Privacy Policy

1. Who we are

Medical Companion is developed and published by Unobyte IT Consulting, a Canadian limited company based in Victoria, British Columbia, Canada.

If you have any questions about this policy, contact us at support@medicalcompanion.app

2. The short version

Your health data stays on your device. We do not collect it, store it on our servers, or sell it. Ever. This policy explains exactly what we do and don't do with your information.

3. What stays on your device

All health data you enter into Medical Companion is stored locally on your device and nowhere else by default. This includes:

• ·Medication names, dosages, and schedules
• ·Dose logs — taken, skipped, delayed
• ·Symptom, hydration, nutrition, activity, weight, and toilet entries
• ·Profile information including display names and date of birth
• ·Reminder settings and notification preferences
• ·Export records

This data is encrypted at rest using SQLCipher. The encryption key is stored in the iOS Keychain on iPhone and the Android Keystore on Android devices. We do not have access to your encryption key and cannot read your health data.

Device backups are handled differently on each platform, and the difference is deliberate. On Android, Medical Companion excludes itself from Google Auto Backup and from device-to-device transfer, so your health data is never copied to your Google account and does not travel to a new phone along with your other apps. On iPhone, the app is included when you back up the device to iCloud or to a computer. Whether restoring such a backup onto a new iPhone reunites the database with the key that opens it is something we have not verified, so please do not treat a device backup as your only copy. The copy you control is an export — a PDF, CSV, or FHIR file you generate and save yourself.

4. What we collect on the website

No page on this website asks for your email address or any other personal information. The newsletter signup has been removed while we rebuild it, and the waitlist closed when the app shipped. We are not sending a newsletter or any marketing email at present.

Records from the forms that used to be here have not all been destroyed, and we are not going to describe them as deleted. If you gave us an email address through the waitlist or the newsletter signup, it may still exist in two places: the notification emails those forms sent to our own inbox, and the record of the confirmation message held by Resend, our email provider. We can delete the first on request. The second we cannot delete individually — Resend provides no way to. Resend's published pricing states a 30-day data retention period on every plan except Enterprise, which we are not on; we do not read that as a promise that the record is deleted at 30 days, and we have not established that it is. Section 10 says what we can and cannot do about both.

This website is hosted by Vercel, which keeps operational logs of requests — including IP addresses — as a normal part of serving and protecting the site. Vercel documents a one-day retention window for the function logs we can see on our plan; we have not independently established how long any other infrastructure-level request records are kept. We do not read these logs to identify anyone, do not export them, and do not combine them with anything else.

We collect no other personal information on the website. There are no analytics trackers, advertising pixels, or third party tracking scripts on any page of this website.

5. What the app collects

The Medical Companion app collects no personal information and makes no network requests by default. Specifically:

• ·No account is required to use the app
• ·No health data is transmitted to our servers or any third party server
• ·No advertising SDKs are present in the app
• ·No analytics or crash reporting SDKs are present in the app
• ·No push notification payloads contain health data — reminders use generic text only
• ·On Android, the app excludes itself from Google Auto Backup and device-to-device transfer

The only network activity in the app is processing your subscription payment through Apple App Store or Google Play. This is handled entirely by Apple and Google respectively. We never see your payment card details.

6. In-app purchases and subscriptions

Medical Companion offers optional paid subscriptions processed entirely through Apple App Store (iOS) and Google Play (Android). All billing, payment processing, and subscription management is handled by Apple and Google under their respective terms of service and privacy policies. We receive only a confirmation that a subscription is active — no payment details.

7. Notifications

Local medication reminders are scheduled entirely on your device. They are not routed through our servers. By default, notification text uses generic language such as “Time to take your medication” and does not include medication names or health information. You may optionally enable detailed notifications in Settings — this setting is stored locally on your device only.

8. Exports

PDF, CSV, and FHIR exports are generated entirely on your device. When you share an export, it leaves your device directly to wherever you choose to send it — your doctor, your email, your files. We never receive a copy of your exported data.

9. Children and dependent profiles

Medical Companion allows a subscriber to create profiles for dependent family members including children and elderly adults. The same privacy protections apply to all profiles — data remains on the device and is never transmitted to our servers.

For child profiles, the subscribing parent or guardian is responsible for ensuring appropriate use in accordance with applicable law in their jurisdiction.

10. Data deletion

You can delete any profile, any individual health entry, or all app data at any time from Settings. Deletion is immediate and permanent — we have no copy of your data to delete on our end. Uninstalling the app removes all locally stored data from your device.

To have your email address deleted, write to support@medicalcompanion.app. We will delete the notification emails our old waitlist and newsletter forms sent to our own inbox, which is the copy under our direct control, and we will confirm to you when that is done.

Resend, our email provider, also holds a record of the confirmation message it sent you, and we cannot delete that one on demand — Resend offers no way to remove an individual sent-email record. Resend's published pricing states a 30-day data retention period on every plan except Enterprise, which we are not on. We are deliberately not telling you that means the record is deleted after 30 days: a stated retention period is not a deletion commitment, and we have not established what happens to it afterwards. What Resend does commit to, in its data processing agreement, is that “when the Customer terminates their use of the Services, we delete their user/customer data within 90 days of the account termination.” If you would like us to raise your address with Resend directly rather than leave it at that, say so and we will, and we will tell you what they say. Aside from that, this email request is the only deletion route we offer: we are not currently sending any email, so there is no unsubscribe link to use, and previous emails did not contain one.

11. Data residency and transfers

Your health data stays on your device and is never sent to us, so we perform no cross-border transfers of health information. The only way health data leaves your device is when you explicitly trigger an export or email-report action, and it then goes wherever you send it. Any email address you gave us through the forms that used to be on this site was processed by Resend. Resend's published pricing states a 30-day data retention period on every plan except Enterprise, which we are not on; see section 10 for what that does and does not tell you about the record described in section 4. Resend's data processing locations are described in their privacy policy at resend.com/legal/privacy-policy.

12. Security

Health data in the app is protected by:

• ·AES-256 encryption via SQLCipher
• ·Encryption key stored in the iOS Keychain or Android Keystore — never sent to us
• ·Optional biometric app lock
• ·No network transmission of health data by default

We follow OWASP Mobile Application Security Verification Standard (MASVS) guidelines as our mobile security baseline.

13. Canadian privacy law

Unobyte IT Consulting is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation in British Columbia. We are not currently sending marketing email of any kind. If we resume, it will go only to people who have explicitly opted in, and every message will carry a working unsubscribe link. We state that as a commitment for the future rather than a description of the past: the emails this site sent before 2026-10-05 did not contain one.

14. Changes to this policy

If we make material changes to this policy we will update the effective date at the top of this page. We have no mailing list to notify, so that date is the only notice we can honestly promise — please check it if this matters to you.

15. Contact

Unobyte IT Consulting
Victoria, British Columbia, Canada
support@medicalcompanion.app
medicalcompanion.app