Version: 2.1
Last Updated: April 28, 2026
Effective Date: April 28, 2026
1. Introduction
This Data Retention Policy explains how REMEDIO manages, stores, and deletes user data in compliance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other international privacy standards.
REMEDIO implements a zero-knowledge architecture with end-to-end encryption (E2E) for all sensitive health data, ensuring that even REMEDIO staff cannot access or decrypt user content.
2. Data Categories and Retention Periods
2.1 Active User Accounts
| Data Category | Retention Period | Encryption | Description |
|---|---|---|---|
| User Profile Data | Account lifetime | Plaintext (non-sensitive) | Username, email, subscription tier — required for login and notifications. |
| Authentication Data | Account lifetime | Hashed (scrypt N=2^19) | Passwords never stored in plaintext; session tokens secured. |
| E2E Encryption Keys | Account lifetime | Wrapped (password-derived) | Master and recovery keys encrypted client-side; unreadable by REMEDIO. |
| Product Data | Account lifetime or until deletion | Plaintext | Product name, category, quantity, expiry — required for reminders and alerts. |
| Product Images | Account lifetime or until deletion | Plaintext | Locally stored base64 images for quick display; never shared externally. |
| Dose Reminders (Gold tier) | Account lifetime or until deletion | Plaintext | Reminder schedules and push notifications for medication intake. |
| Health Tracker Data (Gold tier) | Account lifetime or until deletion | E2E Encrypted (AES-256-GCM) | Blood pressure, glucose, weight, temperature, SpO₂, heart rate — fully encrypted and exportable in professional PDF format. |
| Medical Diary Entries (Gold tier) | Account lifetime or until deletion | E2E Encrypted (AES-256-GCM) | Private health notes, symptoms, treatments, and appointments; exportable in .ics calendar format. |
| Family Management Data (Gold tier) | Account lifetime or until deletion | E2E Encrypted (ECDH P-256) | Family sharing system (Master + Relatives) secured via elliptic curve encryption and Magic Link access. |
| Custom Lists (Silver/Gold tier) | Account lifetime or until deletion | Plaintext | User-defined product lists and categories for personalized organization. |
| Usage History (Bronze+ tier) | Account lifetime or until deletion | E2E Encrypted (AES-256-GCM) | Dose confirmations, product notes, timestamps — fully encrypted. |
| Family Usage History (Gold tier) | Account lifetime or until deletion | E2E Encrypted (AES-256-GCM) | Shared consumption history for relatives; visible only to authorized members. |
2.2 Inactive User Accounts
Definition:
Accounts with no login activity for 730 consecutive days (2 years) are automatically classified as inactive.
Automated Cleanup Process
| Step | Description |
|---|---|
| 🕒 Daily Monitoring | The system automatically checks user activity through a secure background service (UserInactivityCleanupService). |
| ⚠️ Inactivity Detection | If an account shows no login activity for 730 days, it is flagged as inactive. |
| 🗑️ Permanent Deletion | Upon detection, all data (both encrypted and plaintext) is irreversibly deleted from all systems and backups. No recovery is possible due to the zero-knowledge architecture. |
User Notifications
Currently, email warning notifications are not implemented.
Users are encouraged to log in periodically to maintain access and prevent automatic deletion.
Transparency Note
This process ensures full compliance with GDPR Article 5(1)(e) (“storage limitation”) and reflects REMEDIO’s commitment to data minimization and user privacy by design.
All deletions are cryptographically secure and irreversible, ensuring complete data protection and respect for the Right to Be Forgotten.
2.3 Deleted User Accounts (User-Initiated)
Upon account closure, the following data is immediately and permanently deleted:
- User profile and authentication data
- All product data and images
- Dose reminders and consumption history
- Health tracker and medical diary data
- Family management data (E2E encrypted)
- Custom lists and categories
- Encrypted keys and recovery kit
- Device tokens (used for push notifications)
🛑 Irrecoverable by design:
Due to the zero-knowledge architecture, deleted encrypted data cannot be recovered, even by REMEDIO.
2.4 Temporary Data
| Data Type | Retention Period | Purpose |
|---|---|---|
| Session Tokens | 365 days or until logout | Authentication |
| Firebase Device Tokens | Until device logout or token refresh | Push Notifications |
| Magic Link Tokens (Family Sharing) | 24 hours | Secure invitations |
| Application Logs | 30 days (rolling) | Monitoring and diagnostics |
| Error Logs | 90 days (rolling) | Debugging and system reliability |
Note: Account recovery uses the 24-word Recovery Kit (generated at E2E encryption setup), not password reset tokens.
2.5 Backup Data
| Backup Type | Retention Period | Encryption |
|---|---|---|
| Database Backups | 30 days (rolling) | Encrypted storage |
| Configuration Backups | 90 days | AES-256 encryption |
🔐 Backups contain only encrypted data (ciphertext).
Without the user’s password or recovery kit, REMEDIO cannot decrypt any E2E data contained in backups.
3. End-to-End Encryption (E2E) and Zero-Knowledge Design
3.1 Zero-Knowledge Architecture
- Encryption keys are created locally on the user’s device.
- Master key is never transmitted in plaintext to the server.
- Encrypted health data is stored as ciphertext only.
- REMEDIO cannot decrypt or access the user’s health data.
3.2 E2E Encrypted Categories
| Encrypted | Description |
|---|---|
| ✅ Health Tracker | Vital signs, measurements, trends |
| ✅ Medical Diary | Health notes, symptoms, appointments |
| ✅ Family Vault | Shared encrypted data via ECDH P-256 |
| Not Encrypted | Reason |
|---|---|
| ❌ Account details (username, email) | Needed for login and notifications |
| ❌ Product metadata | Required for reminders and expiry alerts |
| ❌ Dose reminders | Operational functionality |
4. User Rights under GDPR & CCPA
4.1 Right to Access
Users can download all their data via:
Settings → Export Data
Data is decrypted locally before export in JSON /PDF format.
4.2 Right to Erasure
Settings → Close Account
All data, including encrypted health records, is immediately deleted and cannot be restored.
Backups are purged within 30 days.
4.3 Right to Rectification
Users can update their personal and health data directly in the app.
4.4 Right to Data Portability
All exported data is provided in a structured, machine-readable JSON/PDF format.
5. Compliance Framework
| Regulation | Compliance Areas |
|---|---|
| GDPR (EU) | Articles 5, 6, 13–22, 25, 32, 33–34 |
| CCPA (US) | Right to Know, Delete, and Non-Discrimination |
| Zero-Knowledge | Prevents unauthorized access by design |
6. Contact Information
Support: info@remedio-app.com
Data Protection Officer/GDPR Requests: dpo@remedio-app.com
We respond to verified GDPR or CCPA requests within 30 days.
End of Document
Version: 2.1 · Last Updated: April 28, 2026