Privacy Policy

1. Data We Collect

• Account: Your email address, or the name and email Apple or Google share when you sign in with them (Apple may give us a private relay address), your display name, language, time zone, daily routine times, quiet hours, lock-screen setting and plan. A Kindose account is separate from any other Inovy app account.
• Health data (with your explicit consent): The medications you add (name, strength, form), schedules, dose history (taken, skipped, not confirmed), refill information, expiry date and batch number read from a pack barcode (a pack serial number is never stored), symptom and mood logs with optional notes. This is needed for an account: it is stored in the cloud so reminders sync, family alerts work and reports can be made.
• People you care for: The display name of each person you add and, if you invite them by text, their phone number. On iPhone the number comes from the system contact picker, which gives Kindose only the one contact you pick; Kindose does not read your address book. On Android, Kindose does not access contacts.
• Family circle: Who is in your circle, their roles, and your invites. Invite codes are stored only as a hash.
• Family alerts: When a dose is still unconfirmed after the delay you set (60 minutes by default), the caregivers you invited receive one push notification. It contains the person’s name, the medication name, the planned time and how late it is; if the recipient turned on “hide medication names on lock screen”, the medication name is left out (the person’s name stays in the title). These alerts are sent through the Expo push service and Apple Push Notification service or Google Firebase Cloud Messaging. We store your push token for this.
• Reminders: Dose reminders are local notifications planned on your phone. They do not need a connection, and reminder content is not sent to a server to deliver them.
• Label scan (with your AI consent): The label photo is read on your phone (Apple Vision on iPhone, Google ML Kit on Android) and then deleted. The photo never leaves your phone. Only the recognised text and your language are sent to our server and to Amazon Bedrock (Anthropic Claude models, EU regions) to pick out the name, strength and instructions. You check every field before anything is saved.
• Barcode scan: The barcode is read on your phone and looked up in our copy of public medicine catalogues (today the U.S. FDA NDC Directory and the French ANSM public medicines database). When you confirm which medicine a barcode belongs to, that pairing is saved for you; once three different users confirm the same pairing, it is shared with all Kindose users. A pairing contains only the barcode and the medicine, never anything about you.
• Ask Kindose and plain-words explanations (with your AI consent): Your question is sent to Amazon Bedrock (Anthropic Claude models, EU regions) together with context about your active medications (name, strength, form, schedule) and your taken, skipped and unconfirmed counts for the last 14 days. Amazon Bedrock does not use this to train models. Your Ask questions and answers are saved in your Ask history until you delete them or your account. If you use “Report this answer”, the report is kept for 180 days.
• Doctor-visit report: The PDF is created on your phone and goes only where you choose to share, print or send it.
• Analytics: Mixpanel (EU servers) receives allow-listed product events, such as “a dose was marked taken” or “a symptom was logged”, with a salted hash of your account ID. Events never include medication names, notes or values. Microsoft Clarity records session replays and heatmaps only on screens without health data (for example welcome, plan choice and some settings) and pauses on every other screen. In the EU, EEA and UK (and where your region is unknown) analytics stay off until you agree; elsewhere they are on by default and you can turn them off.
• Crash reports: Crashes and errors are reported to Sentry without a separate opt-in, because a reliable reminder app needs them. Before sending, Kindose removes health data, names, contact data, account and device identifiers, free text and IP address. Reports keep the error, the stack trace and technical details such as app, OS and device model.
• Ads (free plan only): Google AdMob shows native ads in the Meds, Insights and Profile lists only, never on reminders, your dose card, scanning, reports, Ask or family screens. Ads are personalised only if you allow tracking on iPhone and, where required, agree in Google’s consent form; otherwise only non-personalised ads are requested. AdMob receives device data such as the advertising identifier (when allowed), IP-derived approximate location and ad interactions. The Meta SDK receives only “purchase” and “subscribe” events with price and currency, and only when you allowed tracking and personalised ads. No health data, medication names or dose events are ever sent to ad or attribution services.
• Purchases: Subscriptions are processed by Apple or Google and managed through Adapty. Adapty receives your Kindose account ID, purchase receipts and technical device data.
• Support: If you email us, we receive what you write. The in-app support email adds only the app version, platform and OS version.

2. How We Use Your Data

• Provide reminders, dose logging, sync, family alerts, reports and insights.
• Read labels, look up barcodes and answer your questions, if you agreed to AI processing.
• Apply plan limits and process your Kindose Premium or Kindose Family subscription.
• Show ads on the free plan, according to your ad choices.
• Understand how the app is used (with consent where required) and fix crashes.
• Respond to support and privacy requests.

We do not sell your data. Your health data is never used for advertising and never shared with advertisers. Our legal bases are your explicit consent for health data, AI processing and sharing with family (GDPR Art. 9(2)(a); KVKK Art. 6), the contract with you for the account and subscriptions, your consent for analytics in the EU, EEA and UK and for tracking and personalised ads, and our legitimate interest for crash reports and shared barcode pairings.

3. Who Processes Your Data

• Supabase (EU): Sign-in, database, server functions. Stores your account, health data, circle, invites, Ask history and push tokens.
• Amazon Web Services, Bedrock (EU regions): AI label reading, Ask Kindose and explanations with Anthropic Claude models, only with your AI consent.
• Expo push service (US), Apple Push Notification service, Google Firebase Cloud Messaging: Delivery of family alerts and circle notices.
• Apple and Google sign-in: Only if you choose them.
• Adapty, Apple App Store, Google Play: Subscription purchases and status.
• Mixpanel (EU): Product analytics, with consent where required.
• Microsoft Clarity: Session replay on screens without health data, with consent where required.
• Sentry: Crash and error reporting.
• Google AdMob and Google’s consent form: Ads on the free plan.
• Meta: Purchase and subscription attribution, only with tracking and ad consent.

Some of these providers, including Expo, may process data outside the EU and Türkiye under their own safeguards, such as standard contractual clauses.

4. Your Choices

In the app, Profile › Privacy and data lets you withdraw or give again your agreement for health data, AI features and sharing with family, turn usage analytics on or off, change your ad choices and see your tracking permission. Withdrawing AI consent stops label scanning, Ask Kindose, plain-words explanations and insights; reminders and dose logging keep working. Withdrawing sharing pauses family alerts for your whole circle. Profile › Lock screen hides medication names in notifications. On iPhone you can change tracking in Settings › Privacy & Security › Tracking.

5. Data Retention and Deletion

We keep your account and health data until you delete it or your account. Ask history stays until you delete it or your account. Short-lived technical records are purged automatically: rate-limit counters after 2 days, the family alert queue 30 days after sending, subscription webhook records after 60 days, operational alerts after 90 days, AI answer reports after 180 days, and unused push tokens after 90 days.

Account deletion: In the app, open Profile › Account › Delete account, or follow the steps on the delete account page. Deletion permanently removes all your Kindose data: your profile, the people you manage, medications, schedules, dose history, logs, Ask history, circle memberships, invites and push tokens. Kindose accounts are separate per app; the shared Inovy sign-in is removed too, unless you still use it for another Inovy app, in which case only your Kindose data is deleted. Deleting your account does not cancel a subscription.

Purchase records held by Apple or Google, and data already received by Mixpanel, Microsoft Clarity, Sentry, Adapty, Google AdMob and Meta, are kept by those providers under their own policies. Barcode pairings shared after three confirmations contain no personal data and stay in the catalogue.

6. Children

Kindose is not directed at children. A person you care for in Kindose must be 16 or older.

7. Your Rights

Depending on where you live, including under the GDPR and Türkiye’s KVKK, you can ask for access to your data, a portable copy, correction, deletion or restriction, object to processing, and withdraw consent at any time without affecting earlier processing. Use Profile › Privacy and data › Request my data or email us; we answer within 30 days. You can also complain to your local data protection authority.

8. Changes

If we change this policy, we update the date at the top of this page and, for important changes, tell you in the app.

9. Contact Us

Questions or requests about your privacy: privacy@inovy.dev. General support: support@inovy.dev.