Privacy Policy

1. About MedGuardian

MedGuardian ("we," "our," or "us") provides a patient-focused medication management application (the "Service") designed to help users organize medications, configure schedules, track doses, and optionally connect with trusted caregivers. The Service is currently operating as a free beta.

2. Scope

This Privacy Policy explains how we collect, process, use, and share information when you use our application. It applies to all users of the Service, including patients and authorized caregivers. By using the Service, you acknowledge the practices described in this policy.

3. Personal Data We Collect

We collect information that you voluntarily provide when creating an account and using the Service. The actual data categories we process reflect our current implementation capabilities.

4. Health and Medication Information

When you use the Service, you may provide sensitive personal information related to your health. We store the following verified data points:

• Medications: Name, dosage, frequency, route, and clinical timing window schedules.
• Dose Tracking: Adherence history (e.g., doses taken or skipped) and the timestamps of these actions.
• Profile Biometrics: Height, weight, and blood group (if provided).
• Health Conditions: Allergies, allergens, reaction severity, and active/resolved conditions.
• Emergency Information: Emergency contact names, relationships, and phone numbers.

5. Account and Authentication Information

To secure your account, we collect your email address and an encrypted password hash. We also store session information to keep you logged in safely.

6. Caregiver Relationship Information

If you are a caregiver, we collect your basic profile information (name, phone number). We securely store the pairing relationships, active pairing codes, and the explicit permissions granted by the patient.

7. Device / Notification Information

If you opt-in to reminders, we collect push subscription metadata, timezone preferences, and preferred reminder channels. We do not track real-time physical location data.

8. Information Collected Automatically

We collect essential technical metadata to maintain security and reliability. This includes IP addresses, basic User-Agent strings, and audit logs of critical security actions (e.g., logins, password resets, role changes).

9. How We Use Personal Data

We process your data strictly to operate the application. Specifically, we use it to:

• Create and manage your account.
• Provide medication scheduling, tracking, and notification features.
• Enable authorized sharing with your connected caregivers.
• Maintain the security of your account through authentication and audit logs.

We do not sell your personal data. We do not use your health information for advertising.

10. Legal/Permitted Basis for Processing

We process your personal data primarily based on your voluntary consent when you register and use the Service. For security logs and infrastructure operation, we process data based on our legitimate interest in maintaining a secure application.

11. Caregiver Data Sharing

A core feature of MedGuardian is the ability to invite a trusted caregiver. This relationship requires an explicit authorization flow using a secure pairing code. When approved, a caregiver gains read-only visibility into the patient's medications, adherence history, and basic profile, limited strictly by server-side authorization. Patients may revoke this relationship at any time.

12. Service Providers / Data Processors

We use verified third-party infrastructure processors to host and secure the application. Our primary sub-processors include our cloud application hosting provider and our managed PostgreSQL database provider. These providers process data strictly to provide necessary technical infrastructure.

13. Infrastructure Providers

The application uses infrastructure services such as Cloudflare (for edge routing and security), Render (for application hosting), and Supabase (for managed database infrastructure).

14. Data Security

We implement reasonable technical controls, including encrypted passwords (Argon2id), secure authentication cookies, server-side authorization limits, encryption at rest via our database provider, and TLS encryption in transit. However, no application is 100% secure, and MedGuardian does not claim to hold formal compliance certifications (e.g., SOC 2, HIPAA) at this beta stage.

15. Data Retention

Data may remain in our active systems until deleted through supported account or data-management functionality, or otherwise removed according to our operational retention practices.

16. Account Deletion

Users may request account deletion by contacting support. Upon account deletion, personal health information, medication schedules, and caregiver relationships are removed or anonymized according to our database schemas.

17. Data Principal / User Rights

Depending on your jurisdiction and applicable data protection frameworks (such as the Digital Personal Data Protection Act, 2023, subject to phased commencement), you may have the right to access, correct, or request erasure of your personal data. You may exercise these rights by contacting us.

18. Consent Withdrawal

Where we process data based on your consent, you may withdraw that consent by deleting the relevant medication, unpairing a caregiver, or deleting your account entirely.

19. Grievances / Complaints

If you have a privacy grievance, please contact us using the information provided at the end of this policy.

20. Children's Privacy

MedGuardian is not designed for independent use by young children. Users must be legally capable of providing consent to use the Service.

21. International Data Transfers

Data is stored on cloud infrastructure which may involve international data transfers. We utilize reputable global infrastructure providers to host the application.

22. Cookies and Authentication

We use strictly necessary technical cookies to maintain your authenticated session. Specifically, we use an HttpOnly, Secure cookie to store a session refresh token. We do not use third-party marketing or tracking cookies.

23. Changes to This Policy

We may update this policy as the Service evolves. Significant changes will be reflected by updating the Effective Date at the top of this document.

24. Contact Information

If you have a question about this policy or your personal information, you can contact MedGuardian using the form below. For privacy-related requests, please select "Privacy request" as the reason.