Who we are
Meduva is a family medication tracker: reminders, dose history, drug-interaction awareness, and caregiver alerts for you and the family members you manage medications for. This policy explains what the Meduva app and its backend collect, why, who it's shared with, and how you can access, export, or delete it.
Meduva is not a medical device and does not provide medical advice, diagnosis, or treatment. See the in-app Medical Disclaimer (Settings → Legal) for details.
Information we collect
Account information
- Email address — required for every account, whether you sign up with Apple or with email and password.
- Sign in with Apple identifier — if you use Apple's sign-in option, we receive the identity token Apple issues (which may carry a private relay address if you choose to hide your email from us). Your password, if you sign up with email instead, is stored and verified by our authentication provider (Supabase Auth) — Meduva's own servers never see or store your plaintext password.
Family member ("profile") information
Whatever you enter when you add a profile for yourself or a family member you're helping:
- Name, relationship label (Me / Mom / Dad / Spouse / Child / Other)
- Date of birth, if entered (optional)
- Profile photo, if added (optional)
- Allergies, if noted
Medication and health information
This is the core of what Meduva stores, and we treat it as sensitive:
- Medication name, generic name, strength, form, dose quantity, instructions, prescriber, pharmacy, prescription number, start/end dates, days-supply, and any notes you add
- Prescription label photos, if you scan or upload one
- Your dosing schedule (frequency, times of day, food context)
- Dose history: every scheduled dose and how it was handled — taken, taken late, missed, or skipped (with an optional reason), each with a timestamp
- Drug-interaction check results generated for your medication list
- Adherence statistics computed from the above (e.g. "94% over the last 30 days")
Device and notification information
- A device push token, so we can deliver caregiver alerts and nudges to your phone
- Your notification preferences (quiet hours, alert delay, digest mode)
Subscription information
We store your subscription status (free or premium) and expiration date, kept in sync via webhook events from RevenueCat, our subscription-management provider. Meduva never receives or stores your payment card details — purchases are processed entirely by the App Store and RevenueCat.
Family sharing information
If you generate a family invite code to share a profile with another caregiver, or redeem one someone else shared with you, we record which accounts have access to which profile so the right people see the right family member's medications.
Support communications
If you email us for help, we keep that correspondence to respond to you and improve the app.
How we use your information
- To schedule, deliver, and record dose reminders and follow-ups
- To run drug-interaction and food-interaction checks against FDA drug label data (OpenFDA) and summarize the results in plain language
- To extract structured fields (medication name, strength, instructions, etc.) from a scanned prescription label photo, when on-device scanning alone isn't confident enough
- To send caregiver missed-dose alerts, daily digests, and "Nudge" messages to the family members you've chosen to share this with
- To manage your subscription and unlock the features it includes
- To respond to support requests and keep the app secure and working correctly
Doctor-visit PDF reports are generated entirely on your device and shared however you choose (AirDrop, email, print, Files) — generating one does not upload anything to our servers beyond the data already described above.
Who we share information with
We do not sell your personal information, and we don't use advertising SDKs or third-party ad trackers. We share data only with the service providers that make the app work, each limited to what it needs to do its job:
- Supabase — our database, authentication, and file-storage provider. Nearly all of the data described above is stored in Supabase's Postgres database (encrypted at rest, access-controlled per account) or its private file storage (for label photos, accessible only via short-lived signed links, never a public URL).
- OpenAI — when a prescription label photo needs the server-side scanning fallback, or when your active medications need a plain-language interaction summary, the relevant photo or medication names are sent to OpenAI's API for processing. It is our policy to use OpenAI's zero-data-retention account settings for this traffic, so this content isn't used to train OpenAI's models or retained by OpenAI beyond generating the response.
- OpenFDA (U.S. Food & Drug Administration's public drug label database) — we look up drug names against OpenFDA's public API to retrieve interaction and food-warning data. Only drug names are sent — never your identity, profile, or health history.
- Apple — Sign in with Apple (if you use it), delivery of push notifications via Apple Push Notification service, and processing of in-app purchases through the App Store.
- RevenueCat — receives your account identifier and purchase/entitlement events from Apple to keep your subscription status in sync. RevenueCat does not receive your medication or health data.
We may also disclose information if required by law, or to protect the rights, safety, or security of Meduva, our users, or the public.
Family and caregiver sharing
Meduva is built around families sharing medication information with each other, deliberately and by invitation only:
- A profile's owner can enable caregiver alerts so another family member is notified if a dose is missed.
- A profile's owner can generate a short-lived, single-use invite code (expires after 30 minutes) to grant another account access to that profile's medications, schedule, and dose history. Nothing is shared automatically — access is only granted when a code is generated and redeemed.
- Anyone with access to a profile can see that profile's medication list, schedule, and dose history in the app.
If you're setting up or managing Meduva on behalf of a family member (a parent, spouse, or child), you're responsible for having the appropriate authority or consent to enter and share their health information this way.
Children's information
Meduva accounts are created and held by an adult (18 or older). A family member's profile may represent a child (the "Child" relationship label exists for this), but that profile's information is entered and managed by the adult account holder — Meduva does not knowingly collect personal information directly from children, and the app is not directed at children for their own independent use.
Data retention and deletion
We keep your information for as long as your account is active, so the app can keep working the way you expect. You're always in control of it:
- Export your data anytime from Settings → Data → Export Data, which downloads a JSON copy of everything tied to your account — your profiles, medications, schedules, dose history, interaction checks, and registered devices.
- Delete your account from Settings → Data → Delete Account. This takes effect immediately: your account is locked (you can no longer sign in or use the app), and within 30 days our systems permanently delete your account and everything tied to it, including label photos in storage. This mirrors the App Store's required account-deletion behavior, and the 30-day window cannot be restarted or extended by repeating the request.
Security
Data is encrypted in transit (TLS) between the app, our servers, and our service providers, and encrypted at rest in our database. Prescription label photos are stored in a private file bucket and are only ever accessible through short-lived, signed links generated after we've confirmed you have permission to see that photo — never a public URL. Row-level security policies in our database scope every query to the accounts that actually have access to a given profile.
No method of transmission or storage is 100% secure, and we can't guarantee absolute security — but we design the system to minimize what could be exposed and to whom.
Your rights
Regardless of where you live, you can access, export, correct, or delete your information using the in-app tools described above, or by emailing us. If you're a California resident, this includes the rights the California Consumer Privacy Act (CCPA) gives you to know what personal information we collect, request its deletion, and request a copy of it — all of which the in-app Export Data and Delete Account tools already provide directly, at no cost.
Not a HIPAA-covered entity
Meduva is offered directly to consumers, not through a doctor's office, hospital, insurer, or other healthcare provider — so the Health Insurance Portability and Accountability Act (HIPAA) does not apply to how we handle your information. We still treat medication and health data as sensitive and protect it accordingly, as described throughout this policy.
Changes to this policy
If we make material changes to this policy, we'll update the "Last updated" date above and, for significant changes, provide notice in the app.
Contact us
Questions about this policy or your data? Email privacy@meduva.app or reach general support at support@meduva.app.