Privacy Policy

Last updated: 25 October 2026

We take the protection of your personal data seriously. This policy explains in plain language what data Meditag processes and why.

1. Data controller

Robomoe Genossenschaft
Sägagass 23
9490 Vaduz, Liechtenstein
Email: privacy@meditag.ch

2. What data is processed?

2.1 Data on your device (always, locally)

Meditag stores the following data on your device:

• Medication plan (name, dosage, dose times)
• Dose log (when you marked a medication as taken or skipped)
• Vital signs (blood pressure, pulse, weight, etc.), if you record them
• Reminder settings and personal schedule settings

This data only leaves your device if online backup is on, you connect another phone, or you create a share link for a doctor or pharmacy (see 2.2, 2.3 and 2.7); in that case it leaves encrypted. If you share your plan yourself, for example as a doctor PDF or QR code (2.7), it leaves unencrypted — the responsibility is then yours.

2.2 If you use online backup (optional)

During setup, the app suggests online backup. You can decline it there, or turn it off later under Settings > Backup.

When online backup is on, your data is encrypted on your device before it is sent. The server stores:

• A code that the app calculates from an identifier of your device. It contains neither your name nor any other information about you.
• An encrypted file with your data. We have no access to its contents.
• Check values that let the server recognise that a request comes from you. The server does not store your recovery key or your recovery code.
• When your phone last used the backup. This lets the server tell whether a phone used it in the last 14 days, for example before a new phone takes the backup over. The server updates this time at most once an hour.
• A support code, only if the app finds an earlier backup that it cannot open and you tap «Report a problem». The server stores only a check value that it calculates from the code with a secret key, when the code was created and when it expires, and how often a wrong code was checked. The code is valid for 7 days; after 5 wrong checks the server deletes it. If there is no backup, the server stores nothing.

The server does not know your name, your date of birth, or your medications.

Recovery key and recovery code: during setup, the app creates a recovery key. Only this key can open your backup. With the recovery code, the app finds your backup on the server again, for example on a new phone. Keep both in a safe place. We do not have them and cannot replace them. Older backups may still be protected by a password you chose yourself.

If you turn online backup off: the server keeps the last encrypted copy for up to 30 days. This means a deletion made by mistake can be undone. After that, the copy is deleted for good. During this time, too, we cannot read its contents. At your request (see section 6), we also delete this copy.

Unused backups: a backup that has not been used for 12 months is deleted automatically by the server.

2.3 If you use the family feature (optional)

You can connect the phone of someone you trust, or a second phone of your own, to your phone (via QR code). Your medication plan, your doses and your daily rhythm are then sent to the connected phone, end-to-end encrypted. The server only passes the data on and cannot read it. The key exists only on the connected devices. The server usually deletes each encrypted change after 30 days.

So that the person you trust can be notified when a dose is not confirmed, the server knows the times of your doses (for example 08:00 in the morning). It does not know which medications you take. The server also knows which devices are connected to each other, but not who they belong to.

You can end a connection at any time. The copy of your plan on the other phone is then deleted. Once no trusted contact is connected any more, the server deletes the times.

2.4 Technical data

The server logs technical operational data (number of connections, error rate). This contains no health data and cannot be used to identify individuals.

Error reports and usage statistics: if the app crashes, it sends an error report (for example app version, operating system and error message). It also reports which features are used. Both carry a random device number and are not linked to you or to your health data. You can turn both off in Settings. The server deletes error reports after 90 days and usage data after 12 months.

2.5 Apple Health / HealthKit data (optional, iOS only)

If you use the sync feature on the Vitals screen on an iPhone, Meditag requests read-only access to the following data types in Apple Health. Meditag does not write any data back to Apple Health:

• Blood pressure
• Heart rate
• Body weight
• Blood glucose
• Oxygen saturation
• Body temperature

Purpose: The data is used solely to display your readings on the Vitals screen and, if you choose, to include them in the doctor PDF. Meditag does not analyse this data, does not provide clinical recommendations, and does not make any medical decisions based on these values.

Storage: The data remains exclusively on your device, stored with strong encryption in the app's local database. If you use online backup, vital-sign data is part of the backup — the backup is encrypted on your device with AES-256-GCM before transmission; the server receives only opaque ciphertext, never plaintext values. Your vital data is not transmitted in plaintext to Meditag's servers, not shared with third parties, not used for advertising or analytics, and not used for profiling individuals.

Deletion: You can revoke HealthKit access at any time — in your iPhone's Settings → Privacy & Security → Health → Meditag. Readings already stored in the app can be deleted from within the app. You can delete all app data at any time by uninstalling the app or via our data deletion page.

2.6 Looking up a medication and reporting an unknown medication

When you scan a box, the app sends only the code on the box to the server to look up the name of the medication. This code says nothing about you.

If Meditag does not know a medication, you can choose to send us its name and a photo of the box. This lets us add the medication. The following applies:

• Please type only the name printed on the box, and photograph only the front of the box. Do not photograph the pharmacy label with your name.
• The app crops the photo on your phone to the area you choose. It removes extra information such as location, the time the photo was taken and the camera model.
• No account, no device number and no code from your backup are sent with the photo.
• Only our team can see the report. We delete the photo after 30 days and the typed name after 90 days.

2.7 Sharing with a doctor or pharmacy (optional)

You can share your medication plan with a doctor or pharmacy in three ways:

• Share link: you create a link for a doctor or pharmacy in the app, similar to the family feature (section 2.3). Your data is encrypted on your device before the server stores the encrypted copy. The key is part of the link itself and is never sent to the server — only someone with the full link can read the data. You can revoke the link at any time; after that, no one can access it any more.
• Doctor PDF: you can create your medication plan — with your vital-sign data if you choose — as a PDF and pass it on yourself, for example by printing it or sending it by email. The PDF is created entirely on your device and is not sent to Meditag's server. It is deliberately not encrypted, so your doctor or pharmacist can read it directly; once you share it, the responsibility is yours.
• Medication-plan QR code: the app can display your medication plan as a QR code in the Swiss standard format, which a doctor or pharmacist can scan directly. The code is created on your device and is not sent to Meditag's server. As with the doctor PDF, the content is not encrypted, so it can be read with standard readers.

In all three cases, you decide who you show or send the link, PDF or QR code to. Meditag never has access to the content.

3. Third-party services

Meditag does not use analytics services, advertising networks, or social media integrations. No personal health data is shared with third parties.

Firebase Cloud Messaging (FCM): When it starts, the app registers with Firebase Cloud Messaging (a service operated by Google LLC, USA) to receive push notifications — for example when the plan has changed on a connected phone. Google receives an identifier of the app on your device and technical device information. For connected phones, there is also a wake-up message with no content, carrying only the number of the connection. Google receives no name, no health data and no personal information. Google's Firebase Privacy Policy applies. FCM is used exclusively for notification delivery and not for analytics or advertising.

Apple HealthKit (optional, iOS only): For full details on how HealthKit data is handled, see section 2.5.

4. Server location

The server is located in Switzerland and is subject to the Swiss Federal Act on Data Protection (FADP/nFADP).

5. Retention

• Local data: Remains on your device until you uninstall the app or delete data within the app.
• Online backup: Remains on the server as long as online backup is on. After you turn it off, the server keeps it for up to 30 days and then deletes it. A backup that has not been used for 12 months is deleted automatically. On request, we delete it sooner.
• Server backups: The server is backed up every day. We keep these backups for up to 45 days. If you turn off online backup, or we delete your data at your request or after 12 months without use, we apply this again when we restore from a backup. For this, we keep a deletion record that holds a coded reference instead of your identifier. We keep each entry for about two and a half months.
• Family feature: The server usually deletes each encrypted change after 30 days. It deletes the times used for notifications as soon as no trusted contact is connected any more.
• Sharing with a doctor or pharmacy: the encrypted copy stays on the server as long as the link is active. You can revoke it at any time; after that, no one can access it any more. The doctor PDF and QR code are not stored on our server.
• Report of an unknown medication: The photo is deleted after 30 days, the typed name after 90 days.
• Error reports and usage statistics: Error reports are deleted after 90 days, usage data after 12 months.
• Apple Health / HealthKit data (iOS only): Remains on your device until you delete it in the app or uninstall the app. Meditag does not store this data in plaintext on the server — if online backup is on, it is part of the encrypted backup.

6. Your rights

Under the General Data Protection Regulation (GDPR), applicable in Liechtenstein as a member of the European Economic Area (EEA), you have the right to:

• Access the data held about you
• Correct inaccurate data
• Request deletion of your data
• Restrict processing
• Data portability

To request deletion of your data, use our data deletion page or write to privacy@meditag.ch.

7. Data security

All connections between the app and server are encrypted — like online banking. Data from online backup, the family feature and a share link for a doctor or pharmacy is protected with strong encryption on your device before it reaches our server; we have no access to its contents. The doctor PDF and the medication-plan QR code (section 2.7) are deliberately created unencrypted, so your doctor or pharmacist can read them directly.

8. Minors

Meditag is not intended for persons under 18. We do not knowingly collect data from minors.

9. Changes to this policy

If we make material changes to this policy, registered users (with active backup) will be notified via the app. The date of the last change is shown at the top of this page.

---

Legal notice

Robomoe Genossenschaft
Sägagass 23
9490 Vaduz, Liechtenstein

Email: privacy@meditag.ch
Web: meditag.ch

Register number FL-0002.680.327-7

Meditag is not a medical device and does not replace advice from your doctor or pharmacist.