1. Who we are
Dosia is made by The Crafted Code Ltd, a company registered in England and Wales (company number 14639993). We are the "controller" of your personal information, which means we decide how it's used and we're responsible for protecting it.
This policy covers the Dosia app on iPhone and Android, its widgets, Live Activities and notifications, and the website dosia.app. If Dosia moves to its own company in the future, we'll tell you in the app at least 30 days before, and this policy will name the new company.
Questions about privacy: hello@thecraftedcode.com, with "Privacy" in the subject.
2. What we collect
Dosia is a medicine reminder and health journal, so much of what you give it is health information, which UK law treats as a "special category" with extra protection. We collect only what the features you use need.
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Email address, name, date of birth (email sign-up only), sign-in method, passkeys (a public key only) | You, or Apple or Google if you sign in with them |
| Medicines and schedules | Names, strengths, doses, times, food rules, treatment dates, stock levels, pairing rules | You, or a prescription you scan |
| Dose history | Taken, skipped, missed, snoozed, late; as-needed doses with the reason and how strong it was | You, and Dosia when a dose's time passes |
| How you feel | Check-ins, symptoms and their strength, daily ratings, notes, measurements such as blood pressure or glucose | You |
| Appointments | Doctor's name and speciality, date and time, notes before and after, topics to raise | You, or a calendar event you pick |
| Trips | Destination time zone and dates, medicines you're taking along | You |
| Care profiles | The people you look after: name, relationship, their medicines and records; email address if you invite them | You, as their carer |
| Contacts you add | Your doctor's name, clinic and phone; emergency contacts' names, phone numbers and emails | You |
| Routine and settings | Wake, sleep and meal times, time zone, language, notification choices | You and your phone |
| Subscription | Whether you have a trial or subscription, plan, renewal date. Never your card details. | Apple or Google, through RevenueCat |
| Device and technical | A notification token, a device identifier used only to avoid duplicate reminders, app version, crash reports, IP address (briefly, for security) | Your phone |
| Usage | Which features you use, such as "opened Insights" or "finished setup", linked to a random account number, not your name or email | The app |
3. What stays on your phone
- Photos and documents you scan. Text is read on your phone by Google's ML Kit, which runs on the device. The image itself is never uploaded.
- Your voice. Voice typing in "How have you been" uses your phone's own speech recognition, on the device where your phone supports your language. Where it doesn't, your phone uses Apple's or Google's speech service, just as keyboard dictation does. Either way, Dosia only ever receives the written words, never a recording.
- Your calendar. Dosia reads it only when you open "Add from your calendar", and sorts the events on your phone. Only the events you choose are saved to Dosia. Dosia only changes or deletes calendar events it created itself, and your appointment notes are never written to your calendar.
- Face ID, Touch ID and fingerprints. Your phone checks them. Dosia only learns whether the check passed.
- An encrypted copy of your records, so Dosia works offline. It's protected with AES-256 encryption and a key kept in your phone's secure keychain, and it's wiped when you sign out.
4. What leaves your phone
Your records are stored on our servers so they're safe if you lose your phone, can be shared with people you choose, and can power reminders when the app is closed. Here's everything that leaves your phone, and why:
- Your account and records go to our database (Supabase), to keep them safe and in sync.
- Reminders are sent through Google Firebase Cloud Messaging and, on iPhone, Apple's push service. They don't name your medicines unless you turn on Profile → Show medication details, which is off by default.
- Emails you ask for (sign-in codes, care invitations) are sent by Resend. They contain your email address or the invitee's, and the message.
- Usage events go to Mixpanel, in its EU data centre, so we can see which features help and where people get stuck. They record actions, such as "a dose was marked as taken" or "Insights was opened", tied to a random account number, never your name or email. They never include medicine names, amounts, symptoms, how you feel or your notes, and events about doses and check-ins are only sent after you've given your health consent. You can turn usage events off in Profile → Your data.
- Crash reports go to Sentry so we can fix bugs. They describe the error and your device (model, system version, app version), not your records.
- Subscription status comes from Apple or Google through RevenueCat. RevenueCat knows your random account number and your purchase receipts, never your health information.
- Text for AI features, only if you agree to them (section 5).
What we never do
- Sell your information, or give it to advertisers, data brokers, insurers or employers.
- Use advertising code, advertising identifiers or cross-app tracking. Dosia never asks to track you because it doesn't.
- Use your health information for marketing, including our own.
- Send your email address or account details to an AI provider, or let one train its models on your information.
- Make decisions about you by automated means that have legal or similarly serious effects.
5. AI features
Four features use AI: reading a scanned prescription, Ask Dosia (questions about your own records), How have you been (turning your notes into check-ins) and Insights summaries. They're off until you agree on the "Before Dosia uses AI" screen, and you can say "Not now" and still use the rest of Dosia. Without AI, scanning reads the label on your phone only, and Insights shows a plain summary.
When you use them, our server sends the text the feature needs to our AI service provider, a major cloud company that runs the AI model for us in its European Union data centres and processes the text only on our behalf. That can include text read from a prescription, your medicine names and doses, dose history, symptoms, ratings, appointments and notes, and your question. A scanned label can include the patient's name if it's printed on it. We never send your email address, account details, photos or voice. If you'd like to know which provider we use, email us and we'll tell you.
Under our contract, the provider may use this text only to answer the request. It doesn't train AI models on it, and it doesn't pass it to anyone else, including whoever made the model. It may keep it for up to 30 days, only to detect abuse, and then deletes it. Answers describe what was recorded. They don't diagnose, explain causes or recommend treatment.
If you mention a symptom Dosia doesn't recognise, we keep that word without any link to you, to improve Dosia's symptom list.
You can withdraw AI consent at any time in Profile → Your data → AI features. Nothing is sent after that.
6. Who can see your information
- You.
- People you choose. If you look after someone in Dosia, or invite someone to look after you, the people in that care profile see and can log that person's medicines and records. Either side can end it at any time.
- Anyone you send a report to. A PDF summary or export leaves Dosia when you share it, and goes wherever you send it.
- Anyone who can see your phone. Reminders, widgets, Live Activities and smartwatch notifications show medicine names only if you turn on "Show medication details" (off by default). You can also lock Dosia with Face ID or a fingerprint.
- Our team, only when needed to fix a problem you report or to keep the service secure, and never to browse.
- Authorities, only if the law requires it. We'd check the request is valid and tell you unless we're legally prevented.
If The Crafted Code or Dosia is sold or merged, your information would move to the new owner under this policy, and we'd tell you before it did.
7. Companies that work for us
These companies are our processors: they act only on our instructions, under a written contract that requires them to keep your information secure and confidential and to delete it when the job is done. None of them may use it for their own purposes. This is the complete list.
| Provider | Why | What they receive | Where |
|---|---|---|---|
| Supabase, Inc. (on Amazon Web Services) | Database, sign-in, our server code | Your account and all your records | United States (Virginia) |
| Our AI service provider (a major cloud company) | AI features, only with your consent | The text a feature needs (section 5); never your email, photos or voice | European Union |
| Google (Firebase Cloud Messaging; Firebase Hosting) | Delivering reminders; hosting dosia.app | Notification token, reminder text; website visitors' IP addresses | United States and worldwide |
| Apple (push service) | Delivering reminders on iPhone | Notification token, reminder text | United States and worldwide |
| Mixpanel, Inc. | Understanding which features are used | Random account number, usage events, device type, app version, language, time zone; no medicine names, symptoms, feelings or notes | European Union data centre |
| Functional Software, Inc. (Sentry) | Crash and error reports | Error details, device model and system version, app version | United States |
| RevenueCat, Inc. | Managing subscriptions | Random account number, store receipts, subscription status | United States |
| Resend, Inc. | Sending sign-in codes and invitations | Email address, the message | United States |
Apple and Google as app stores and sign-in providers are not our processors. When you subscribe, or sign in with Apple or Google, they handle that under their own privacy policies, and they tell us only what we need: whether you're subscribed, and your name and email if you sign in with them.
8. Why we use it: our legal bases
| What we do | Legal basis (UK GDPR) |
|---|---|
| Create and run your account; send sign-in codes | Contract (Art. 6(1)(b)) |
| Store your medicines, doses and how you feel; send reminders; show Insights; produce reports you ask for | Contract (Art. 6(1)(b)), and your explicit consent for health information (Art. 9(2)(a)), given on the consent screen during setup |
| AI features | Your separate explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) on the "Before Dosia uses AI" screen |
| Records about someone you care for | The explicit consent of that person, or consent given on their behalf by someone with legal authority to give it (a parent, an attorney or deputy). You confirm this when you create the care profile. |
| Subscriptions | Contract (Art. 6(1)(b)) |
| Usage analytics, crash reports, preventing abuse (such as rate limits) | Our legitimate interests in keeping Dosia working, secure and improving (Art. 6(1)(f)). Usage events about doses and check-ins are only sent with your health consent, never carry medicine names, symptoms or notes, and you can switch analytics off. |
| Keeping records the law requires, responding to lawful requests | Legal obligation (Art. 6(1)(c)) |
You can withdraw consent at any time (section 12). Withdrawing doesn't affect what we did before. Because Dosia can't remind you about medicines without processing them, withdrawing health consent means deleting your account; withdrawing AI consent only turns AI off.
9. Data outside the UK
Our database and some of the companies above are in the United States, so your information is transferred outside the UK and the European Economic Area. We protect every transfer with an approved safeguard: for people in the UK, the UK–US data bridge (where the company is certified under it) or the ICO's International Data Transfer Agreement or Addendum; for people in the EEA, the EU–US Data Privacy Framework (where the company is certified under it) or the European Commission's Standard Contractual Clauses; and similar safeguards required by other countries' laws, such as Brazil's. We also check each company's security. Our AI service provider processes your text inside the European Union. You can ask us for a copy of these safeguards.
10. How long we keep it
| Information | Kept for |
|---|---|
| Your account and records | Until you delete them or your account. Deletion from our live database is immediate; encrypted backups roll off within 7 days. |
| Notification delivery log | 30 days |
| AI request text at the AI provider | Up to 30 days, only for abuse checks |
| AI usage counts (no content) | Until your account is deleted |
| Usage events (Mixpanel) | Until you delete your account, then erased |
| Crash reports (Sentry) | Up to 90 days |
| Subscription records (RevenueCat) | Until your account is deleted. Apple and Google keep their own purchase records. |
| IP addresses kept for abuse prevention | Up to 7 days |
| Symptom words Dosia didn't recognise | Kept, with no link to you |
If you stop using Dosia without deleting your account, we keep your records so they're there when you come back.
11. Security
- Everything travels encrypted (TLS), and our database encrypts it at rest.
- Each account can only reach its own records, enforced by the database itself, not just the app.
- There are no passwords to steal: you sign in with a one-time code, a passkey, or Apple or Google.
- The copy on your phone is encrypted, and you can lock Dosia with Face ID or a fingerprint.
- Only a small number of people at The Crafted Code can access production systems, with two-step sign-in.
No system is perfectly secure. If a breach puts your rights at high risk, we'll tell you without undue delay, and the ICO within 72 hours where the law requires.
12. Your choices and rights
In the app, any time, with or without a subscription:
- Download your data: Profile → Your data → Export.
- Delete your account and everything in it: Profile → Your data → Delete. This also removes the people you created care profiles for who don't have their own login, ends any care links, deletes your subscription record at RevenueCat, and disconnects Sign in with Apple. It doesn't cancel a subscription: do that in your App Store or Google Play settings.
- Turn AI features off, turn usage analytics off, choose whether reminders show medicine names, and change notifications.
- Correct anything by editing it.
Your rights under UK data protection law: to access your information, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent. Email hello@thecraftedcode.com from the address on your account. We'll reply within one month, free of charge. We may ask you to confirm it's you, because we never want to hand your records to someone else.
13. Age
You must be 18 or over to create a Dosia account. Children and young people can use Dosia through a care profile managed by a parent or carer, who agrees to this policy on their behalf. If we learn that someone under 18 has created their own account, we'll delete it.
14. Users outside the UK
European Union and EEA. You have the rights in section 12 under the EU GDPR. Send any request or question to hello@thecraftedcode.com and we'll handle it the same way. You can also complain to the data protection authority in the country where you live or work.
Brazil. Under the LGPD you can confirm whether we process your data, access, correct, anonymise, block or delete it, receive it in a portable format, find out who we share it with, and withdraw consent. We process your health information on the basis of your specific, highlighted consent (Art. 11, I) and transfer it abroad under the safeguards in section 9. To use a right, email hello@thecraftedcode.com. You can also complain to the ANPD (Autoridade Nacional de Proteção de Dados).
United States. We don't sell or share your personal information, as "sell" and "share" are defined in US state privacy laws, and we don't use it for targeted advertising. Our Consumer Health Data Privacy Policy at dosia.app/health-data explains your rights under Washington's My Health My Data Act, Nevada SB 370 and similar laws.
Everywhere else. We apply this policy wherever you are, and any extra rights your local law gives you.
15. This website
dosia.app uses no cookies, no analytics, no advertising and no third-party scripts. Google Firebase Hosting serves the pages and briefly logs visitors' IP addresses to keep the site running and secure.
16. Changes
We'll update this page when Dosia changes how it uses information, and change the date at the top. If a change is significant, we'll tell you in the app before it takes effect, and ask for your consent again where the law requires it.
17. Contact and complaints
The Crafted Code Ltd. Company number 14639993, registered in England and Wales. Email hello@thecraftedcode.com (subject "Privacy").
If you're unhappy with how we've handled your information, please tell us first so we can put it right. We'll acknowledge your complaint within 30 days. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.