Who is responsible for the processing

The developer and operator of the app:

• Serhii Lypii, sole trader (eenmanszaak)
• Address: Juliana van Stolbergstraat 28, 4532 AZ Terneuzen, the Netherlands
• KvK (Chamber of Commerce): 99817039
• BTW (VAT): NL005412268B54
• Email: serhii@lypii.nl

The Policy applies to the Vistadose app for iOS and Android. It does not apply to app stores, Google Drive, Open Food Facts or your device's operating system. They have their own policies.

Health data is a special category

Information about the taking of medications, weight, how you feel and side effects belongs to a special category of personal data (Article 9 GDPR). That is why the app is built so that this data does not leave the device unencrypted, and I do not receive it, do not see it and do not store it.

The legal basis for the processing on the device is your own decision to keep a diary. There is no processing of your health data on my side, so no basis for it is required either.

What is stored on the device

Everything listed below is entered by you, and all of it stays in the app's encrypted database on the phone:

• medications, doses, the intake schedule and the supply
• marks for doses taken, missed and rescheduled, injection sites
• weight, measurements, side effects, appetite, lab results, protein, water and fiber
• foods, meals and food entries
• progress photos
• notes, tags, questions for your doctor and settings
• the profile: name and year of birth, if you give them; both fields are optional

Deleting an entry marks it as deleted, and it is finally erased from the database within thirty days. Deleting the app or the "Delete all data" button erases the database, the photos, the downloaded food database and the encryption keys immediately.

What I do not receive

• entries about medications, doses, how you feel and weight
• photos, notes, foods and the names of your trackers
• data from Apple Health and Health Connect
• the name or email address of your Google account
• precise location
• advertising identifiers: IDFA and AAID are not requested

The app has no ads and no third-party advertising or tracking SDKs. The App Tracking Transparency prompt is not shown, because the app does not track anyone.

Encryption and the lock

The database and the attached files are encrypted on the device. The encryption key is kept in the secure storage of the operating system and is tied to the device.

If you wish, you can turn on a lock for the app by Face ID, Touch ID, fingerprint or a PIN code with a timeout. It is off by default. When the lock is on, the content of the app is hidden in the app switcher.

The database is deliberately excluded from the system backups of iCloud and Android: the encryption key is tied to the device, and a database restored that way would be unreadable. Data can only be transferred by the app’s own backup.

Backup to a file or a folder

You can save an encrypted backup file yourself, or let the app save one automatically to a folder you choose on the device. The file is encrypted before it is written. The key is derived from your recovery code, which is shown when backup is turned on. Without this code the file cannot be read, by me either. If you lose the code, no one can restore the data.

Google Drive: cloud copy and sync between your devices

This is optional and is turned on by you in Settings › Sync.

• What the app asks Google for. Only access to its own hidden app folder in your Google Drive (the drive.appdata permission). The app cannot see, open or change any other file in your Drive, and it does not read your account’s name or email address.
• What is stored there. Encrypted change files, encrypted photo files and encrypted backup copies (the newest three). Everything is encrypted on your device before it is sent, with a key protected by your recovery code. Google stores the files but cannot read them, and neither can I.
• What Google can see. That the app uses the folder, the number of files, their sizes (rounded) and when they change. File names do not reveal their content.
• Sync between devices. A second phone or tablet joins with the same recovery code. Each device writes its own encrypted files and reads the others’.
• How to stop and remove the data. In Settings › Sync choose “Turn off sync on this device”. To remove the app’s folder from Google Drive, open your Google Account › Security › Third-party apps with account access, remove Vistadose, and in Google Drive › Settings › Manage apps choose “Delete hidden app data” for Vistadose.

Vistadose’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Camera and photos

The camera is used only when you take a progress photo or scan a food barcode, and only after you allow it.

• Progress photos are stripped of location and other metadata, resized and encrypted on the device. They are not added to your photo library.
• Barcode scanning happens on the device. The camera image is not saved or sent. Only the number read from the barcode is used.

Food: barcode lookup and the food database

• Built-in data. The app contains a set of popular products and basic foods, so most lookups happen on the device with no network.
• Online lookup on Open Food Facts. If a scanned product is not on the device, the app asks once whether it may look it up online. Only if you agree, the barcode number is sent to Open Food Facts (openfoodfacts.org). Like any web service, Open Food Facts also sees your IP address. No name, email, health data or food history is sent. The product found is saved in your encrypted database. You can turn the lookup off in Settings › Food. Open Food Facts has its own privacy policy.
• Offline food database for your country. If you choose to download it, the file is downloaded from my server (apps.lypii.nl). The file is the same for everyone. My server sees your IP address and which country file was requested; these server logs are kept for at most 14 days for operation and security and are not linked to anyone.

The product data comes from Open Food Facts (available under the Open Database License) and from USDA FoodData Central.

Apple Health and Health Connect

The connection to Apple Health and Health Connect is optional and is turned on by you. The app works fully without it.

If you turn it on, the app reads your weight and height and adds them to your log. Permission is requested only at the moment the feature is turned on.

Data from Apple Health and Health Connect is not transferred to third parties, is not used for advertising and does not go into diagnostics and analytics.

Widgets, the lock screen and notifications

Widgets, notifications, the Live Activity and the lock-screen widgets show only what you allow. By default, what can be seen without unlocking the phone is neutral ("1 to do", "Done"), without medication names or numbers. Weight is never shown on the lock screen. You can change this in Settings › App lock › Widgets.

Purchases and the subscription

Payment goes through the App Store or Google Play. Payment details are processed by the store. I do not receive, do not see and do not store them.

To check whether the premium part has been paid for, the RevenueCat service is used. It is sent a de-identified identifier of the app installation and the information about the purchase from the store. Your health entries do not enter this exchange.

Diagnostics and analytics, only with your consent

Crash reports and de-identified usage statistics are off by default. They can be turned on with two separate switches at first launch or later in the settings, and turned back off at any time.

Even when the reports are on, the values of entries, notes and the names of medications, foods and trackers do not get into them: they are filtered out before sending. Screenshots and the action log with interface text are disabled.

Where the app goes out to the network

All network requests go over HTTPS. The app contacts only the following recipients:

• the app store: purchases and the restoring of purchases
• RevenueCat: the check of the paid premium part
• the crash reporting and analytics service: only if you have turned them on
• Google Drive: only if you have turned on the cloud copy or sync
• Open Food Facts: only if you have allowed the online barcode lookup
• my server apps.lypii.nl: only when you download or update the food database for your country

Without these actions the app works fully offline.

Your rights

Under the GDPR you have the right of access to your data, the right to its rectification, erasure, the restriction of processing and portability. Since the data is stored on your device and in your own Google Drive, you exercise most of these rights yourself and immediately:

• access and rectification: right in the app, any entry can be edited
• portability: export to CSV, JSON or PDF in the reports section
• erasure: the "Delete all data" button in the settings; for Google Drive, see the section above

If you need something that cannot be done in the app, write to serhii@lypii.nl. You are also entitled to lodge a complaint with a data protection supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens.

Children

The app is intended for adults and has the corresponding age rating in the stores. It is not addressed to children, and I do not knowingly collect children’s data.

Changes to the Policy

If the Policy changes, the new version will be published on this page with a new date. Material changes I will note in the release notes of the app.

Contact

With any questions about this Policy and about the processing of data, write to serhii@lypii.nl. I reply personally, usually within one to three days.