Privacy Policy

Effective date: October 20, 2026

CareDose is operated by Pablo Gamero, who is the data controller for the personal information described here. This Privacy Policy explains how CareDose collects, uses, stores, shares and protects information when you use the CareDose app and related services. Contact us at caredose@pablogamero.com.

Information we collect

We collect information you provide or generate while using CareDose:

Account details — your email address and display name. If you sign in with Apple or with Google, we receive the account identifier and the email address that provider releases to us. Sign in with Apple may pass a private relay address instead of your real one; we do not attempt to resolve it.
Health information you enter — medication names, schedules, dose amounts, dose logs, appointments, adherence history, stock counts and notes.
Your consent record — the version of the consent you agreed to, when you agreed, and that you confirmed your age.
Caregiver sharing — invitations, invite codes and sharing status. Scanning an invite QR code uses the camera; frames are processed on the device and are never stored or transmitted.
Device and delivery settings — push notification tokens, the device’s IANA time zone, its language, and per-device reminder settings such as quiet hours and whether notifications may show medicine names.
Subscription status — plan and entitlement information, received from Apple or Google through RevenueCat. We never see your card details.
Usage and diagnostics — only if you switch it on; described in its own section below.

Medication, appointment, dose and adherence data is health data, a special category of personal data under Article 9 of the GDPR. CareDose processes it only on the basis of your explicit consent (Article 9(2)(a)), which the app asks for in its own screen before any of it is stored — a box you tick yourself, never pre-ticked.

CareDose uses this information only to provide the service: reminders, logging, adherence history, the sharing you choose, alerts and support. We do not sell it, do not use it for advertising or profiling, and do not track you across other apps.

You can withdraw your consent at any time by deleting your account (Settings → Delete account). Because the app cannot work without this data, withdrawing consent means the account and its data are erased. Withdrawal does not affect processing that happened before it.

How we use information, and why we may

What we do	Legal basis
Create and run your account, sign you in	Performing our contract with you (GDPR art. 6(1)(b))
Store your medicines, doses and appointments; send reminders; show adherence	Contract (art. 6(1)(b)) and your explicit consent for health data (art. 9(2)(a))
Share your information with the caregivers you accept	Your explicit consent (art. 9(2)(a)), given when you accept each request
Manage subscriptions and plan access	Contract (art. 6(1)(b)); tax and accounting records under legal obligations (art. 6(1)(c))
Product analytics and crash reports	Your consent (art. 6(1)(a)) — off unless you switch it on
Answer support and privacy requests	Contract (art. 6(1)(b)) and legal obligation (art. 6(1)(c))
Keep the service secure, prevent abuse, keep short technical logs	Our legitimate interest in running a safe service (art. 6(1)(f))
The Android waiting list	Your consent (art. 6(1)(a))

Notifications and the lock screen

Reminders are scheduled on your device and, for some alerts, sent by our server through Apple Push Notification service or Firebase Cloud Messaging. Notification text passes through those services to reach your phone, and can appear on your lock screen.

By default a reminder names the medicine or appointment. You can turn that off in Settings → Notifications → “Show medicine names”: reminders then say “your medicine” or “an appointment”, both for the ones your phone schedules and for the ones our server sends to that device. People’s names in caregiver alerts are kept so you know whose dose it was.

Analytics and diagnostics

CareDose can collect a small amount of product-usage and crash information so we can see which parts of the app are used and what breaks. It is off unless you agree to it — the consent screen asks, separately from the health-data consent, and saying no never limits the app.

Who processes it. PostHog, on its EU Cloud (eu.i.posthog.com). Analytics data does not leave the European Union.

Who you are to it. A randomly generated identifier kept in the device’s own storage. It is not your Firebase account id, your email, your name or any Apple or Google identifier, and it is not shared with any other app.

What is collected. Which screens are viewed and which features are tapped; the platform, app version, language code, account mode and plan tier; and crash and error reports, covering Flutter framework errors, platform-dispatcher errors and isolate errors.

What is never collected. Medication names, doses, times, schedules, appointments, notes, titles, people’s names, email addresses, display names, account, patient, caregiver or invite identifiers, and raw exception messages. This is enforced in code, not only promised: every outbound event — crash reports included — passes through a deny list of property names that are dropped before sending, and any remaining text property is truncated to 40 characters. Native platform exceptions are not captured at all, precisely because their text would bypass that filter.

What is switched off. Session replay, surveys, feature flags, push-notification tracking and cross-app tracking are all disabled. CareDose does not ask for App Tracking Transparency permission and does not track you across other companies’ apps or websites.

How to change it. Settings → Privacy → “Share app usage”, at any time; it takes effect immediately. Events already sent are kept for up to 12 months and are erased together with your account if you delete it.

The Android waiting list

If you ask us to tell you when CareDose reaches Google Play, we store the email address you type, the language of the page you typed it on, and the date. Nothing else — no name, no IP address, no tracking pixel, and no advertising use. It is kept in a Cloudflare D1 database in our own account and is never sold, shared or used to email you about anything else.

We will write to you once, on the day CareDose is available on Google Play, and that email carries a one-click unsubscribe link. After that launch email we delete the list. You can leave earlier at any time by emailing caredose@pablogamero.com. The legal basis is your consent, which you may withdraw at any time.

Caregiver sharing is optional, user-initiated and revocable. Before you accept a request, the app tells you what that person will be able to see: your medicines, schedule, taken or missed doses, stock and appointments, and alerts about them. Either of you can end the sharing at any time from the Care tab; deleting either account removes the connection.

If you look after someone else through their own CareDose account, you only see what they chose to share with you. If you enter information about another person — a child or a relative who does not use the app themselves — make sure you are allowed to, for example as their parent, guardian or with their permission.

Processors and sub-processors

CareDose uses third-party service providers to operate the app. They process information on our behalf under data processing agreements:

Google Firebase — authentication for account sign-in, Firestore for schedule and app data storage (stored in the European Union, multi-region eur3), and Cloud Messaging for push notification delivery.
Cloudflare — the worker that schedules and sends notifications, processes account deletion and data requests, and keeps entitlements in sync; it also hosts this website. The worker keeps no database of its own, but Cloudflare retains short-lived execution logs, which can contain account identifiers but never medicine names.
RevenueCat — subscription management, entitlement status and paid plan access.
PostHog (EU Cloud) — product analytics and crash reporting, only if you opt in.

Apple (Sign in with Apple, the App Store, push delivery) and Google (Sign in with Google, Google Play) act as independent controllers under their own privacy policies when you use their services.

International transfers

Your app data is stored in the European Union. Google, Cloudflare and RevenueCat are US companies, and some processing or support access may happen outside the European Economic Area. Where it does, it is covered by the EU–US Data Privacy Framework for certified providers and by the European Commission’s Standard Contractual Clauses in each provider’s data processing agreement. You can ask us for a copy of the relevant safeguards. Analytics data stays in the European Union.

Data retention

Account, health data, care connections, devices and alerts — kept while your account exists, and erased when you delete it.
Subscription records — the RevenueCat record is erased with your account; Apple and Google keep their own purchase records under their policies and tax law.
Analytics — up to 12 months, and erased with your account.
Technical logs — a few days, as kept by Cloudflare.
Support and privacy emails — up to two years after the conversation ends, so we can show how a request was handled.
The Android waiting list — until the launch email, as described above.

Deleting your account

You can delete your account from inside the app: open Settings and tap Delete account at the bottom. That erases your medications, dose history, activity log, appointments, stock events, devices, alerts, care connections, plan membership, consent record, subscription entitlement records and the login itself, and asks RevenueCat and PostHog to delete your subscriber record and analytics. The page on deleting your account sets out exactly what goes and what stays. If you cannot reach the app, email us and we will process the request.

Your rights

Under the GDPR you have the right to:

access your data and get a copy of it;
portability — receive your data in a structured, machine-readable format (JSON);
rectification of anything inaccurate — most of it you can edit in the app;
erasure — delete your account in the app, or ask us;
restriction of processing and objection to processing based on legitimate interest;
withdraw consent at any time, without affecting earlier processing.

To ask for a copy of your data, use Settings → Privacy → “Request a copy of my data”, or write to caredose@pablogamero.com from the email address on your account. We answer within one month. We do not sell personal information and do not share it for cross-context behavioural advertising.

You also have the right to complain to a data protection authority. In Spain that is the Agencia Española de Protección de Datos (aepd.es), C/ Jorge Juan 6, 28001 Madrid. You can also complain to the authority where you live or work.

Security

We use administrative, technical and organisational safeguards designed to protect information: access rules that let only you and the caregivers you accept read your data, encryption in transit, secrets kept out of the app, and no health data in analytics or logs. No method of transmission or storage is completely secure. You are responsible for keeping your device and account credentials secure, and for choosing trusted caregivers when sharing data.

Age

You must be at least 14 to use CareDose on your own; the app asks you to confirm this. In Spain, 14 is the age from which you can consent to the processing of your personal data yourself. A younger person’s medicines can be managed by a parent or guardian from their own account. If you believe a child under 14 has given us information without permission, contact us and we will delete it.

Medical disclaimer

CareDose is not a medical device, does not diagnose, treat, cure or prevent disease, and does not provide medical advice. CareDose reminders, logs, adherence summaries and caregiver alerts may be delayed, incomplete, inaccurate or unavailable. Always consult qualified healthcare professionals about medications, dosing, side effects, missed doses and treatment decisions.

Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will tell you through the app, the website or email, and where a change affects what you consented to, the app will ask you again. The effective date above shows when this policy was last updated.

Contact

For privacy questions, account requests or data rights requests, contact Pablo Gamero at caredose@pablogamero.com.