Version: 2.1
Last Updated: April 28, 2026
Audience: Developers, Security Auditors, Compliance Partners
1. Executive Summary
REMEDIO implements a zero-knowledge, end-to-end encrypted (E2E) privacy architecture ensuring that sensitive health data remains accessible only to the user.
Servers handle encrypted payloads exclusively — plaintext is never transmitted or stored.
Core Privacy Principles
- ✅ Data Minimization – Collect only operational data
- ✅ Purpose Limitation – Data used exclusively for app functionality
- ✅ Zero-Knowledge Encryption – Even REMEDIO cannot access user health data
- ✅ User Control – Export, deletion, and data recovery always available
- ✅ GDPR & CCPA Compliance – Designed for EU and international frameworks
2. Data Classification Overview
| Data Category | Encryption | Storage | Server Access |
|---|---|---|---|
| Health Tracker Data | AES-256-GCM (E2E) | Encrypted | ❌ Ciphertext only |
| Medical Diary Entries | AES-256-GCM (E2E) | Encrypted | ❌ Ciphertext only |
| Family Vault Data | ECDH P-256 (E2E) | Encrypted | ❌ Ciphertext only |
| User Passwords | Hashed (scrypt) | Encrypted | ❌ No plaintext |
| Product Metadata | Plaintext | Operational DB | ✅ Required for reminders |
| User Profile Info | Plaintext | Operational DB | ✅ Minimal data |
| Device Tokens | Plaintext | Firebase (GDPR SCC) | ✅ Required for push notifications |
Clinical Scope Exclusion
REMEDIO intentionally avoids processing diagnoses, therapy reasons, or treatment outcomes to stay outside the scope of medical device regulations.
3. End-to-End Encryption (E2E)
- All sensitive data (health tracker, diary, family vault) is encrypted client-side before transmission.
- A unique AES-256 master key is generated per user and never sent to the server.
- Encrypted data is stored as ciphertext only — the server cannot decrypt it.
- A recovery kit (24 words) is generated client-side for user recovery in case of password loss.
- Family data sharing is handled securely through Elliptic Curve Diffie-Hellman (ECDH P-256) key exchange.
Result: Even with full database access, no sensitive information can be decrypted without the user’s password or recovery kit.
4. Authentication and Sessions
- Password Hashing: scrypt (N=2^19) with unique salt per user
- Session Expiry: 365 days
- Session Security: Secure cookies, HTTPS-only, CSRF protection
- Two-Factor Authentication: Planned (v2.2 roadmap)
No plaintext passwords are ever stored or transmitted.
5. Database and Storage Privacy
- Encrypted data tables for E2E payloads (AES-256-GCM ciphertext)
- Backups stored with full-disk encryption (AES-256)
- Inactive accounts deleted after 730 days
- User-initiated deletions trigger immediate, irreversible data removal
- Backup retention: 30 days (rolling window)
Only non-sensitive operational data (e.g. product name, expiry) remains plaintext for in-app reminders and notifications.
6. Network and Transport Layer Security
- TLS 1.3 enforced for all communications
- HSTS (Strict Transport Security) enabled
- Certificate Pinning applied on mobile clients (iOS & Android)
- Security Headers: CSP, X-Frame-Options, X-XSS-Protection, Referrer Policy
- Hosting: OVHcloud (EU Datacenters) & Neon (EU PostgreSQL)
No unencrypted traffic or unsecured APIs are permitted.
7. Privacy by Design & Default
| Principle | Implementation |
|---|---|
| Data Minimization | Only data essential to functionality is collected |
| Purpose Limitation | No commercial reuse or profiling |
| User Consent | All sensitive features are opt-in |
| Default Privacy | No tracking, no analytics, no third-party cookies |
| Transparency | All retention and encryption rules are public |
No personal data is shared with external partners or advertisers.
8. GDPR Technical Compliance
| User Right | Implementation | Notes |
|---|---|---|
| Access (Art. 15) | Instant JSON/PDF data export | Self-service in app |
| Erasure (Art. 17) | Permanent deletion | Irreversible under E2E |
| Rectification (Art. 16) | User-managed | Editable data fields |
| Portability (Art. 20) | Machine-readable JSON/PDF | Fully interoperable |
| Restriction / Objection | Supported via support request | dpo@remedio-app.com |
Data exports decrypt locally on device before download (never server-side).
9. Breach Management
Detection
- Continuous log monitoring
- Automated anomaly detection
- Fail2Ban intrusion blocking
Response Timeline
- Detection → within 24h
- Containment → within 48h
- Notification → within 72h (GDPR Articles 33–34)
User Impact
E2E encrypted data remains unreadable even in the event of a breach.
10. Third-Party Processors
| Processor | Function | Data Shared | GDPR Compliance |
|---|---|---|---|
| Neon (PostgreSQL) | Database hosting | Encrypted app data | ✅ EU-based |
| Firebase (Google) | Push notifications | Device tokens only | ✅ SCCs |
| OVHcloud | VPS & API hosting | Encrypted data | ✅ EU-based |
| Apple / Google Health APIs | Local imports only | Device-local data | ✅ Device-controlled |
All processors operate under signed Data Processing Agreements (DPAs) and EU GDPR compliance.
11. Privacy Impact Summary
| Activity | Risk | Mitigation |
|---|---|---|
| Health Data Processing | 🔴 High | AES-256 E2E encryption |
| Family Sharing | 🟡 Medium | ECDH P-256 vault exchange |
| Notifications | 🟢 Low | No sensitive content |
| Product Metadata | 🟢 Low | Non-sensitive operational use |
No user profiling, tracking, or marketing automation implemented.
12. Governance and Ongoing Reviews
- Quarterly internal privacy reviews
- Annual external audit (next: Q1 2027)
- Privacy Training for all contributors
- Automatic Key Rotation planned in v2.3
- Incident Readiness Drills bi-annually
13. Contact & Requests
Data Protection/GDPR Requests → dpo@remedio-app.com
Security Incidents → reportfraud@remedio-app.com
Response within 30 days, per GDPR Article 12(3).
End of Privacy Technical Documentation (Public Snapshot)
Version 2.1 – April 28, 2026