MedTogetherGet the app

Privacy Policy

MedTogether is a medicine reminder for you and your family, made by Handkit ("we", "us"). This policy explains what the app collects, why, where it's kept, who can see it, and the choices you have.

Last updated: 25 October 2026

The short version

  • We collect what the app needs to work: your account, the medicines and schedules you add, your dose history, and the photos you choose to add.
  • It's stored with Google Firebase in the United States, encrypted in transit and at rest.
  • Only you, and the people in your family if you share with them, can see your medicines.
  • No ads, no tracking, no third-party analytics. We never sell your data.
  • You can delete your account, and everything in it, from the app at any time.

What we collect

  • Account: your email address, the name you give, and how you sign in (Apple, Google or email). If you use Sign in with Apple and hide your email, we get a private relay address from Apple instead.
  • Medicines and schedules: what you enter for each medicine, such as its name, strength, form, notes, how many you have left, its schedule, whether it rings like an alarm, and your meal times.
  • Dose history: each scheduled dose and whether it was taken, skipped or missed, and when.
  • Photos (optional): pictures of a medicine's pack that you take or choose.
  • Family: which family you're in and who owns it, each person's sharing choices (Share my medicines with family, Let family make changes), whose missed-dose alerts you get, open invites, and missed-dose alerts and reminders sent between you.
  • Nicknames: if you give a family member a different name, it's stored privately with your account. Only you can see it.
  • Devices: for each phone you sign in on, a push notification token, its name and platform (iPhone or Android), whether reminders are on, and when it last connected.
  • Settings: your time zone (Automatic, or the one you pick) and language, stored on your account, so your schedule follows your time zone and family alerts show the right time in your language.
  • Purchases: whether you have Premium and until when. Payment details stay with Apple or Google; we never see them.
  • Emails to us: if you contact us, your email address and what you write.

Medicine information is health data. We use it only to run MedTogether for you and the people you choose, and you decide what to enter. We don't collect your location, contacts, or any advertising identifier, and the app has no third-party analytics or advertising code.

Why we use it

  • To run the app: show your day, remind you, keep your medicines in sync across your devices, and keep your history. This is the service you ask for when you create an account.
  • To share with your family: only with the people in your family, and only what each of you allows. This rests on your choice, which you can change at any time.
  • To send notifications: reminders and alarms (Ring like an alarm) are scheduled on your phone itself and work without our server. Family alerts and reminders from a family member are sent through our server, and include the person's name and the medicine's name.
  • To handle Premium: to know whether you, or the owner of your family, have Premium, and to pause family features 14 days after the owner's Premium ends.
  • To keep it safe and working: to prevent abuse (for example, limiting how often reminders can be sent to someone), fix problems, and answer you when you ask for help.
  • When the law requires it.

We don't use your data for advertising or profiling, and we don't sell or rent it to anyone.

Where it's stored and who processes it

Your data is stored with Google Firebase (Google Cloud) in the United States (region us-central1). We use Firebase Authentication for sign-in, Cloud Firestore for your medicines and history, Cloud Storage for photos, Cloud Functions for family features and account deletion, and Firebase Cloud Messaging to deliver notifications. Google processes this data for us under its data processing terms.

  • Apple and Google handle sign-in if you choose Sign in with Apple or Continue with Google, and deliver notifications to your phone (Apple Push Notification service on iPhone).
  • Apple, Google and RevenueCat handle purchases: Apple or Google takes the payment, and RevenueCat, our payment processor, tells the app whether you have Premium. RevenueCat receives an anonymous ID for your account and your purchase details, not your medicines.

If you live outside the United States, your data is transferred there. These transfers are covered by the providers' standard contractual clauses.

How it's protected

Data is encrypted in transit (HTTPS) and at rest on Google's servers. Security rules make sure each account can reach only its own data and what family members have shared with it. MedTogether is not end-to-end encrypted: like most apps that sync, the data can be read by our server, which is what lets family alerts work when your phone is off. We don't look at your medicines or history, except when you ask us to help with a specific problem or the law requires it.

Family sharing

  • A family is one group: you and up to 5 family members, owned by the person whose Premium covers it. Nothing is shared until someone accepts an invite to your family, or you accept one. Only the owner invites; invites work once and expire after 7 days.
  • Family members see the data you share. If Share my medicines with family is on (it is unless you turn it off), everyone in your family can see your name, your medicines, which doses you've taken, and your times in your time zone. They can also send you a reminder (at most once every 15 minutes each), and get an alert when you haven't marked a dose 30 minutes after it was due, if they choose to get alerts about you.
  • If Let family make changes is on (it's off unless you turn it on), family members can also edit your medicines.
  • Only you can change your own switches. You can leave the family at any time; the owner can remove someone or end the family. Leaving stops sharing both ways, and nobody's medicines are deleted.
  • Nicknames you give family members are visible only to you.
  • Please invite only people who agree to it, and add medicines for someone else only with their permission.

How long we keep it

  • Your data is kept for as long as you have an account.
  • When you delete a medicine, its history is deleted too, on every device. You can remove a photo at any time.
  • When you delete your account, your login, profile, medicines, history, photos, devices, nicknames, invites and family membership are deleted from our database straight away. If you own a family, the family ends; nobody else's medicines are deleted. Copies in Google's systems are then removed under Google's own deletion process.
  • We remove push tokens of phones that haven't connected for 60 days, and expired invites and old missed-dose alert records after 7 days.
  • Apple, Google and RevenueCat keep purchase records as the law requires them to.
  • Emails to us are kept as long as needed to help you, then deleted.

Deleting your account

In the app, go to Settings → Profile → Delete account. If you can't use the app, see how to ask us to delete it.

Children

MedTogether isn't meant for children under 13 (or the minimum age in your country) to use on their own. A parent or guardian can keep track of a child's medicines in their own account. If you believe a child has given us data without a parent's permission, email us and we'll delete it.

Your rights

Wherever you live, you can see, correct, download and delete your data. If you're in the European Union, the United Kingdom or Thailand, the GDPR, UK GDPR or Thailand's Personal Data Protection Act (PDPA) also give you the right to:

  • access your data and get a copy in a common format;
  • correct data that's wrong;
  • have your data deleted;
  • restrict or object to how it's used;
  • withdraw your consent at any time, without affecting what was done before;
  • complain to your data protection authority, such as Thailand's Personal Data Protection Committee or your EU or UK regulator.

Most of this you can do in the app: edit or delete anything you've added, or delete your account. For anything else, email handkit.dev@gmail.com from the address you use for MedTogether. We'll answer within 30 days, and may ask you to confirm it's you.

This website

This site is hosted on Cloudflare Pages, which keeps standard server logs (such as IP addresses) for security. The site sets no cookies and loads nothing from other services.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects how your data is used in a meaningful way, we'll tell you in the app before it takes effect.

Contact

MedTogether is made by Handkit. Questions about privacy or your data: handkit.dev@gmail.com.