Privacy Policy
1. Who we are
MedRec List (“MedRec List”, “we”, “us”) is operated by:
[COMPANY LEGAL NAME]
[MAILING ADDRESS]
This policy covers the MedRec List mobile app (the “app”) and the website medreclist.com (the “website”).
2. Summary
- Your medication, allergy, question and person information is stored only on your device, encrypted.
- Label photos are processed on your device and are never uploaded.
- An account is optional. It exists only for encrypted backup.
- Your backup is encrypted on your device with your passphrase before upload. We can't read it or recover it.
- Ads are non-personalized and contextual. No health data is used or shared for advertising.
- We do not sell personal data or health data.
3. Information that stays on your device
When you use the app, the information you enter or scan is stored only on your device, in encrypted form. This includes:
- the people you add;
- medications, over-the-counter products and supplements;
- allergies;
- questions and notes; and
- the results of the app's interaction checks.
We do not receive this information. Label photos are processed on your device to read the text and are never uploaded to us or anyone else.
When you choose to share your list as a PDF or QR code, you decide who receives it. A QR code contains the list itself, so anyone who scans it can read it. We do not receive what you share.
4. Information we keep if you create an account
You can use the app without an account. If you create an optional account to back up your list, our server stores:
| Information | Why we keep it |
|---|---|
| Account ID | To identify your account and your backup. |
| Sign-in provider (Apple, Google or email) | To let you sign in the same way next time. |
| Email address | To sign you in, send sign-in codes and reply to your requests. |
| Date the account was created | To manage the account. |
| Version of the Terms of Use you accepted | To keep a record of your agreement. |
| Encrypted backup file | To let you restore your list. |
Your encrypted backup
Before a backup leaves your device, the app encrypts it with a passphrase that you choose. We never receive your passphrase. We cannot read your backup, and we cannot recover it if you lose your passphrase.
Sign-in with Apple or Google
If you sign in with Apple or Google, that company confirms your identity and gives us an identity token that includes your email address. If you use Apple's “Hide My Email” option, we receive a relay address instead. We do not pass any list data to Apple or Google for sign-in.
5. How we use information
We use the account information above only to:
- create and run your account;
- store your encrypted backup and return it to you when you restore;
- send sign-in codes to your email;
- reply to your questions and requests;
- protect the service against abuse; and
- meet legal requirements.
6. Service providers
We use these companies to run MedRec List. They act on our behalf.
| Provider | What they do | Information involved |
|---|---|---|
| Supabase | Accounts and backup storage | Account information and the encrypted backup file |
| Cloudflare | Delivers this website and app data downloads, such as reference data updates | Technical information needed to deliver content, such as IP address. No list data. |
| Email delivery for sign-in codes; AdMob ads | Email address (email delivery). For ads, technical information needed to show a non-personalized ad. No health data. | |
| Apple and Google | Sign-in | Identity confirmation and email address |
We may also disclose information if the law requires us to.
7. Advertising
The app shows non-personalized, contextual banner ads on its home screen only. Ads are served by Google AdMob. We ask AdMob for non-personalized ads only. No health data is used or shared for advertising, and no ads appear on screens that show medication, allergy, check results, sharing or camera content.
8. This website
This website does not use cookies, analytics, trackers or third-party content. Cloudflare hosts the website and processes technical information, such as IP addresses, to deliver pages and protect the website.
9. No sale of data
We do not sell personal data or health data. We do not share personal data for targeted advertising.
10. How long we keep information
We keep your account information and encrypted backup until you delete your account. When you delete your account, we delete the account and the backup. Information on your device stays there until you delete it or delete the app.
11. Security
Your list is encrypted on your device. Backups are encrypted on your device before upload. Information moves between the app and our providers over encrypted connections. No system is perfect, so please keep your device and your passphrase secure.
12. Your choices and rights
- Use the app without an account. Nothing about your list reaches our server.
- Delete your account in the app or by email. See Delete your account.
- Delete local data by deleting the app.
Depending on your state, you may have the right to know what personal data we hold, to get a copy, to correct it, to delete it, and to opt out of sale or targeted advertising (we do neither). To make a request, email [email protected]. We may need to confirm that the request comes from you. You may use an authorized agent where state law allows.
If we deny your request, you may appeal by replying to our decision or by emailing [email protected] with “Appeal” in the subject line. We will not treat you differently for using your privacy rights.
See also our Consumer Health Data Privacy Policy.
13. Children
You must be 18 or older to create an account. A parent or guardian may keep a child's list on their own phone. That list stays on the parent's device like any other list. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it.
14. United States only
MedRec List is offered only in the United States. Our service providers store account information and backups in the United States. [LEGAL REVIEW: confirm storage region with each provider.]
15. Changes to this policy
We will post any changes on this page and update the effective date.
16. Contact us
Privacy requests: [email protected]
Legal: [email protected]
[COMPANY LEGAL NAME]
[MAILING ADDRESS]