Privacy Policy

Last Updated: March 10, 2026

Introduction

MedShot is operated by Thryvenex Holdings LLC ("Company," "we," "our," or "us"). This Privacy Policy explains how we collect, use, store, and protect your personal and health-related information when you use the MedShot mobile application (the "App"). By creating an account or using the App, you consent to the practices described in this policy. MedShot is not a HIPAA covered entity or business associate. The App is a consumer organizational tool, not a healthcare provider or clinical system.

1. Information We Collect

We collect the minimum data necessary to provide our services:

Account Information: Name, email address, and authentication credentials. Accounts are managed via Supabase Auth. Passwords are hashed and never stored in plain text.
Health-Related Data: Medication names, strengths, dosage forms, directions, frequencies, routes of administration, inventory counts, adherence logs (taken/missed/skipped doses), reminder schedules, food instructions, and time-of-day preferences. This data is user-entered or scanned via the App's camera feature.
Profile Preferences: Wake/sleep times, notification preferences, notification sound selection, and dark mode preference.
Camera & Image Data: When you use the Scanner, your device camera captures images of medication labels. Images are processed on-device using Apple Vision (OCR) and may be sent to Google Gemini API for AI-assisted text extraction. Images are processed ephemerally — they are NOT stored on our servers, NOT sold, NOT shared with third parties, and NOT used to train AI models.
Device Information: Time zone (for scheduling reminders). We do NOT collect device identifiers, IP addresses, or location data.
Analytics: We use Firebase Analytics (without advertising ID support) to collect anonymous usage data such as app opens, feature usage counts, and device type. This data is not linked to your identity and is used solely to improve the App. No medication names, health data, or personal information is included in analytics events.
Drug Information Queries: When you view drug details, the App queries publicly available U.S. federal databases (DailyMed, openFDA, RxNorm, ClinicalTables, MedlinePlus) on your behalf. These are anonymous API calls that do not transmit your personal information.
Financial Data: We do NOT process, collect, or store any payment or credit card information. All subscription transactions are handled entirely by Apple through the App Store's In-App Purchase system.

2. How We Use Your Information

Core Services: To store your medications, track adherence, deliver scheduled reminders, and sync data to your account.
AI Features: Medication label images and text may be processed by Google Gemini API solely for OCR extraction and drug information summarization. Your health data is NOT used to train, fine-tune, or improve any AI models. By using the Scanner or drug information features, you consent to this processing.
Drug Information: To retrieve and cache publicly available drug label data from federal sources so you can view indications, warnings, interactions, and side effects.
Notifications: To deliver the medication reminders you configure, using Apple's local notification system on your device.
Analytics: To understand general usage patterns and improve the App's features and performance. Analytics data is anonymous and aggregated.

3. Data Storage & Security

Encryption in Transit: All data transmitted between the App and our servers uses HTTPS/TLS encryption.
Encryption at Rest: Your authentication tokens are stored in the iOS Keychain with device-only encryption (kSecAttrAccessibleWhenUnlockedThisDeviceOnly). Server-side data is encrypted at rest by our infrastructure provider.
Access Control: Your data is protected by Row Level Security (RLS) policies — only you can read or modify your own records. No other user or administrator can access your medication or health data through the App.
Infrastructure: Data is hosted on Supabase (built on PostgreSQL, hosted on AWS). AI processing uses Google Cloud infrastructure. Both providers maintain SOC 2 compliance.
Breach Notification: In the event of a data breach involving your health-related information, we will notify affected users within sixty (60) days in accordance with the FTC Health Breach Notification Rule and applicable state laws.
No Guarantees: While we employ industry-standard security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

4. Data Sharing & Third Parties

We do NOT sell, rent, trade, or share your personal or health-related data with any third party for marketing, advertising, or data brokerage purposes.

Supabase (Database & Auth): Stores your account and medication data. Subject to Supabase's privacy policy and data processing terms.
Google Gemini API (AI Processing): Processes medication label images and text for OCR and summarization only. Subject to Google's API Terms of Service. Data sent to Gemini is not used by Google to train generalized AI models per their API data usage policy.
Firebase Analytics (Usage Analytics): Collects anonymous, non-identifying usage data (feature usage counts, device type). No health data, medication names, or personal information is sent to Firebase. Subject to Google's privacy policy.
Apple (Payments & Notifications): Handles all subscription billing via the App Store. Delivers local notifications via iOS. Subject to Apple's privacy policy.
U.S. Federal APIs (Drug Data): DailyMed, openFDA, RxNorm, ClinicalTables, and MedlinePlus are queried anonymously — no personal data is sent to these services.
Legal Obligations: We may disclose your information if required by law, court order, subpoena, or to protect the rights, property, or safety of Thryvenex Holdings LLC, our users, or the public.

5. Data Retention & Deletion

Active Account: Your data is retained for as long as your account is active.
Account Deletion: You may permanently delete your account and ALL associated data at any time via Settings > Security > Delete Account. This action is irreversible and cascades to all medications, reminders, adherence logs, and profile data.
Cached Drug Data: Publicly sourced drug information (from DailyMed, openFDA) is cached in shared tables to improve performance. This data is not personal and is not deleted when you delete your account.
Backups: Server-side backups maintained by our infrastructure provider may retain deleted data for a limited period consistent with their retention policies before permanent erasure.

6. Your Rights

Access & Edit: You can view and edit your profile, medications, and adherence data at any time within the App.
Delete: You can permanently delete your account and all associated data via Settings > Security.
Portability: You may request a copy of your data by contacting us at the email below.
California Residents (CCPA/CPRA): You have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do NOT sell personal information. To exercise your rights, contact us at the email below.
Washington Residents (My Health My Data Act): You have the right to know what consumer health data we collect, request its deletion, and withdraw consent for its collection or sharing. We collect health-related data (medication names, dosages, adherence logs) solely to provide you the App's services. We do not sell or share consumer health data. To exercise your rights, contact us at the email below.
Nevada & Connecticut Residents: You may opt out of the sale of your personal data and exercise rights under your state's consumer health data privacy laws. We do not sell personal data. Contact us to exercise your rights.
Canadian Residents (PIPEDA): You have the right to access your personal information, request corrections, and withdraw consent for its use. We collect and process your data only with your consent and for the purposes described in this policy. Contact us to exercise your rights.
EU/EEA Residents (GDPR): If applicable, you have the right to access, rectify, erase, restrict processing of, and port your personal data, as well as the right to object to processing. Our legal basis for processing is your consent (provided at account creation) and legitimate interest in providing the service. Contact us to exercise these rights.

7. Children's Privacy

MedShot is not intended for use by children under the age of 17. We do not knowingly collect personal information from children under 17. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately and we will delete such information.

8. Analytics

MedShot uses Firebase Analytics (without advertising identifier support) to collect anonymous, aggregated usage data. This includes general feature usage counts (such as how many scans or dose logs occur), device type, and app version. No medication names, health data, personal information, or advertising identifiers are collected. This data is used solely to understand usage patterns and improve the App. MedShot does not use advertising SDKs, fingerprinting, or cross-app tracking.

9. HIPAA Non-Applicability

MedShot is a consumer organizational tool and is NOT a covered entity or business associate as defined under the Health Insurance Portability and Accountability Act (HIPAA). The App does not access, store, or transmit Protected Health Information (PHI) from healthcare providers, health plans, or healthcare clearinghouses. Your medication data is self-reported and is not subject to HIPAA regulations. Standard consumer privacy protections described in this policy apply.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last Updated" date at the top of this policy. Continued use of the App after changes constitutes acceptance. We encourage you to review this policy periodically.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us:

Thryvenex Holdings LLC
MedShot.Assist@gmail.com