Medicine Tracker is a personal medication-tracking mobile app published by GNLE Lab LLC ("we," "us," "our"), a Georgia limited liability company with its principal office at 1870 The Exchange SE Ste 220 #430948, Atlanta, GA 30339. You can reach our privacy team at contact@gnlelab.net.
This policy describes the information we collect when you use Medicine Tracker, how we use that information, who we share it with, how long we keep it, and the choices you have. It applies to the Medicine Tracker mobile app and the application programming interface ("API") that supports it.
We collect only the information needed to run Medicine Tracker for you:
XSRF-TOKEN to protect that page against
cross-site request forgery attacks. This cookie is
server-only (HttpOnly), expires when you
close the browser, and is not used to track you. The
mobile app does not use cookies.
We do not collect device identifiers for advertising, precise location, location from your device's location services, contacts, microphone, health data from device sensors, or any other category we do not need to run the app. The only location-related information we hold is the coarse ZIP code described above. We access your camera or photo library only when you choose to add a profile photo for a family member or attach a screenshot to feedback, and only for the image you select; we do not otherwise browse your photo library.
We use the information above only to:
We do not use your information to build advertising profiles, to train machine learning models, or for any purpose unrelated to operating Medicine Tracker.
We do not sell your information, rent it, trade it, share it with advertisers or data brokers, or disclose it to third parties for their own independent use. Medicine Tracker does not show advertising, and we do not embed third-party advertising or marketing-analytics software development kits ("SDKs") in the app. The app does include the Sentry crash-reporting SDK described in Section 3, which receives technical crash reports and no health information.
We share your information only with the service providers ("subprocessors") below, each of whom processes your information on our behalf under contractual terms requiring them to protect it.
| Subprocessor | Role | Data they process |
|---|---|---|
| Google Cloud Platform | Application hosting and database (Cloud SQL for PostgreSQL). Hosting and data storage are located in the United States. | All information described in Section 3, stored at rest in our managed PostgreSQL database. In addition, our hosting platform automatically records a server request log for each request, which includes the IP address of the request, the request path, and basic response metadata such as status code and timing. |
| Resend | Transactional email delivery (account verification, password resets, family invitations, security alerts, and account-deletion confirmation) and occasional product update announcements. Emails are processed and stored in the United States. | Your name and email address, and the body of the message we send you. |
| Cloudflare | DNS resolution and edge protection for our domains. | Network metadata associated with requests to our domains (IP address, request path). Cloudflare does not see the contents of authenticated API responses. |
| Sentry (Functional Software, Inc.) | Crash and error reporting for the mobile app. Crash reports are processed and stored in the United States. | Device model, operating system version, app version, device-state details (memory, storage, battery, orientation), technical error details (stack traces), and a random installation identifier used to count affected devices, when the app crashes or encounters an error. Crash reports do not include your medicines, family members, or dose records, and we configure Sentry not to attach your IP address. |
This list is current as of the "last updated" date at the top of this policy. If we add a new subprocessor, we will update this list before sending your data to them.
We may also disclose information when we believe in good faith that doing so is required by law (for example, in response to a valid subpoena or court order), to protect the rights and safety of our users or the public, or in connection with a corporate transaction such as a merger or asset sale, in which case the successor entity is bound by the commitments in this policy or you receive notice and an opportunity to delete your data first.
We keep your account information for as long as your account is active. When you ask to delete your account from the Settings screen, we send a confirmation email to your account address. Clicking the link in that email completes the deletion. The link is valid for 24 hours. If you do not click the link within that window, the request expires and nothing is deleted, so an accidental tap on Delete cannot remove your account without an additional confirmation from your inbox.
After you confirm by clicking the link, we permanently remove your personal data (your name, email address, password hash, sign-in records in our database, and refresh tokens) in a single database transaction. We do not retain a copy and there is no recovery period. The separate security and operational logs described below are retained on their own schedule.
Family records you shared with other caregivers persist for them. A family group, the medicines it tracks, and the intake history belong to the family, not to any single caregiver. Where intake records you logged remain available to other caregivers in the family, your name is removed from those records.
Member profile photos. A profile photo you add for a family member is deleted from our storage whenever that member is removed, whether you clear the photo, delete the member, delete the family, or delete your account. No member photo is kept after the member it belongs to is gone.
Pending invitations. An invitation you send to add a caregiver to your family is valid for 7 days. We keep the invitation record (including the invitee's email address) for that window. After 7 days the invitation expires and can no longer be used to join your family; expired invitation records are removed during routine maintenance. If you want us to delete a specific pending invitation sooner, email contact@gnlelab.net.
Feedback. Feedback you submit through the in-app form is kept so we can act on it and follow up where you have asked us to. Any screenshot you attach is stored for at most 365 days and is then deleted automatically. Deleting your account removes the link between your feedback and your account, but it does not delete the feedback itself or any attached screenshot; those follow the retention described here. If you want us to remove a specific feedback submission or its screenshot sooner, email contact@gnlelab.net.
Authentication and security logs. The application logs described in Section 3 (sign-in events, failed sign-ins, suspicious-activity alerts), together with the server request logs our hosting platform records for each request (which include the IP address and request path), are retained in our logging system for the period required by our security and operational needs, currently a rolling window measured in months rather than years. These logs do not contain your medicines, doses, or family member records.
You can manage your information directly from inside the app:
If you are a resident of Washington State, the Washington My Health My Data Act gives you the right to confirm whether we are processing your consumer health data, to access that data, to withdraw consent for processing, and to request deletion. Each of these rights is satisfied by the in-app surfaces above. If you have trouble using the in-app controls, email contact@gnlelab.net and we will assist you.
If you are a resident of California, Connecticut, Colorado, Texas, or another state with a comprehensive privacy law, you may have similar rights to access, correct, delete, or obtain a portable copy of your information. We treat all U.S. users the same and honor these requests regardless of your state of residence. We do not sell personal information or share it for cross-context behavioral advertising under any state law's definition of those terms, so no opt-out is required.
To create an account, you must be at least 18 years old and a resident of the United States. By creating an account, you confirm that you meet both requirements. We do not knowingly accept accounts from persons under 18 or persons residing outside the United States, and we may delete any account that we believe in good faith does not meet these requirements.
Family member records inside the app may describe persons of any age, including children. For example, a parent may set up a family member record for each of their children to track the children's medications. Those records are created and managed by the adult account holder; the child does not have an account, does not sign in, and does not interact with the app directly. The adult account holder is responsible for ensuring they have authority (as parent, guardian, or otherwise) to enter information about each family member.
Medicine Tracker is not directed to children under 13. Although our eligibility rules already require account holders to be 18 or older, if you believe a child under 13 has nonetheless created an account, email contact@gnlelab.net and we will delete the account.
If you travel outside the United States, the app may continue to function, but we do not target or market the app outside the United States. If your residency changes such that you are no longer a U.S. resident, please email us so we can arrange to delete your account.
We follow reasonable security practices appropriate to the sensitivity of the information we hold. Connections between the app and our servers are encrypted in transit using Transport Layer Security ("TLS"). Passwords are stored only as salted hashes computed with the bcrypt algorithm. Our database is access-controlled, and access events are recorded in our logging system. We rate-limit authentication endpoints, monitor for unusual sign-in patterns, and alert account holders to suspicious activity. We do not, however, guarantee that our security measures will prevent every unauthorized access, and we ask you to use a strong, unique password for your Medicine Tracker account.
Medicine Tracker is a vendor of a personal health record subject to the Federal Trade Commission's Health Breach Notification Rule (16 CFR Part 318). If we experience a breach of unsecured personally identifiable health information, we will notify each affected user and the FTC within the timelines required by the Rule (no later than 60 calendar days after discovery for affected users; sooner, within 10 business days, for notification to the FTC if 500 or more users are affected). If 500 or more residents of a single state or jurisdiction are affected, we will also notify prominent media outlets serving that area as required by the Rule.
Medicine Tracker is a personal medication-tracking tool. It records the doses you log and warns you when a new dose would exceed limits you have configured. It does not provide medical advice, diagnosis, or treatment. The dose-safety indicator reflects the limits you entered when you set up the medicine, not a pharmacological evaluation. Medicine Tracker does not check drug interactions, contraindications, allergies, or medical history. Always consult your healthcare provider for medical guidance about your medications. The full disclaimer is part of our Terms of Service.
We may update this policy from time to time. The "last updated" date at the top reflects the most recent change. Material changes (for example, adding a new subprocessor or a new category of information we collect) will be announced in-app or by email to your account address before they take effect. Your continued use of Medicine Tracker after a change becomes effective constitutes acceptance of the updated policy.
Privacy questions or requests should be sent to contact@gnlelab.net. Please include the email address associated with your Medicine Tracker account so we can respond appropriately.