Privacy Policy

• Account Information: Full name, phone number, email address, date of birth, gender
• Health Data: Medications, dosage schedules, adherence logs, vital readings (blood pressure, glucose, etc.), symptoms, and appointment history
• Device Information: Device type, OS version, push notification tokens (FCM), and app usage data
• Location: Your device location, only when you grant permission. Used to find nearby pharmacies and, if you trigger an SOS alert, to send your precise coordinates to your linked caregivers (see Section 6)
• Camera and Photos: Used to scan medicine QR codes, prescriptions and medicine packaging. Photos you choose to scan are sent to an AI service to read them, and prescription photos uploaded for pharmacy orders are also saved to your account (see Section 7)
• Usage Data: App interactions, feature usage patterns, and crash reports for quality improvement

• Providing and personalising your medication tracking and health management experience
• Sending medication reminders, refill alerts, and appointment notifications via push notification
• Enabling pharmacy order fulfilment and prescription management
• Allowing authorised caregivers to monitor patient health (only with explicit patient consent)
• Sending your location to your linked caregivers when you trigger an emergency SOS alert
• Showing pharmacies near you and their distance from you
• Reading the prescription and medicine photos you choose to scan, using a third-party AI service, to extract medicine details
• Generating anonymised analytics for healthcare improvement research
• Complying with legal and regulatory requirements applicable in Nepal

• Pharmacies: Order details shared with pharmacies you place orders with
• Caregivers: Health summaries shared only with caregivers you explicitly approve. If you trigger an SOS alert, it (including your location) is sent to the caregivers linked to your account
• AI Service (OpenAI): Prescription and medicine photos you choose to scan are sent to OpenAI to read the text in them (see Section 7)
• Service Providers: Infrastructure partners (hosting, database, push notifications) bound by confidentiality agreements
• Legal Requirements: When required by applicable law or regulatory authority

• All data is transmitted over TLS/HTTPS encryption
• Passwords are hashed using industry-standard algorithms and never stored in plain text
• Access tokens use short-lived JWT with secure refresh token rotation
• Sensitive data (auth tokens) is stored in device secure storage (Android Keystore / iOS Keychain)
• Database access is restricted to authenticated application services only
• Regular security reviews and dependency updates are performed

• Finding nearby pharmacies: your approximate position is sent with each search so pharmacies and medicine prices can be ordered by distance. It is used only for that request and is not saved to your profile or our database.
• Emergency SOS: when you trigger an SOS alert, your precise coordinates are sent to our servers and delivered to the caregivers linked to your account as a push notification with a map link. We do not store the SOS location in our database. If you instead use the option to message your emergency contact, a map link is added to an SMS sent from your own phone — it does not pass through our servers.

• What is sent: the photo you chose to scan, a fixed instruction, and the names of medicines in our catalog (to help match names). We do not send your name, phone number, email or account ID with it. The photo itself may show your name, your doctor's name or other printed details.
• Who receives it: OpenAI (United States), which processes the photo on our behalf only to return the extracted text. Under OpenAI's current API terms, data sent through its API is not used to train its models by default, and may be kept by OpenAI for up to 30 days to monitor for abuse.
• Limited purpose: the AI is used only to read and extract medicine details. It does not diagnose, give medical advice or decide your treatment, and we do not sell your photos or use them for advertising.
• What we keep: a prescription you upload for a pharmacy order is saved in your account, with the extracted details, and permanently deleted when you delete your account (see Section 12). Photos scanned with "Scan Medicine" are not saved by us.
• Review and accuracy: you review the results before they are added to an order or your medications. AI can misread handwriting or labels, so always check them against your prescription.
• Your choice: you can decline, and add medicines manually instead.

• Active account data is retained while your account remains active
• Prescription photos uploaded for pharmacy orders, and the medicine details read from them, are kept in your account until you delete your account
• When you delete your account, your profile, medications, health records, orders and notification tokens are permanently deleted — after a 30-day grace period (during which you can cancel by signing in again), or immediately if you choose "Delete now"
• Anonymised security records (they contain no name, phone number, email or IP address) may be kept after deletion
• Anonymised analytics data may be retained indefinitely in aggregate form

• Access: Request a copy of all personal data we hold about you
• Correction: Update inaccurate or incomplete information
• Deletion: Request deletion of your account and associated data
• Portability: Export your health data in a standard format
• Withdraw Consent: Revoke caregiver access or notification permissions at any time

• Open Profile → Delete My Account, choose Delete in 30 days or Delete now, then enter your password to confirm.
• With "Delete in 30 days" your account is deactivated immediately and permanently deleted after 30 days; sign in again before then to cancel. With "Delete now" it is deleted right away.