FamilyDose Subprocessors and Other Services

Beta version. This document has not been reviewed by a lawyer.

Version 2.0

Date: 2026-10-18

What changed in this version

FamilyDose is operated by Primelink Digital Online Seller, a sole establishment licensed in Dubai.
The list is the same as the Privacy Policy (section 9) and our app store privacy answers.
Telegram and the outside chart library (jsDelivr) are no longer used and were removed.
We added Cloudflare Turnstile, which checks that sign-ins come from people, not bots.

How to read this page

We use the service providers listed here to run FamilyDose. They process data only to provide their service to us.

"Your data" means anything about you, your household or a patient, including an IP address.

Your data leaves the country you live in. It is stored in Japan (Tokyo) by Supabase on Amazon Web Services. Some of it is processed in the United States for email, push notifications, error reports, the website and shared care cards, medicine name suggestions and, only with your consent, the closer reading of a prescription photo. Our staff view it from the United Arab Emirates.

We do not use advertising networks, third-party analytics or data brokers. We do not sell data. Usage events stay in our own database.

The service providers

Service provider	What it does for us	What it receives	When	Where	Health data?
Supabase (on Amazon Web Services)	Database, sign-in, file storage, server functions	Everything the app stores: account (name, email, date of birth), household and members, people cared for, medicines, doses, symptoms, temperatures, growth, appointments, notes, files and photos, consent records, settings, usage events	Always	Japan (Tokyo, AWS ap-northeast-1)	Yes
Resend	Sends email	The recipient's email address and the email's words: invitations, sign-in codes, dose and missed-dose emails (a medicine name unless you hide medicine names in email), support replies	When an email is sent	United States	Yes, in email words, unless names are hidden
Expo push service, then Apple Push Notification service	Delivers push notifications	The phone's push token and the notification's words (a medicine name unless you hide medicine names in push)	When a push is sent	United States (Expo); Apple worldwide	Yes, in notification words, unless names are hidden
Apple	Sign in with Apple, App Store and in-app purchases, TestFlight	Your Apple sign-in identifier and the email Apple shares; purchase records; crash and usage data only if you share it with developers in iOS settings	Sign-in, purchase	Apple, worldwide	No
Sentry (Functional Software Inc.)	Crash and error reports, app and server	The error, the device and app version, a scrubbed message; no names, emails, medicine words or IP address	When something fails	United States	No (scrubbed)
OpenAI	Reads a prescription photo more closely, only after you turn on "Closer reading" (its own consent)	The prescription photo, not stored by OpenAI for training	Only with that consent, only that photo	United States	Yes
US National Library of Medicine (Clinical Tables, RxTerms)	Medicine name suggestions while you type	The letters typed into the medicine name box; no account, person or household data	While you type a name	United States	The typed name only
Vercel	Hosts the website (familydose.app), the shared care card pages and our admin dashboard	When a care card link is opened: the card the family chose to share (name, allergies, conditions, medicines, emergency contacts, insurance front photo if added); website visits (standard request logs)	When a link is opened or the site is visited	United States and edge locations	Yes, for a shared care card
Zoho Mail	Our support and privacy mailboxes	Whatever you write to support@familydose.app or privacy@familydose.app	When you write	Zoho region of the mailbox [CONFIRM: the Zoho data centre, from the Zoho account settings]	Only if you write it
Healthchecks.io	Watches that the reminder job runs	A ping with no user data	Every run	European Union	No
Cloudflare Turnstile (Cloudflare, Inc.)	Checks that a sign-in, sign-up, email code or password reset comes from a person, not a bot	Your IP address, browser or app signals and a check token; never your email, password, name or any health data	Each sign-in, sign-up, code or reset	United States and Cloudflare's worldwide network	No
Firebase Cloud Messaging (Google)	Delivers push notifications on Android, once the Android app is available	The Android push token and the notification words (medicine names hidden if you choose)	When a notification is sent to an Android phone	Google, worldwide	Yes, in notification words, unless names are hidden

A shared care card link is your own choice to share.

On your phone

Text in a photo is first read on the phone by Google ML Kit. The photo stays on the phone and is not sent to Google. [CONFIRM: whether Google ML Kit sends usage metrics about the library to Google, and if so add it to the list above]

Links to each provider's own privacy page

Supabase: https://supabase.com/privacy
OpenAI: https://openai.com/policies/privacy-policy
Expo: https://expo.dev/privacy
Apple: https://www.apple.com/legal/privacy/
Sentry: https://sentry.io/privacy/
Vercel: https://vercel.com/legal/privacy-policy
Zoho: https://www.zoho.com/privacy.html

Links for Resend, the US National Library of Medicine and Healthchecks.io are left out until the addresses are checked. [CONFIRM: URLs]

Agreements

[CONFIRM: that a data processing agreement is accepted or signed with Supabase, Resend, Expo, Sentry, OpenAI, Vercel and Zoho. Apple acts under its own developer terms.]

Changes to this list

We will update this page before a new service provider starts to receive your data. If the change affects your choices, the app will ask you to accept the updated Privacy Policy.

Questions: privacy@familydose.app

Primelink Digital Online Seller, a sole establishment licensed by the Department of Economy and Tourism, Dubai, licence no. 1603034, P.O. Box 48800, Dubai, United Arab Emirates. Contact: support@familydose.app