Documents

The controller of your personal data is Kamil Kuźma. Contact for data matters: kontakt@medszafka.pl. MedSzafka (the "Application") is a tool for running a home medicine cabinet.

We have not appointed a data protection officer: we are not a public body, we do not systematically monitor people on a large scale, and processing health data is not an organisation's core activity here but a function you switch on for yourself. For any matter concerning your data, write to the address above.

As much as your cabinet needs to work:

• Account data: your name (or whatever you type), e-mail address, a hash of your password, and for each signed-in device its name, IP address and date of last use.
• Health data: medicine names, quantities, expiry dates, dose history, dosing plans and courses, the symptom diary; and, if you enter them, household members' first names and their allergies, conditions, weight, date of birth and blood type.
• Technical data: IP address, device and browser type, the push notification identifier, reports of Application errors.
• Billing data — only while paid plans are on: the Stripe customer and subscription identifiers, the plan's status, the card's type and last four digits. We do not store the card number; you enter it on Stripe's page.
• Usage statistics, not linked to your account: which screen was opened (e.g. “medicine details” — never which medicine, nor what was typed into search), which site somebody came from, whether a step such as creating an account or adding a medicine was taken, the device and browser type, and the country and city derived from the IP address. We count them on our own server with Umami. The IP address is not stored — only a one-way hash, changed every month, that lets visits be counted.
• Reports of an error in a medicine's data: what the report says, which medicine it is about and when it was sent, attached to the account that sent it.

We collect nothing from other sources. Everything we know about the medicines in your cabinet comes from you or from a barcode you scan.

Your data is used to:

• Run your cabinet: record what you have and show what is running out or expiring.
• Remind you of doses and expiry dates — by push notification and e-mail, if you turn them on.
• Identify a medicine by its EAN code and answer a question put to the assistant.
• Protect the account: detect abuse, limit sign-in attempts, fix an error that happened to you.
• Bill a paid plan — issue an invoice and keep the subscription — while plans are on.
• Improve the Application: the usage statistics show how many people finish creating an account, which screens nobody opens and where people stop.
• Keep the assistant and medicine recognition within their costs: count what calls to AI models cost for each household, to set fair limits and plan prices and to notice abuse.
• Correct the medicine catalogue from error reports, and count aggregate figures from account data (such as how many accounts there are and how many used the App in the last week), which point at nobody.

Each purpose has its own legal basis:

• Running the account and the cabinet: performance of the contract you enter by accepting the terms (art. 6(1)(b) GDPR).
• Health data — medicines, doses, history, symptoms, household profiles: your explicit consent, given at registration as a separate statement (art. 9(2)(a) GDPR). Without it the Application cannot work, because a cabinet is a collection of such data.
• Push notifications and the AI assistant: your consent, separate for each, switched on and withdrawn in the Application (art. 6(1)(a) GDPR).
• Security logs and error reports: our legitimate interest in keeping the account safe and the Application running (art. 6(1)(f) GDPR). You may object — see section 8.
• Invoices and billing records, while plans are on: a legal obligation under tax law (art. 6(1)(c) GDPR).
• Usage statistics: our legitimate interest in improving the Application (art. 6(1)(f) GDPR). You can switch them off yourself in “Privacy and data” with “Send statistics from this device”; a browser sending Global Privacy Control or Do Not Track sends none at all.
• What calls to AI models cost, counted per household: our legitimate interest in keeping the assistant within its costs, setting limits and plan prices and catching abuse (art. 6(1)(f) GDPR). We record numbers only — how many calls, how many tokens and what they cost in a month — never their content. You may object — see section 8.
• Error reports and aggregate figures from account data: our legitimate interest in a correct medicine catalogue and in running the service (Art. 6(1)(f) GDPR).

We sell your data to nobody and show no advertising. We use providers who process data only on our instructions:

• OVH (France, EEA): the Application's servers, database and backups.
• OpenAI (USA, outside the EEA): the assistant and identifying a medicine by EAN.
• Google — Firebase Cloud Messaging (EU, EEA): delivery of push notifications.
• Resend (USA, outside the EEA): sending e-mail from the Application.
• Sentry (USA, outside the EEA): collecting Application error reports.
• Stripe (USA, outside the EEA): payments and invoices — only while paid plans are on.

The current list with each provider's role and location is in the Application under "Your data". Beyond that list, data may go only to an authority that demands it under the law.

Four providers operate in the United States. Each receives only what its role needs:

• OpenAI receives the text of your question, the last few exchanges of the conversation, and the names, stock, expiry dates and leaflet excerpts of the medicines in your household's cabinet. It receives no names — neither yours nor the household's. Under OpenAI's API terms, data sent through the API is not used to train models.
• Resend receives your e-mail address, your name and the text of the message we send (a reminder, a confirmation link, an invitation).
• Sentry receives an error report: which screen, which browser, which error. The contents of form fields and entries are masked before the report leaves your device.
• Stripe receives what a payment and an invoice need — only while paid plans are on.

The transfers rest on the standard contractual clauses adopted by the European Commission (art. 46(2)(c) GDPR) or on the provider's certification under the EU-US Data Privacy Framework (art. 45 GDPR). Which tool applies to which provider is shown under "Your data" — until the agreements with each of them are confirmed, the list there is labelled unverified. A copy of the clauses is available on request.

For as long as the account exists, unless a shorter period is given below:

• Account data and health data: until the account is deleted.
• The IP address, device and page address on activity history entries: 12 months, then removed from the entry. The entry itself — who gave a dose and when — 24 months, then deleted.
• Device sessions: until sign-out, or 30 days from last use for a remembered device; 2 hours for one not remembered.
• Application logs on the server: 14 days.
• Error reports in Sentry: 90 days.
• A copy of your data you ask for: 48 hours, then the file is deleted.
• An account after deletion is requested: 30 days in which you can recover it by signing in. After that the data is erased for good.
• The consent register: until the account is deleted — we have to be able to show what you agreed to and when, and when a consent was withdrawn.
• Billing data, while plans are on: as long as tax law requires, including after the account is deleted.
• Usage statistics: 24 months, then deleted.
• The cost of calls to AI models: monthly totals linked to the household — until the account is deleted; after that they remain only in totals that cannot be linked to anyone.
• Reports of an error in a medicine's data: until handled and 12 months after; deleting the account deletes its reports too.

Deleting the account erases the cabinet, the dose history, the courses, the symptom diary and the household profiles you own. You can download a copy of the data first.

Under the GDPR you have the right to:

• Access your data and receive a copy (art. 15) — in the Application: "Your data" "Download your data".
• Rectify your data (art. 16) — every cabinet entry, profile and name is yours to change.
• Erase your data (art. 17) — delete the account under "Your data"; 30 days later the data is gone for good.
• Restrict processing (art. 18) — write to us; while the matter is clarified we stop all processing except storage.
• Data portability (art. 20) — the copy you download is JSON, a machine-readable format.
• Object to processing based on our legitimate interest (art. 21) — write to us; we will consider it unless there are overriding grounds, such as protecting the account from abuse. You object to the usage statistics yourself by switching them off in “Privacy and data”.
• Withdraw any consent at any time (art. 7(3)) — in the Application: "Your data" "Consents". Withdrawal does not affect the lawfulness of processing before it.
• Lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

We answer a request without undue delay and within a month at the latest.

The cabinet is shared, so you enter other people's data into it: a child's name, a parent's doses, a partner's allergies. You do so as the person looking after them or running the shared household.

Tell your household that their data is in the Application and where they can read this policy. Each of them may ask you or us to see, correct or erase their data. A member with their own account manages their own data; for a person without an account, you answer as the cabinet's owner. A child's profile is kept by an adult.

An account may be created by a person aged 16 or over (art. 8 GDPR and the Polish age threshold). You confirm this at registration with a separate statement; younger people cannot create an account. A child's data may be in the Application only as a profile kept by an adult carer.

The assistant answers questions about the medicines in your household's cabinet, quoting their leaflets. It works only with your consent. When you ask a question, its text, the last few exchanges of the conversation and the list of medicines in the cabinet — up to 60 — go to OpenAI, with their names, active substances, whether they need a prescription, stock, expiry dates and excerpts of their leaflets. No names — neither yours nor the household's. The answer is labelled as generated by a model.

The conversation itself is not stored on our server. It stays in your browser (in its local storage) and goes when you clear it, sign out or press "New conversation". On the server we count how many questions were asked in a month — the free plan has a limit — and what calls to AI models cost in a month (the number of calls, the tokens and the cost), and record which version of the assistant's instructions produced an answer. We do not store the questions or the answers.

The assistant does not diagnose, does not recommend prescription medicines, and directs you to a doctor for red-flag symptoms. MedSzafka is not a medical device.

The Application keeps in your browser's storage (localStorage and IndexedDB) on your device: the session token, a copy of the screens you last looked at (so they open at once and work without a network), the conversation with the assistant, and the appearance settings. This storage is tied to your account and shared with nobody; signing out clears it. We use no cookies or other identifiers for tracking — the only cookie tells the browser it is signed in and holds no data. The usage statistics store nothing on your device; if you switch them off, the browser remembers only that.

We make no decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you (art. 22 GDPR). The Application counts dates and quantities, and the assistant answers questions; neither decides about you or your treatment.

Passwords are stored only as a hash (bcrypt). All communication is encrypted (TLS). Every signed-in device has its own session, which you can disconnect in the Application. Backups are encrypted. The servers are in the European Union. Sign-in attempts and requests are rate-limited. Only the administrator has access to the server, and every change to the Application passes automated tests. We keep a description of the technical and organisational measures in internal documentation and make it available to the supervisory authority on request.

Administrative access to the service needs two-step sign-in every time, goes through a private, encrypted network and is recorded.

The policy carries a version number and an effective date — both shown at the top of this screen. When we change the text, we raise the version, and on your next visit the Application asks you to read and accept the documents again. The consent register records which version you accepted and when.