Privacy Policy for RemTab

RemTab (“we”, “us”, the “App”) is a medication reminder app for Android, published by Two North Studios. This policy explains what information the App collects, why, where it’s stored, and what choices you have.

1. Who this covers

RemTab has two kinds of user: a patient (the person taking medication) and, optionally, a caregiver (a family member the patient chooses to connect, who can see the patient’s medications and adherence and receive alerts if a dose is missed). Everything below applies to both, and each section says which role it concerns where it matters.

You can use RemTab as a patient without ever creating an account or giving us your name — see §2.

2. Information we collect

2.1 If you never sign in

RemTab works fully offline for a patient who never creates an account. In that case, nothing described in this policy leaves your device: your medications, schedule, photos, and dose history are stored only in a local database on your phone. We have no way to see, back up, or recover this data, and no way to know you exist.

2.2 If you sign in (patient or caregiver)

Signing in is required only to connect with a caregiver, or to keep your data if you get a new phone. When you sign in, we collect:

• An account identifier — a random id, plus whichever of these you used to sign in: your email address, or your Google account’s email and name (if you use “Sign in with Google”).
• A display name, if you choose to add one, shown to a connected caregiver or patient so they know who they’re looking at.
• Your medications: names, dosage amount and unit, and schedule (frequency, time of day, days of week).
• Your dose history: when a dose was due, and whether you marked it taken, skipped, or missed, and when.
• Caregiver connections: if you connect with a caregiver, we store that connection (who’s linked to whom) and a short-lived, single-use code used to make the connection.
• A push notification token for your device, if you’re a caregiver who wants alerts when a patient misses a dose, or a patient who wants to be nudged by a caregiver. This is an opaque identifier issued by Google’s push notification service (Firebase Cloud Messaging), not personal information on its own.
• Messages sent between a connected patient and caregiver — a small fixed set of preset “nudge” messages (e.g. “checking in”), and any schedule-time change a caregiver suggests, which the patient must approve before it takes effect.

We do not collect your date of birth, address, phone number, insurance information, prescriber information, or any medical diagnosis. RemTab only knows the name of a medication you’ve told it about and whether you took it — it has no clinical context.

2.2.1 Medication photos

RemTab’s core feature is a photo of your medication, shown in your dose reminder. As the app is currently built, this photo never leaves your device — it’s stored only in local storage on your phone, and is not part of your account or backed up anywhere by us. If you switch phones or reinstall the app, your medication photos do not come back, even though your medication names, schedule and history do.

2.3 Refill tracking

If you turn on refill tracking for a medication, that information (start date and how many days a fill lasts) is stored locally on your device only, the same as photos — it is not part of your account and is not backed up.

2.4 Purchases (caregiver subscription)

RemTab’s caregiver subscription is not live yet. Once it is, this section will describe the subscription tier and status we store against your account, and that payment itself is handled entirely by Google Play — RemTab and Two North Studios never see or store your card details.

2.5 What we don’t collect

RemTab has no analytics or tracking SDK of any kind — no advertising id, no usage analytics, no third-party crash reporting. We rely solely on Google Play’s own store-level crash and stability reporting (Play Console vitals), which does not identify you to us individually.

3. Cookies and other tracking technologies

RemTab is a native Android app, not a website — it does not use browser cookies, and, as covered in §2.5, has no analytics or advertising SDK of any kind. Nothing in the App tracks you across other apps or sites.

This policy, and the rest of twonorthstudios.com, are served as plain web pages. We do not set any cookies of our own on them. Our hosting provider may set technical cookies strictly necessary to deliver the page to your browser; none are used for tracking, analytics, or advertising.

4. Who your information is shared with

• A caregiver you’ve connected with sees your medication names, schedule, and adherence history — nothing more. You can disconnect a caregiver at any time in Settings, which immediately removes their access; it does not affect your own reminders.
• A patient who’s connected a caregiver to them can see that the caregiver has connected, and can disconnect them.
• Google, as our infrastructure providers: Firebase Cloud Messaging delivers push notifications, and Google Sign-In handles authentication if you choose that sign-in method. Google processes the minimum needed to deliver these services (a device token for push; your email/name for sign-in) and does not receive your medication data as part of this.
• Supabase, our database and authentication provider, hosts your account data in the EU (Frankfurt, Germany). Supabase is a processor acting on our instructions, not an independent user of your data.

We do not sell your information, and we do not share it with anyone for advertising or marketing purposes. We have never received a government request for user data.

5. Where your information is stored

Account data (everything in §2.2) is stored in our database, hosted in the EU (AWS Frankfurt, eu-central-1). Medication photos and refill details (§2.2.1, §2.3) stay on your device only, regardless of where your account data lives.

6. How long we keep your information

We keep your account data for as long as your account exists. Dose history and medication data are kept so you and any connected caregiver can see your adherence trends over time — we do not keep it for any longer, or for any other purpose.

If you delete your account (§8), we delete this data from our production systems immediately, or within 30 days if you request deletion by email. Routine backups kept for disaster recovery may briefly retain a copy after that, purely so we can restore the service if something goes wrong — these are cycled out and overwritten in the ordinary course of business, not kept as a separate record, and are never used to reconstruct a deleted account.

7. Health data and your consent

Medication information is “special category data” under UK/EU data protection law, which requires either your explicit consent or another specific lawful basis to process.

As RemTab is currently built, there is no separate consent step during setup beyond agreeing to this policy and our Terms of Service — our lawful basis for processing this data is that it’s necessary to provide the reminder service you’re actively asking for, carried out at your direction, for your own health management.

8. Your rights, and deleting your account

If you’re in the UK or EEA, UK/EU GDPR gives you the following rights over your personal data. Each is already available in the ways described below:

• Access — request a copy of the data we hold on you, via Settings → “Download my data”, or by emailing us.
• Rectification — correct inaccurate information by editing it directly in the app.
• Erasure — delete your account and everything tied to it, from Settings → Delete account.
• Restriction or objection — ask us to stop processing your data by emailing us; because deleting your account removes the data outright, that’s usually the simpler route.
• Portability — request your data in a form you can take elsewhere, via “Download my data”.
• Complaint — lodge a complaint with your local data protection authority (in the UK, the ICO) if you believe we’ve mishandled your information.

Because our lawful basis for processing your medication data is that it’s necessary to provide the service you’re actively using (§7), rather than your consent, there’s no separate “withdraw consent” step — stopping and deleting your account has the same effect.

You can delete your account at any time from Settings. This permanently removes your account, your medications, schedule and dose history, and your caregiver connections from our servers — this cannot be undone. Deleting your account does not affect medication photos or refill data, which were never on our servers to begin with (§2.2.1, §2.3).

You can ask us questions about what we hold on you at any time by contacting info@twonorthstudios.com.

A web-based account deletion request page is also available at twonorthstudios.com/remtab/delete-account, for anyone who can no longer access the app itself.

9. California residents

If you’re a California resident, the California Consumer Privacy Act (CCPA) and CalOPPA give you rights over the categories of personal information described in §2:

• Right to know and access — the categories of personal information we collect (§2), why we collect it, and the specific pieces we hold on you.
• Right to delete — request deletion of your account and the data associated with it (§8).
• Right to opt out of sale or sharing — not applicable: we do not sell or share your personal information, and never have (§4).
• Right to non-discrimination — we will not treat you differently for exercising any of these rights.

To exercise any of these rights, contact us at info@twonorthstudios.com — we’ll respond within the time required by law.

10. Children

RemTab is not directed at children and we do not knowingly collect information from anyone under 16. If you believe a child has created an account, contact us at info@twonorthstudios.com and we’ll delete it.

11. Changes to this policy

If we make a material change to this policy, we’ll update the effective date above and, for a genuinely significant change, notify you in the app.

12. Contact us

Two North Studios
info@twonorthstudios.com