Privacy Policy

Who we are

Medicose(“we,” “us,” or “our”) provides a medication reminder and caregiver-coordination service, made up of this website and the Medicose Android app (com.medicose.app). We are the controller of the personal information described below. You can reach us at hello@medicose.app.

Information we collect

Everything below is either entered by you or needed to deliver a reminder. We do not buy data about you from anyone.

• Account information — your email address and password (handled by Firebase Authentication; we never see or store your password ourselves), the display name you choose, whether you signed up as a patient or a caregiver, and optionally a phone number if you add one.
• Health information you enter — the medications you add (name, strength, form, instructions, schedule, and remaining count for refill reminders) and your dose history (whether each dose was taken, skipped, snoozed, or missed, and when it was confirmed). This is health-related data and we treat it as sensitive.
• People you care for— if you manage medications for a dependant, the profile you create for them (display name, timezone, and optionally date of birth) and their medications and dose history. You are responsible for having the authority to enter another person’s health information.
• Care Circle membership and invitations— who is in a Care Circle, the role each member holds (viewer, monitor, or manager), when they accepted, and their alert preferences. When you invite someone you may also enter their name, their relationship to you (for example “daughter”), and optionally their phone number; those details are stored with the invitation so you can recognise it in your list. The invitation itself is a short-lived random code that expires on its own. Only enter another person’s details if they are happy for you to.
• Device information for notifications— a Firebase Cloud Messaging token for each device you sign in on, so a caregiver alert can reach that device, and your device’s manufacturer (for example “samsung”) so the app can show the right battery and alarm settings walkthrough for your phone.

Camera

The app asks for camera access for two optional things: scanning the barcode on a medicine box to fill in its details, and scanning a Care Circle invitation QR code. Frames are read on your device to decode the code. We do not save photographs, and no image is uploaded to us or to anyone else. You can decline camera access and enter everything by hand.

What we do not collect

• No advertising or analytics SDKs. There is no advertising identifier collection, no behavioural profiling, and no third-party tracker in the app.
• No location data, contacts, call logs, SMS, or microphone access.
• No payment information — the app is free and has no purchases.

How we use your information

• To schedule and fire your reminders, including on-device alarms.
• To detect a dose that was not confirmed in time and alert the Care Circle members you chose for that medication.
• To show your adherence history and count down refills.
• To keep the service working, secure, and free of abuse.
• To answer you when you contact support, and to meet legal duties.

We do not sell your personal information, we do not share it with data brokers, and we never use your health information for advertising.

Our legal bases (UK/EU users)

Where the UK GDPR or EU GDPR applies, we rely on: performance of our contract with you, to run the account and deliver reminders; your explicit consent for health-related data, which you give by entering your medications and by choosing which Care Circle members are alerted, and which you can withdraw at any time by deleting the data or your account; and our legitimate interests in keeping the service secure.

Who else processes your information

• Google (Firebase) — Firebase Authentication holds your login credentials, Cloud Firestore stores your medications, dose history, and Care Circle, and Firebase Cloud Messaging delivers caregiver alerts. Google acts as our processor under its data processing terms.
• Our own reminder server — a small service we operate on Google Cloud reads upcoming and overdue doses in order to send caregiver alerts. It is not shared with anyone else.
• RxNav, U.S. National Library of Medicine — when you search for a medicine by name or scan a barcode, that name or code is sent to the public RxNav service to look up standard drug details. Your account identity is not attached to the lookup.

We may also disclose information where the law requires it, or to protect the rights and safety of people using the service.

Sharing inside your Care Circle

Nobody sees your medications unless you invite them. You start the sharing by issuing a single-use invitation code; the person you give it to becomes a member with the role you picked, and from then on sees what that role allows — typically your medication list and whether doses were taken or missed — and receives the alerts you enabled for each medication.

A member can end their own access at any time from their device. If you want a member removed and they have not left themselves, email hello@medicose.app and we will revoke their access — removing a member from inside the app is not available yet. An unused invitation code expires on its own.

International transfers

We and Google process your information on servers that may be located outside your country, including in the United States. Where data leaves the UK or EEA, the transfer relies on the safeguards in Google Cloud’s data processing terms, including the European Commission’s Standard Contractual Clauses and the UK Addendum.

Data security

Traffic between the app and our providers is encrypted in transit, and data at rest is encrypted by Google Cloud. Access rules restrict each account to its own records and to the Care Circles it belongs to, and administrative access is limited to what is needed to run the service. No method of transmission or storage is completely secure, but we work to safeguard your data and limit access to it.

Retention and deletion

We keep your medications and dose history for as long as your account exists, because the history is the point of the app. Push tokens are removed when you sign out on that device or when they stop being valid. When you ask us to delete your account we remove your profile, medications, dose history, Care Circle membership, and push tokens within 30 days, except where we must keep a limited record to meet a legal obligation.

You can request deletion at any time — see how to delete your account and data.

Your rights and choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to withdraw consent, to object to or restrict certain processing, and to complain to your data protection authority (in the UK, the Information Commissioner’s Office). To exercise any of these, email hello@medicose.app from your account address and we will respond within 30 days.

Children’s privacy

The app is intended for adults and is not directed to children. We do not knowingly let a child create their own account. An adult may create a managed profile to track a child’s medications; that information is held under the adult’s account and is their responsibility.

Changes to this policy

We may update this policy from time to time. When we do, we’ll revise the “Last updated” date above and, where the change is significant, tell you in the app.

Contact us

Questions about this policy, or about the data we hold on you? Email hello@medicose.app.