Version: 2.1
Last Updated: April 28, 2026
For: General Users (Non-Technical Audience)
1. Our Commitment to Your Privacy
At REMEDIO, your privacy and data security come first.
The app is built with end-to-end encryption (E2E) for your most sensitive health information — meaning even we cannot access your encrypted data.
This page explains, in clear terms, how we protect your information and what control you have over it.
2. What Data We Collect
2.1 Basic Account Information (Not Encrypted)
- Username & Email – identify your account
- Password – stored only as a secure, non-reversible hash
- Subscription Level – Free, Bronze, Silver, or Gold
These details help us provide your account and service tier.
2.2 Medication Data (Not Encrypted)
- Product names, expiry dates, and quantities
- Photos of your products
Why not encrypted?
This data is considered non-sensitive under GDPR (it doesn’t reveal medical conditions). It is stored in plaintext only to enable expiry alerts and notifications without decrypting private data on the server — preserving the app’s zero-knowledge design.
Product photos are stored in plaintext to allow quick display on your device.
2.3 Health Data & Usage History (Fully Encrypted)
- Usage History (Bronze+ Tier): Your personal medication intake records including product names and notes
- Family Usage History (Gold Tier Only): Medication intake records from family members you monitor, including product names, quantities taken, and notes
- Health Tracker (Gold Tier Only): Your vital signs like blood pressure, heart rate, weight
- Medical Diary (Gold Tier Only): Your private health notes, symptoms, appointments
- Family Health Data (Gold Tier Only): Health data you share with family members
Why is this important? Your medication intake history reveals sensitive medical information (diagnoses, mental health conditions, chronic diseases) classified as “special category data” under GDPR Article 9. We protect this with the same encryption used by governments and banks.
🔒 Protection Level: Maximum — data encrypted end-to-end (E2E).
Even REMEDIO cannot read it.
3. How We Encrypt Your Data
3.1 End-to-End Encryption Explained
Think of it like a locked vault only you can open:
- You create a key (your password)
- Your health data is locked on your device
- The server stores only locked boxes (encrypted data)
- Only you can unlock them with your password
✅ Result: Your private health data stays private — even from us.
3.2 Encryption Technology
- Standard: AES-256-GCM (used by banks & governments)
- Key Strength: 256-bit (virtually unbreakable)
- Password Protection: 600,000 PBKDF2 iterations (prevents brute-force)
- Family Sharing: Encrypted with elliptic curve cryptography (ECDH P-256)
4. Your Recovery Kit (24-Word Backup)
4.1 What It Is
When you register your account, you’ll receive a 24-word Recovery Kit — a secure backup key to restore your encrypted data.
🧠 Example: “xT2a pQ9z bR4m kL7n …”
4.2 Why You Need It
Your Recovery Kit helps you regain access if you:
- Forget your password
- Lose your device
- Need to restore your account
📜 Keep it safe — write it on paper and store it securely.
We never store it.
4.3 If You Lose It
If both your password and Recovery Kit are lost:
- ❌ The basic product data remains saved in the database but is no longer accessible because we use zero-knowledge encryption, even REMEDIO cannot recover it.
- ❌ Encrypted data is permanently lost
5. Password Security
5.1 How We Store It
We never store your password itself.
Instead, we use a process called hashing, which turns it into unreadable gibberish.
Even if someone accessed our database, they would not see your real password.
5.2 Strong Password Tips
✅ At least 8 characters
✅ Use uppercase, lowercase, numbers, symbols
✅ Make it unique (not reused elsewhere)
Example good password: M3d!c@t!on2025
Avoid: password, 123456
6. How We Secure Your Data
6.1 In Transit
All connections use:
- HTTPS + TLS 1.3 encryption
- Certificate pinning (mobile apps)
- HSTS (prevents downgrade attacks)
Your data travels encrypted — like online banking.
6.2 On Our Servers
Hosted on OVHcloud (EU) with:
- Firewalls & access control
- SSH key authentication (no password logins)
- Fail2Ban (auto-blocks intruders)
- Full disk encryption
- Regular security updates
6.3 In Our Database
- Health data → Encrypted end-to-end
- Passwords → Hashed (scrypt, 524,288 iterations)
- Access restricted → Authorized personnel only
- Backups → Encrypted, 30-day retention, EU servers
7. What We Share — and What We Don’t
7.1 We Never Sell or Rent Data
REMEDIO does not sell, rent, or use your data for marketing.
7.2 Essential Third-Party Services
| Service | Purpose | Data Shared | Protection |
|---|---|---|---|
| Neon (PostgreSQL) | Database hosting | All data (encrypted) | GDPR-compliant, EU servers |
| Firebase (Google) | Push notifications | Device tokens only | GDPR-compliant |
| OVHcloud | Server hosting | Encrypted app data | EU-based, GDPR-compliant |
| Apple Health / Google Health Connect | Optional imports | Processed locally only | Device-level privacy |
Your encrypted data is never readable by these services.
8. Your Control Over Your Data
You can manage everything from within the app:
- Export → Download all your data anytime (JSON/PDF format)
- Delete → Permanently remove your account and all data
- Opt-Out → Disable notifications, Health imports, or Family sharing
You always stay in control.
9. Family Sharing (Gold Tier)
9.1 Secure by Design
Sharing health data with relatives uses end-to-end encryption via a Magic Link — a temporary, secure invitation.
- Expires in 24 hours
- One-time use only
- Can be revoked anytime
Only the data you choose to share is visible — encrypted throughout.
10. If a Security Incident Happens
If a breach ever occurs:
- Immediate investigation
- User notification within 72 hours (GDPR)
- Full remediation and transparency
Even in a worst-case scenario, your encrypted health data remains protected.
Only non-sensitive metadata (like medication names) could be visible — never your private health records.
11. Children’s Privacy
- Designed for adults and families managing medication
- Minimum age: 16 years
- Parental consent required under 18
- No ads or profiling
12. Continuous Security Improvement
We continually enhance protection:
- Regular security updates
- Annual external audits (next: Q2 2026)
- Transparent notification of any policy change (30-day notice)
13. Your Role in Security
You help keep your data safe by:
- Using a strong, unique password
- Protecting your Recovery Kit
- Keeping your device locked and updated
- Avoiding public Wi-Fi for sensitive access
Security is a shared effort — we protect your system, you protect your keys.
14. Need Help or Have Questions?
📧 dpo@remedio-app.com – Data protection/EU privacy rights-requests
🆘 info@remedio-app.com – Technical assistance
We aim to reply within 30 days (usually faster).
15. Summary: How We Protect You
| Protection Layer | What It Does |
|---|---|
| End-to-End Encryption | Encrypts your health data on your device before upload |
| Password Hashing | Keeps your password unreadable |
| HTTPS / TLS 1.3 | Encrypts data while it travels online |
| Firewall + Fail2Ban | Protects servers from intrusion |
| Zero-Knowledge Design | We cannot read your encrypted data |
| 24-Word Recovery Kit | Lets you recover encrypted data safely |
| GDPR Compliance | Your right to access, delete, or export data |
| EU-Based Storage | All servers located within the European Union |
🩺 Your health, your data, your control.
We protect it — you own it. Always.
End of Document
Version 2.1 | Last Updated April 28, 2026