Privacy isn't a feature.
It's a promise.
We built Medical Companion from the ground up around one principle: your health data belongs to you and no one else. Here's exactly how we deliver on that.
Local-first storage
Everything you log — medications, symptoms, weight, hydration — lives only on your device. We don't send it to any server, ever — data only leaves your device when you explicitly export or email a report.
Encryption at rest
Your health database is encrypted using device-level keys tied to your biometric or passcode authentication. Even if someone extracted your device storage, your data would be unreadable.
Zero data selling
We have no advertisers. We have no data broker relationships. Your health information is not sold, shared, or used to train third-party machine learning models — full stop.
No account required
You can use Medical Companion fully without ever creating an account. There is no email verification, no login wall, and no requirement to link your identity to your health data.
You own your data
Delete everything from Settings at any time, on any tier, with no conditions. Export to CSV, PDF, or FHIR R4 is part of the Sync and Caregiver Pro tiers — and every format is open and documented, so an exported file stays readable without us and without this app.
No telemetry of any kind
Medical Companion contains no analytics SDK and no crash-reporting SDK. There is nothing to opt into and no setting to find, because the app collects no usage data and sends no diagnostics anywhere. The only crash information that can ever reach us is whatever Apple's own OS-level reporting provides — a setting you control in iOS, not something the app collects.
Technical implementation
SQLite with SQLCipher — All health data is stored in an encrypted SQLite database on your device. The encryption key is a random value generated on your device and held in the iOS Keychain or Android Keystore, where it can be read only while your device is unlocked.
No network calls without consent — The app performs no outbound network requests during normal operation except when you explicitly export, email, or share a report. All features work fully offline.
No servers, by design — Medical Companion doesn't run a backend and doesn't sync your data anywhere. The Sync tier unlocks unlimited history and export formats — it doesn't transmit your data off-device.
Standard export formats — We export CSV for spreadsheet analysis, PDF for doctors, and FHIR R4 JSON for clinical systems. None of these formats contain telemetry or phone-home mechanisms.
Email communications
We are not sending any email at the moment, and there is nowhere on this site to give us your address. The waitlist closed when the app shipped. The newsletter signup has been removed while we rebuild it. No marketing email is going out, and no new address is being collected.
If you gave us an address through either form, we have not destroyed every trace of it and will not pretend otherwise. It may remain in two places. The notification emails those forms sent to our own inbox — we can delete those, and will, if you write to support@medicalcompanion.app. And the record of the confirmation message held by Resend, our email provider — that one we cannot delete on demand, because Resend offers no way to remove a single sent-email record. Resend's published pricing states a 30-day data retention period on every plan except Enterprise, which we are not on; that is not the same as a promise to delete it, and we are not going to present it as one. The privacy policy sets out exactly what we can and cannot do.
We have never sold an email address or given one to anyone for their own use, and we never will.
Have a privacy question?
Read our full privacy policy or reach out to us directly.