Privacy Policy

1. Who uses LydraCare

An account can be used in different ways, and what we collect depends on how you use it:

• Personal: you manage your own medications, appointments and check-ins.
• Caregiver: you set up and look after one or more seniors. A senior's profile can be created by the caregiver first, and the senior can later open an invite and take over that account as their own.
• Senior: you use the app for your own care, with or without a caregiver linked to you.
• Family member: you are invited into someone's Family Circle and see only what that person allows.

2. What we collect

Account details

• Name, email address and phone number.
• Your password. We never store it in readable form; it is stored hashed.
• One-time verification codes we email you to confirm your email or reset your password.
• Language and time zone, so reminders arrive at the right local time.
• Your birthday as day and month only (no year), if you add it, so your circle can send birthday wishes.
• A profile photo, if you add one. If you sign in with Google, we receive your Google account identifier, email, name and profile picture.

Health and care information you enter

• Medications: name, dose, the times and days to take them, and an end date.
• Whether each dose was taken, skipped or missed, and when. A dose with no answer 30 minutes after its time is shown as missed. If you clear a dose by mistake you can undo it within 5 seconds, which removes that entry.
• Appointments: doctor's name, date, time, notes, the place, and whether you tapped "on my way" or "I attended".
• Reminders and tasks you create.
• Daily check-ins: how you feel (mood) and any pain level.
• Exercise sessions: name and length.
• Emergency contacts: the names and phone numbers of people you choose to add (up to 10). Please add only people who are happy to be listed.
• Birthday wishes you send or receive, with the short note you write.

Family and caregiver links

• Who is connected to whom as caregiver, senior or family member, and the permissions you give each family member.
• Invite details the inviter types: the person's name, email, phone and relationship (for example "Son").
• When someone opens an invite, the email they type to prove it is meant for them, and a notification token so we can tell them when it is approved. These arrival requests expire after 24 hours.

Location

• When you tap "use my current location" or search for a place for an appointment, and when you send an alert to your family. We do not track your location in the background.
• Family alerts: to send an alert to your family (including "Medical emergency" and "I fell"), the app needs location access. It finds your current location and sends it, as a Google Maps link, to the family circle members who receive your alerts. The link goes only in that notification; we do not store your location. If you do not allow location, the alert is not sent, and the app asks you to allow it.
• The place you pick for an appointment, and places you save (such as "Home"), are stored encrypted.
• What you type in place search, and the coordinates when you use your current location, are sent through our server to Google to find addresses.

Device and technical information

• A push-notification token and your phone type (Android or iPhone), so we can send alerts and reminders.
• Your IP address and basic technical logs, used to keep the service secure and to limit abuse.
• Sign-in tokens are kept in your phone's secure storage so you stay logged in.

Subscriptions

• Your plan, its status, your free-trial end date, your renewal date, and a purchase reference from Google Play or the Apple App Store. We never receive your card or bank details.

When you contact us

• What you send us, such as a support message or an account-deletion request, and your email address.

3. Permissions the app asks for

You can change these any time in your phone's settings. The app still works without most of them, but some features need them.

• Notifications and exact alarms: to ring and alert you when a dose or appointment is due, even when the app is closed. The app also restarts these reminders after your phone reboots.
• Contacts: only when you choose to add an emergency contact from your phone. We read the contact you pick; we save only that person's name and number. We do not upload your address book.
• Photos and camera: only when you choose a profile photo.
• Location: only when you tap "use my current location" for an appointment, or send an alert to your family. Foreground only, never in the background.

4. How we use it

• To run the app: show your medications, appointments and reminders, record doses, and keep your family circle in sync.
• To send the notifications and emails described in the next section.
• To let caregivers and family members see what you allow them to see, and to alert them when a dose or appointment is missed.
• To verify and manage your subscription.
• To keep the service secure, prevent abuse, fix problems and improve reliability.
• To answer your questions and handle deletion requests.

We do not sell your personal information. We do not show advertising, and we do not use your health information for advertising or to build marketing profiles.

5. Notifications and emails

• Push notifications: dose and appointment reminders, missed-dose alerts (30 minutes after the dose time), a follow-up when a missed dose is taken late, and missed-appointment alerts, all sent to the caregivers and family members you allow, family invites and approvals, birthday messages, and alerts someone sends to their circle. Notifications can appear on your lock screen, so turn them off or hide their contents in your phone settings if others can see your screen.
• Account emails: verification and password-reset codes.
• Reminder emails: on by default. We email you when a task is due and the day before and 2 hours before an appointment. Turn them off in Settings.
• Weekly report: off by default. If you switch it on, we email you a PDF summary of your last 7 days every Sunday. A caregiver who switches it on also gets a PDF for each senior they look after. Turn it off in Settings.

6. Who can see your information

• You can see everything you enter, including a 7-day history of your doses, check-ins, appointments and reminders. Past appointments and reminders stay in your lists for 3 days, then only in that history.
• Your caregiver: if a caregiver looks after you, they can see and manage your medications, appointments and check-ins, and receive your missed-dose (including "taken late") and missed-appointment alerts. A caregiver can only act for seniors linked to them.
• Family members: only the categories the Family Circle owner turns on for them: check-ins, medications, appointments, alerts and exercise. The owner can change this or remove a member at any time. Family members never see other people's information.
• Birthday: your day and month are used to remind the people in your circle to send you wishes.
• Emergency contacts and saved places are private to your account.
• Invites: an invite link never signs anyone in by itself. The invited person must type the invited email, and the person who invited them must approve it. Invite links and codes are valid for 24 hours.

We do not share your data with anyone else, except the service providers below who process it for us, or when the law requires it.

7. Service providers

These companies process data on our behalf, only to provide LydraCare:

• Supabase: database hosting.
• Hostinger: server hosting and email mailboxes.
• Resend: sending emails (codes, reminders, weekly reports).
• Cloudinary: storing profile photos.
• Expo, Google (Firebase Cloud Messaging) and Apple: delivering push notifications.
• Google: "Continue with Google" sign-in, and address search and geocoding (requests go through our server, so Google does not receive your account details).
• Google Play and Apple: app distribution and subscriptions. They tell us whether your plan is active.

These providers may store or process data in countries other than yours, including the United States and other countries. We choose providers that protect data, but local laws there may differ from those in Canada.

When you share an invite link or a birthday card from the app, you choose where it goes (for example a messaging app). That app's own privacy policy applies to what you send there.

8. How long we keep it

• While your account is active, we keep your information so the app works.
• Automatically removed: expired or used verification codes and sign-in sessions, missed-dose alert markers, and cached place lookups (30 days) are cleared by a daily clean-up.
• Removed right away when you delete them: emergency contacts, saved places and exercise entries.
• Hidden from view: a medication, appointment or reminder you delete in the app disappears from your screens but is kept in our database (so your dose history stays accurate) until your account is deleted.
• Invite requests expire after 24 hours.
• When you delete your account, your personal data is deleted from our systems (see below). Copies in routine backups may remain for a short time until they are overwritten. We may keep something longer only where the law requires it.

9. Deleting your account

You can delete your account yourself: open Settings in the app and choose Delete Account. If you cannot open the app, use the request form on our delete account page or email support@lydracare.com from the address on your account.

Deleting removes your profile, photo, medications and dose history, appointments, reminders, check-ins, exercise, emergency contacts, saved places, push tokens, subscription record and family circle. This cannot be undone.

If you are a caregiver: senior profiles you created that the senior has not yet claimed are deleted with your account. A senior who has claimed their account keeps it and all their data; it is only unlinked from you. Your subscription is not cancelled by deleting your account, so cancel it in Google Play or the App Store too.

10. Your choices and rights

• Access and correct: you can see and edit most of your information in the app. For anything else, email us and we will help.
• Withdraw consent: you can stop at any time by turning off permissions in your phone, switching off emails in Settings, or deleting your account.
• Choose who sees what: change a family member's permissions or remove them whenever you like.
• Ask for a copy: email us from your account address and we will provide the information we hold about you.
• Complain: if you are in Canada and are not happy with how we handled your information, you can contact us first and, if needed, the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta. Depending on where you live you may have further rights; contact us to use them.

We will reply as soon as we can, and normally within 30 days.

11. Security

Data travels over encrypted connections (HTTPS). Passwords are hashed, appointment places and saved places are encrypted, sign-in tokens are kept in your phone's secure storage, and access to our servers is restricted. No system is perfectly secure, so please use a strong password and keep it private. If we learn of a breach that puts you at real risk, we will tell you as the law requires.

12. Children

LydraCare is not intended for children under 13 and we do not knowingly collect their information. If you believe a child has given us information, email us and we will delete it.

13. Not medical advice

LydraCare is a reminder and organising tool. It does not give medical advice and is not a substitute for a doctor. In an emergency, call your local emergency number.

14. Changes

If we change this policy we will update the date above and, for important changes, tell you in the app or by email before they take effect.

15. Contact

LYDRA Inc., Calgary, Alberta, Canada · support@lydracare.com