Privacy Policy

Pill Rao is operated by Alumolu Sai Shree Anjan, an individual developer based in India. Send privacy, security, access, correction, export, or deletion requests to aanjansai96@gmail.com. Do not email passwords, security answers, prescription files, medicine lists, or other unnecessary health information.

Depending on the features you choose, Pill Rao processes:

• account and authentication data: name, email, optional mobile number, language, timezone, optional profile photo, login-provider identifier, and hashed credentials or recovery answers;
• medicine and reminder data: names, dosage text, form, schedules, reminder times, instructions, notes, supply counts, and start or end dates;
• adherence and activity data: taken, skipped, snoozed, or missed status, action times, optional daily step totals, step goal, and Health Connect permission or connection state;
• uploaded prescription files and metadata that you choose to store;
• optional pregnancy-support details, gestational timeline inputs, appointments, healthcare professional or clinic names, preparation instructions, health notes, and emergency contact text;
• optional care-circle invitations, relationships, progress shared through that feature, and encouragement messages;
• security and operational metadata such as request identifier, method, path, response status, duration, response size, device app version, a random app-installation identifier used for sync checkpoints, and error category. Sync diagnostics may include the operation stage and outcome, duration, aggregate item and pending counts, aggregate conflict and permanent-failure counts, age of the oldest pending change, journal lag, and a normalized recovery or retry category. API request bodies, authorization headers, raw account or installation identifiers, medicine names, medicine or dose values, pending-change contents, prescription contents, and health-note text are not intentionally written to application logs.

Information is used only to:

• create, authenticate, recover, and protect your account;
• show schedules, history, refill status, and optional health features;
• schedule local reminders and process actions such as snooze;
• make supported mobile features available offline, synchronize changes with your account, recover a current cloud snapshot, and let you review conflicting changes from another device;
• store files and private notes that you explicitly submit;
• provide sharing or support features that you explicitly use;
• answer support, access, correction, export, and deletion requests;
• detect abuse and maintain the reliability and security of the service.

On supported native mobile builds, Pill Rao keeps a separate, SQLCipher-encrypted SQLite database for each signed-in account. It may contain medicines and schedules, dose and adherence records, dashboard and history snapshots, relevant preferences, pending sync operations and their medicine or dose contents, local and cloud copies involved in unresolved conflicts, sync cursor and readiness state, and up to the 100 most recent aggregate sync-diagnostic rows. This database allows supported features to remain available while the device is offline.

Authentication tokens, the random local-database encryption key, signed-in profile data, and selected device state use the operating system's protected secure storage and are configured to be available only after the device is unlocked. Ordinary app preferences, such as theme, language, and the per-user offline cache of the notification privacy choice, use local preference storage. The authoritative medication-notification privacy choice is stored with the account in PostgreSQL. A pending medical-safety acknowledgement contains only policy version and timestamp, not medicine information.

In the cloud, account and feature records are stored in managed PostgreSQL. This includes account-scoped sync-journal entries, idempotency records used to avoid applying the same offline change twice, and sync checkpoints containing a random installation identifier, cursor, and last-seen time. The installation identifier is not an advertising identifier and is not used to authenticate you. Uploaded prescriptions and profile photos are stored in a private object bucket and served only through authenticated, ownership-checked API routes. Production API, database, and object storage resources are in Google Cloud region asia-south1 (Mumbai). Firebase Hosting provides the public HTTPS front door and routing and may process connection metadata at Google's network edge.

The authenticated web app currently stores session tokens in browser local storage. Moving web refresh tokens to Secure, HttpOnly, SameSite cookies with CSRF protection is a required security release item. Do not use the web app on a shared or untrusted browser until that work is complete.

On supported mobile builds, medicine and dose changes are saved first in the encrypted local database. Pending changes are sent to the Pill Rao API after the account is authenticated and a network connection is available. The app also downloads account changes made on other devices. A “Synced” or cloud-backup-ready status means the app has completed a successful cloud synchronization boundary and has no known pending or actionable sync issue; it does not mean that an independent archival copy exists. A change that is still pending or has permanently failed is not protected in the cloud.

When the same record changes in incompatible ways, encrypted local copies of the device change and current cloud record may be retained on the device until you choose which version to keep. Choosing the cloud version discards the conflicting device change. Choosing the device version queues it for another authenticated upload.

Signing out removes session credentials and closes the local database, but does not delete that encrypted database. It can be reopened after the same account signs in again. If the encryption key is missing or the database is unreadable, Pill Rao sets aside the unreadable encrypted files, creates a new encrypted database, and attempts to restore synchronized records from the cloud. Pending changes that never reached the cloud may be lost. Unreadable encrypted recovery files are not uploaded and may remain in the app's private storage until the app's storage is cleared or the app is uninstalled.

Production traffic uses HTTPS/TLS, and the production PostgreSQL instance is configured to require encrypted database connections. Google Cloud encrypts stored customer content at rest by default. The current project does not configure customer-managed encryption keys for the database or object bucket; Google owns, manages, and rotates the default storage keys. Passwords, recovery answers, and refresh tokens are additionally stored as one-way bcrypt hashes; password-reset tokens use SHA-256 hashes.

The native per-account SQLite database is encrypted using SQLCipher with a randomly generated key stored separately through the operating system's secure-storage service. The key is not sent to Pill Rao. Device backup, transfer, security settings, operating-system changes, or storage corruption can make the key or database unavailable; in that case, only records already synchronized to the cloud can be restored by Pill Rao.

Application secrets are injected from Google Secret Manager. A documented, tested recurring secret-rotation process has not yet been completed and is a required security release item.

Medicine reminders are scheduled locally on the device. Medication names and dosage are shown by default: the title is “Medication reminder” and a detailed body is, for example, “Time to take Metformin — 500 mg.” Anyone who can see your notifications or lock screen may see those details. You can hide them later in Profile → Settings → Notifications → Show medication details. Private mode uses the same title and the body “Open the app to view the details.”

Detailed medication reminder content is limited to the medication name, dosage or strength, and an optional scheduled time. It does not include a condition, diagnosis, private note, adherence or missed-dose history, caregiver information, patient name, or other unnecessary health information. Appointment and health-note notification text is generic. Notification delivery can be delayed, disabled, duplicated, or missed. Your operating-system notification-preview and lock-screen controls continue to determine when notification text is visible.

The current app does not register a server push-notification token and server push delivery is not active. The server's dormant delivery boundary applies the same account preference and generates content only when needed for an attempt; it does not store message text in delivery, retry, task, analytics, or application-log records. A local pending payload is retained by the operating system only until it is delivered, cancelled, or replaced. If remote push is activated, the policy, consent flow, provider disclosure, retention controls, and store declarations must be reviewed before collection begins.

Pill Rao does not sell personal data or health-related data to advertisers, data brokers, or other third parties. It does not use medicine, adherence, prescription, pregnancy, appointment, health-note, or Health Connect data for targeted advertising.

No advertising, third-party product analytics, session replay, or crash reporting SDK is currently enabled in the mobile, web, or API package manifests. Health fields must not be added to analytics, crash reports, session replay, notification telemetry, or application logs. If any such SDK is proposed, it requires a data-flow review, policy and store-declaration update, and consent where required before release.

The mobile app sends privacy-limited sync diagnostics to the authenticated Pill Rao API to operate and troubleshoot cloud synchronization. These reports contain only the allowlisted operational stages, outcomes, durations, aggregate counts and ages, journal lag, and normalized retry or recovery categories described above. The report payload and generated central log event omit raw account, installation, record, cursor, and idempotency identifiers, as well as medicine, dose, prescription, note, mutation, and token contents. These are operational logs, not advertising or product analytics.

Current providers and purposes are:

• Google Cloud for API hosting, managed PostgreSQL, private object storage, secrets, backup media, and operational logging in or anchored to asia-south1;
• Firebase Hosting for HTTPS hosting and request routing;
• Google Sign-In, only when you choose Google authentication;
• Expo and app-store build services for building and distributing the app; runtime medicine data is not intentionally sent to Expo by Pill Rao;
• Android or iOS system services for local notifications and, only after permission, Android Health Connect for step totals.

Pill Rao discloses information only to providers acting on its behalf, when you direct sharing through a feature, to investigate abuse or protect users, or when legally required. Care-circle sharing is optional and should be used only with people you trust; remove a relationship to stop future in-app access. Existing copies or information already seen by another person cannot be recalled.

A narrower processing region has not been verified for Firebase edge routing, Google Sign-In, Expo build services, or app-store services; those providers may process technical or account data in other countries under their terms. Confirming provider contracts, transfer terms, and a complete subprocessor register is a legal release requirement.

Account and feature records are retained while the account is active unless you delete an item earlier. The planned automatic 90-day expiration of daily step aggregates is not currently active, so step aggregates remain with the account until individually removed or the account is deleted. Activating and verifying that cleanup is a required privacy release item.

At this release, automatic sync-journal compaction is disabled during the checkpoint-capable client rollout. Account-scoped sync-journal entries, device checkpoints, and mutation-idempotency records are therefore retained while the account remains active. When journal compaction is enabled after a controlled rollout, it is designed to remove eligible journal entries older than 90 days only up to a safe active-device checkpoint. Journal compaction does not delete the current medicine or dose records stored with the account.

The active encrypted mobile database remains on the device across sign-out. Its local sync-diagnostic history is limited to the most recent 100 entries. Permanent account deletion removes the active per-account database and its encryption key after the API confirms deletion. Clearing the app's storage or uninstalling the app also removes its local app data, but does not by itself delete the cloud account.

Permanent account deletion removes the active user profile, login records, sessions, recovery records, medicines, reminder occurrences, adherence, prescriptions, photos, pregnancy information, appointments, health notes, activity aggregates, rewards, invitations, care-circle links, device-token records, encouragement messages, sync journals, sync checkpoints, and mutation-idempotency records through explicit object deletion and database cascades. Local Pill Rao reminders, the active encrypted account database and key, secure caches, and session data are cleared after the API confirms deletion. A previously unreadable encrypted recovery file may remain in app-private storage until app storage is cleared or the app is uninstalled because its encryption key is no longer available.

Deleted private objects remain recoverable only through the provider's protected soft-delete mechanism for seven days. Cloud SQL takes automated daily backups, retains seven backups, and retains seven days of transaction logs; deleted database rows may remain in protected backup media through that rotation and are not restored to active use except during authorized disaster recovery. Application logs in the default logging bucket are retained 30 days; provider-required administrative audit logs are retained 400 days.

A deletion audit entry contains only a one-way account reference, event type, and timestamp—never contact or health details. No automated expiry is yet configured for these minimal audit entries; defining and enforcing their retention period is a required privacy release item.

Private API routes require an authenticated account and user-owned records are queried by account identifier. The object bucket blocks public access and uses uniform bucket-level access. Runtime services use dedicated service accounts and deployment uses keyless workload identity.

A production IAM review on August 10, 2026 found broad human Owner, Editor, compute, and storage roles. Those grants must be reviewed and reduced before the service is represented as having least-privilege human access. Formal staff-access approval, periodic access review, and access-audit procedures also remain release requirements.

Cloud SQL instance deletion protection is currently disabled and the current small zonal database is not highly available. Enabling deletion protection and completing the production availability review are release requirements.

In Profile → Settings → Notifications you can turn off Show medication details. In Profile → Privacy controls you can open this policy, request access, correction, or export, review optional sharing, and reach permanent account deletion. You may also remove individual medicines, prescriptions, health notes, appointments, pregnancy information, or activity data through available feature controls. Rights and response periods vary by location; contact aanjansai96@gmail.comwhen a control is unavailable.

Suspected unauthorized access is triaged by preserving privacy-safe evidence, containing access, rotating affected credentials, assessing the data and people involved, restoring safely, and documenting corrective action. Affected people and relevant authorities will be notified when applicable law requires it. Report a suspected incident promptly to aanjansai96@gmail.comwithout including medical details or credentials.

Pill Rao is intended for people age 18 or older. A parent or guardian who believes a minor submitted information should contact the operator for review and deletion. Pill Rao does not claim HIPAA, GDPR, medical-device, or other regulatory certification. Legal and security review is required before a production launch involving real patient data.

Pill Rao is a convenience tool only. It does not provide medical advice, diagnosis, or treatment and is not a substitute for a doctor, pharmacist, prescription label, or emergency service. Do not rely solely on Pill Rao for life-critical, time-critical, or essential medicines. Reminders can be late, missed, duplicated, or incorrect. Keep an independent backup reminder and medication-management plan.

The policy version and effective date will change when material data flows, providers, retention, or controls change. Material changes will be presented in the app for renewed acknowledgement when required.