Privacy Policy

Introduction & scope

MedKit Tracker is a personal medicine-kit inventory app. It helps you keep track of the medications in your home — their name, dosage, form, category, expiration date, quantity, notes, an optional photo of the packaging, and barcode — across one or more kits. It sends expiration reminders, supports family sharing, and offers home-screen widgets.

MedKit Tracker is not medical advice and not a medical device. It is an inventory tool only: it does not diagnose conditions, recommend dosages, or warn about drug interactions. Always consult a qualified healthcare professional for medical decisions.

This policy covers the MedKit Tracker iOS app and this policy alone. It is published by Andrey Sysoev, an independent app developer who acts as the data controller for the limited processing described below. Use of the app is also subject to Apple's standard licensed-application end-user license agreement, which this policy does not replace.

Our key principle

The rest of this document explains the details: the categories of data involved, where each one lives, the legal bases we rely on, and the controls you have.

What data we collect

Because there is no MedKit account and no developer server, most of what follows never leaves your device or your iCloud. Here is every category, what it contains, and where it lives.

1. Medication & kit data you enter (health-related).

   Medication name, dosage, form, category (including custom categories), expiration date, quantity, notes, an optional photo of the packaging, and barcode value; plus kit name, icon, color, and location. Stored locally with Core Data (encrypted at rest by iOS) and synced to your own iCloud via Apple CloudKit.

2. Apple ID / iCloud identity.

   The app has no separate account and no login. It uses the Apple ID already signed in on your device for iCloud sync and sharing. We never see your Apple ID password or credentials.

3. Family sharing data.

   When you choose to share a kit, its medications become accessible to the people you invite, through Apple CloudKit Sharing (CKShare). Participants' names and Apple ID identifiers may be visible to the kit owner, and the owner's shared content is visible to participants. Sharing is always initiated by you through the iOS share sheet.

4. Usage analytics — optional, off by default, consent required.

   Provided by AppMetrica, a Yandex service. Collects anonymous behavioral events (e.g. screen and feature usage, scanner used, paywall shown, subscription started), plus device and technical info (device model, OS version, app version, language, a per-install identifier, IP address) and crash / diagnostic reports. It never collects medication names, photos, notes, or any health data. Disabled until you explicitly opt in, and can be turned off at any time (see §8).

5. Purchases.

   Subscription status and entitlements via Apple StoreKit. Apple processes the payment; we receive only transaction and entitlement information. We never receive or store your payment card data.

6. Camera.

   Used for barcode scanning and OCR text recognition. Processing happens entirely on-device (Apple VisionKit / Vision); scanned camera frames are not stored or transmitted. Photos you deliberately attach to a medication are saved as medication data, per category 1.

7. Local notifications.

   Expiration reminders and the monthly digest are scheduled on your device. No notification data is sent to us.

Why we use data & legal bases

Where the EU / UK General Data Protection Regulation applies, we rely on the following legal bases for each purpose.

Third parties & sub-processors

These are the only external recipients of any data. The developer runs no other servers or processors.

If you never opt in to analytics, no data is ever sent to Yandex.

International data transfers

• Analytics (only if enabled). If you opt in, analytics and crash data may be transferred outside your country or the EEA to Yandex, whose AppMetrica infrastructure stores data in the European Union (Finland) and in Russia. This transfer takes place only with your consent, which you can withdraw at any time (see §8). Yandex offers Standard Contractual Clauses and IP-anonymization within its Data Processing Agreement linked above.
• iCloud data. Your medication and kit data is handled by Apple across its global infrastructure under Apple's own terms. The developer does not control where Apple stores it.

Data retention

• Medication & kit data. Retained until you delete the items, delete the app, and/or remove the data from iCloud. The developer holds no copy and cannot retain it.
• Analytics data. If enabled, retained by AppMetrica according to its own retention settings and policy. Withdrawing consent stops further collection; existing anonymous data is handled per Yandex's terms.
• Purchases. Transaction records are retained by Apple under Apple's retention practices.

Your choices & consent management

Analytics consent is off by default. You can opt in on the onboarding "Help Improve MedKit" screen, and change your choice at any time:

Settings › Privacy › Share Usage Analytics

Turning it off stops all analytics and crash reporting immediately. Other controls live with Apple, not with us:

• iCloud sync is controlled by your device's iCloud settings.
• Notifications are controlled in iOS Settings.

Your rights

Subject to your local law — including the EU / UK GDPR, and the CCPA for California residents — you have the right to access, rectify, erase, restrict, and object to processing, and the right to data portability.

• Erasure & rectification. Because your medication data lives only on your device and in your iCloud, you exercise most of these directly in the app — edit or delete any item, kit, or the whole app at any time.
• Export & portability. The app provides built-in CSV and PDF export of your kits (a PRO feature) so you can take your data with you.
• Withdraw consent. You can switch analytics off at any time (see §8), with no effect on the app's core functionality.
• Complaint. You may lodge a complaint with your local supervisory authority — for example your national Data Protection Authority in the EU/EEA, or the Information Commissioner's Office (ICO) in the UK.

To exercise any right that you cannot complete in-app, contact andrey@sysoev.io. Note that since the developer holds no copy of your medication data, certain requests can only be fulfilled by you on your own device and iCloud.

Children's privacy

MedKit Tracker is a household inventory tool that offers no medical recommendations of any kind. It is not directed to children and does not knowingly collect personal data from children under 16. If you believe a child has provided data through the app, contact andrey@sysoev.io and any such data will be deleted promptly.

Security

• Local storage is encrypted at rest by iOS Data Protection; data in transit is protected by TLS.
• Your iCloud / CloudKit data is encrypted by Apple in transit and at rest.
• No third-party server ever holds your health or medication data.
• Authentication relies on your device's Apple ID — the app keeps no password store of its own.

Changes to this policy

We may update this policy from time to time — for example if the app gains new features. When we do, we will revise the "Last updated" date at the top of this page, and for material changes we will provide notice within the app. We encourage you to review this page periodically.

Contact

Questions about this policy or your privacy? Reach the developer directly:

Andrey Sysoev — independent app developer
Email: andrey@sysoev.io