latest 30 days after the last view.
• Usage analytics: at most 14 months in Google Analytics.
• Website and download logs (IP address, date and time, page or file requested): 30 days.
• Server logs: 90 days for most technical logs; at least 6 years for security and audit logs. They are designed not to contain your medications or the content you send.
• Database backups: our databases keep recovery copies for up to 35 days; a record deleted from our live systems disappears from these copies within that time.

14. Changes to this policy

We will post updated versions here and, if the change is material, require re-acceptance of the Legal Disclaimer at the next app launch. Material changes affecting US state privacy rights are highlighted at the top of this page for at least 30 days.