FamilyDose

Privacy Policy

Last updated August 2026

This policy has not yet been reviewed by a lawyer. It is written to accurately describe what FamilyDose actually collects and does today, and to lay out the real legal frameworks that apply to it, so the app can be submitted for review. A final, counsel-reviewed version will replace this before Paid Soft Launch, particularly given this app handles children's health information.

What FamilyDose is

FamilyDose is a tool for tracking and organizing medications for the people in your household, including reminders, dose history, symptoms, and a shared record everyone in the family can see.

Medical disclaimer

FamilyDose is not a medical device and does not provide medical advice, diagnosis, or treatment. Nothing in the app diagnoses a condition, recommends a medication, or tells you what dose to give. It is built to help you and your family keep track of decisions your doctor or pharmacist has already made. It never replaces them. Always follow your prescriber's instructions, and consult a qualified healthcare provider (not FamilyDose) with any medical question, especially before starting, stopping, or changing a medication.

Who this policy covers

FamilyDose is for use by adults (18 or older) managing medications for themselves or for someone in their care, including children. This is explicit and by design: a child or other dependent does not create their own account, sign in, or provide their own information at any point. Everything about them (name, date of birth, medications, symptoms) is entered and controlled entirely by the adult household member responsible for their care. FamilyDose does not knowingly collect information directly from a child, and has no sign-up or login path a child could use on their own.

This is also why the U.S. Children's Online Privacy Protection Act (COPPA) does not apply to FamilyDose: COPPA governs operators that knowingly collect personal information directly from children under 13. FamilyDose has no interface, input, or account a child under 13 (or of any age) ever interacts with. Every piece of information about a patient profile, including a child's, is entered by the adult responsible for their care, not by the child.

What we collect

Specifically, and only, the following:

Account information: your email address, and either a password or your Apple ID identity if you sign in with Apple.
Household and patient records: the name of your household, and for each patient you add: their name and, optionally, date of birth. A patient profile can represent a child, an aging parent, or the account holder themselves.
Medication records: medication name, dose, route, category, schedule, and any notes or diagnosis you choose to enter, plus stock counts if you choose to track them.
Dose history: when a dose was marked given, skipped, or snoozed, and which household member logged it.
Symptom entries: temperature, severity, tags, and any notes you log.
Prescription photos: if you scan or upload a prescription label to add a medication faster. Most scans are read directly on your device and the photo never leaves it. When the on-device reading isn't confident enough, the photo is sent to OpenAI's API for a second, more accurate reading. Either way, nothing from a scan is ever saved as a medication automatically. You always review and confirm every field yourself before it's added.
Crash and error reports: if the app crashes or hits an error, technical details (device type, OS version, and what the app was doing) are sent to Sentry, a crash-reporting service, so we can fix the bug. This does not include your medication or symptom data.
Basic usage events: a small number of one-time milestones (such as completing sign-up or adding your first medication), tied to your account, used only to understand whether the app is working for new households. Never sold, never used for advertising.
Device sign-in information: for the "where you're signed in" security screen, the type of device and when it was last active, so you can see and revoke access to your own account.

Who can see your data

Only the people you've explicitly invited into your household. Whoever owns the household can set what each member is allowed to see or do (for example, limiting a caregiver to logging doses without editing medications). Nobody outside your household, including us, can browse your family's data. Staff access is limited to what's needed to investigate a support request you've raised, or to keep the service running.

Who we share it with

We do not sell your data, and we do not share it for advertising. The only outside parties involved are the infrastructure we use to run the app, each bound by its own agreement to use your data only to provide that specific service:

Supabase: our database and file storage provider. All of the data above lives here, encrypted in transit and at rest. Supabase hosts this project's data on servers in Japan.
OpenAI: only for the low-confidence prescription-scan fallback described above.
Sentry: crash and error reports only, as described above.
Resend: sends account emails (verification codes, password resets, alert notifications) on our behalf.

Where your data is processed and stored

FamilyDose is operated from the United Arab Emirates. The infrastructure above stores and processes data outside the UAE (Supabase's hosting is in Japan; OpenAI, Sentry, and Resend operate internationally, including in the United States). Where UAE law requires a specific basis for that transfer and no formal adequacy finding or standard contractual clauses have yet been published for a given destination, we rely on our processors' own contractual data-protection commitments as the safeguard, consistent with current UAE Data Office guidance. This is an evolving area of UAE law and is flagged here explicitly, not glossed over, as one of the items needing counsel review before Paid Soft Launch.

A separate, more specific UAE law is also relevant here: Federal Law No. 2 of 2019 Concerning the Use of Information and Communication Technology in Health Fields imposes a general prohibition on transferring, storing, generating, or processing "Health Information" tied to the provision of health services outside the UAE, distinct from and stricter than the PDPL. Ministerial Resolution No. 51 of 2021, which implements that law, lists specific exceptions to this prohibition, including one for data collected by simple medical devices and tools designed for personal use which require users to supply simple medical data, with fitness apps and connected personal devices given as the example. FamilyDose, where household members manually enter their own medication and symptom data rather than receiving it from a healthcare provider, fits this description closely.

Our position, not yet confirmed by counsel: based on the published exception under Resolution 51 of 2021, this is our reasoned position for why FamilyDose falls within the "simple devices and tools" exception rather than the Health Data Law's general prohibition, and why Supabase's Japan-based hosting is consistent with it. This has not yet been confirmed by counsel and remains one of the items to formally verify before Paid Soft Launch, not an assumption we're treating as final.

How long we keep your data

We keep your account and household data for as long as your account is active. If you delete your account (see "Your controls" below), your data is removed immediately and permanently, not retained on a schedule afterward. Crash reports in Sentry and system logs are kept only as long as needed to diagnose and fix issues, on a rolling basis, and are not tied to your identity beyond what's needed for that purpose.

Your privacy rights

Regardless of where you live, you can exercise all of the rights below by contacting us at the email at the bottom of this page, or, for deletion specifically, directly in the app under Settings. We will act on any request within 30 days.

Access: get a copy of the personal data we hold about you.
Correction: fix inaccurate data (most of this you can already edit directly in the app).
Erasure: delete your account and personal data (available instantly and directly in Settings, no need to wait on us).
Restriction: ask us to limit how we use your data while a request is being resolved.
Portability: get your data in a format you can take elsewhere.
Objection: object to a particular use of your data.

These rights are drawn from the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), which is the primary law governing this policy, and mirror the same baseline of rights found in the EU's GDPR. We apply this same set of rights to every FamilyDose user, not only where a specific law happens to require it.

Under the UAE PDPL specifically: the controller responsible for your personal data is FamilyDose (contact details below). We process your data for the purposes described in "What we collect" above, running the household medication-tracking service you've signed up for, keeping the household's shared record in sync, and the limited crash-reporting and product-analytics purposes also described above, and for no other purpose. The categories of data processed and the third parties involved are listed in full above; nothing is processed or shared beyond what's described on this page.

If you're in the European Economic Area or United Kingdom

We extend the same rights above to you as a matter of policy. If you believe we haven't handled your request properly, you also have the right to lodge a complaint with your local data protection supervisory authority.

If you're a California resident

In the categories used by the California Consumer Privacy Act, the personal information described in "What we collect" above falls under identifiers (email), and under health information you choose to provide (medication, dose, and symptom records). We do not sell or share your personal information for cross-context behavioral advertising, and we have not done so in the preceding 12 months. You have the right to know what personal information we collect about you, to delete it, to correct it, and to opt out of any sale or sharing (there is none to opt out of). Exercising any of these rights will never result in different treatment, pricing, or a lower level of service.

Your health information (medication, dose, and symptom records) is "sensitive personal information" under the California Privacy Rights Act, which gives you the additional right to limit its use to only what's necessary to provide FamilyDose to you. We already use it for no other purpose, not for advertising, not for analytics beyond the basic milestones described in "What we collect", but you can still make this request explicitly at the email below if you'd like it on record.

If you're a Washington resident

Washington's My Health My Data Act (MHMDA) protects "consumer health data" that falls outside HIPAA, exactly the category FamilyDose's medication, dose, and symptom records fall into, and applies regardless of where the company operating the app is based. MHMDA requires a genuinely stand-alone Consumer Health Data Privacy Policy, separate from this page: see our Consumer Health Data Privacy Policy for what categories of consumer health data we collect, why, who we share it with, and how to exercise your access, deletion, and consent-withdrawal rights.

Is FamilyDose subject to HIPAA?

No. FamilyDose is a consumer app used directly by families, not a healthcare provider, health plan, or healthcare clearinghouse, and it does not transmit your data to one on your behalf, the two things that would make it a "covered entity" or "business associate" under the U.S. Health Insurance Portability and Accountability Act (HIPAA). FamilyDose is not built to send information to your doctor, pharmacy, or insurer, and doesn't integrate with any of them today. If that ever changes, this policy will be updated to reflect it accurately, not left stale.

Separately, because FamilyDose is a consumer health app that maintains what U.S. regulators call a personal health record, it is subject to the U.S. Federal Trade Commission's Health Breach Notification Rule. If a breach of your unsecured personal health data ever occurred, we are required to notify you, and in some cases the FTC and the media, under that rule, a real, separate obligation from HIPAA, and one we take seriously regardless of whether HIPAA itself applies.

Your controls

You can delete your account, and everything associated with it, at any time directly in the app under Settings. This is immediate and permanent, not a request that waits on us. If your household is shared with other members, your own account and access are removed; medication records the household still needs stay with the household unless everyone has left.

To request a copy of your data instead of deleting it, or to exercise any of the other rights listed above, contact us at the email below and we'll respond within 30 days.

If Sign in with Apple is used

If you delete your account, we also revoke the Apple token that let FamilyDose sign you in, so the connection between your Apple ID and FamilyDose is fully removed, not just your data inside the app.

If FamilyDose changes ownership

If the company behind FamilyDose is acquired or merges with another company, your data may transfer as part of that transaction, but it stays subject to the commitments in this policy (or one at least as protective) unless you're given clear notice and a choice otherwise.

Changes to this policy

If we make a material change to this policy, we'll update the "Last updated" date above and, for a change significant enough to affect your choices, notify you directly (by email or in the app) rather than relying on you to check back.

Questions

Contact privacy@familydose.app with any privacy question, or to request or delete your data.