Medaro privacy notice
This notice explains how Medaro uses information when you manage medications, vitamins, meals and reminders.
Who is responsible
Medaro is operated by IT-4You SWE, a Swedish sole trader, Säbygatan 3, 723 41 Västerås, Sweden, which is the controller of your personal data. Public privacy and support contact: info@it-4you.com, +46704424414, https://it-4you.com.
Information Medaro handles
- Account identifiers, email address, sign-in and security events, and, if you sign in with Google, the name and profile-picture link that Google shares with the sign-in service.
- Medications, vitamins, instructions, meal times and notes, reminders, dose history and the status you record.
- Language, time zone, reminder, notification and privacy preferences.
- Device-session identifiers, synchronization changes and limited security or reliability diagnostics needed to operate the service.
Why the information is used
- To calculate and show the schedules and history you request, deliver reminders and synchronize your account across authorized devices. Legal basis: performing the service you ask for (GDPR Article 6(1)(b)); for health information, your explicit consent (Article 9(2)(a)), which you can withdraw at any time by deleting the information or your account.
- To authenticate you, enforce the active-device policy, protect data, prevent abuse and investigate failures. Legal basis: our legitimate interest in keeping the service and your account secure (Article 6(1)(f)).
- To answer support, privacy and account-deletion requests.
Authentication and biometrics
The configured identity provider processes your email, password and authentication events. Medaro does not store a plaintext password.
Android checks fingerprints or device credentials locally. Medaro does not receive or store biometric templates.
Storage and security
The app keeps an encrypted local working copy and a protected synchronization outbox on your device.
Exporting your data writes an unencrypted JSON copy to a file location you choose through Android. That copy is outside Medaro's encrypted database; you control and delete it through the selected storage provider.
If Medaro cannot safely open local encrypted data, it keeps a protected encrypted recovery copy on this device instead of replacing it. You can export or permanently delete that copy from Medaro.
The server uses PostgreSQL as the durable account authority. Connections use transport encryption. Medaro is not end-to-end encrypted.
The screenshot and screen-recording preference controls local screen privacy only; it does not change authentication or server data.
If you allow call awareness, Medaro processes only whether an Android call is active so it can apply your reminder choice. It does not read phone numbers or call history, and it does not store, log or send this state.
Service providers and sharing
Service providers process data only on our instructions to operate the service: Google Cloud (Google Cloud EMEA Limited) for hosting, database, sign-in and scheduling, and Brevo (Sendinblue SAS, France) only to send account-deletion verification emails. We do not share your data with anyone else unless the law requires it.
Medaro is not designed to sell health data or use it for advertising.
Retention and account deletion
Account and health data are kept while your account exists. After an accepted deletion request they are erased within 30 days; database backups that may still contain them expire automatically within a further 7 days. Server request logs are kept for 7 days.
You can request deletion in Medaro or through the public deletion page. An accepted request blocks account use immediately and enters the canonical deletion lifecycle. A minimal non-health completion receipt remains so a restore cannot silently recreate a deleted account.
Your choices and rights
You have the right to access, correct, export, restrict, object to and delete your data, and to withdraw consent. You can do most of this in the app; otherwise contact us and we will answer within one month. You may also complain to the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, imy.se.
Children and target audience
Medaro is intended for adults aged 18 and over. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.
Processing locations and transfers
Your health data is stored and processed within the European Union: the server and database run in Finland and scheduling runs in Belgium (Google Cloud), and deletion emails are sent from France (Brevo). The Google sign-in service (Identity Platform) may process your email address and sign-in events outside the EU; Google protects such transfers with the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.
Changes to this notice
Effective date and version of this notice: 2026-10-31. The application records the version you accepted. A changed notice gets a new version and a new effective date.
Contact
For privacy or support questions, contact info@it-4you.com or +46704424414. Website: https://it-4you.com.