Privacy Policy

Who we are

HoraDose is a personal health management application published by PoulinSoft. This policy covers this marketing website (the "site") and the HoraDose mobile app (the "app"). For any privacy question, you can write to us at privacy@horadose.com.

What this website collects — the mailing list

This website has a single, optional form. In Canada, it signs you up to our mailing list to receive HoraDose news from time to time; trying the app requires no signup there: it goes straight through TestFlight (Apple) or Google Play. Outside Canada, the test is by invitation, and the same form is used to request your personal invitation; news is a separate, optional, unticked box. Apart from this form, the site asks for no personal data and does not let you create an account.

To know which version of the page to show you, the site asks our host (Vercel) for the country your connection comes from, derived from your IP address. Only the country code is returned to your browser; it is neither stored, nor logged, nor linked to your signup.

When you sign up, we collect: your email address (required), the type of phone you use — iPhone, Android or both (required), your first name (optional), and where your visit came from, as a general keyword such as "facebook" or "direct". We also keep the date of your signup and the version of the consent text you were shown, so we can demonstrate, if needed, what you agreed to and when.

This information is used to send you HoraDose news from time to time if you asked for it and, if you requested a test invitation, to send you that invitation. To register you as a tester, we then pass your email address to Apple (TestFlight) or Google (Google Play), depending on your phone; those companies process it under their own privacy policies. People who signed up before October 4, 2026 also received, on that basis, the test invitation and its instructions.

It is stored on Supabase servers located in Canada (region ca-central-1). We do not sell it, do not rent it, and never use it for advertising.

Addresses of Android testers who signed up before October 4, 2026 — disclosure outside Québec

Until October 4, 2026, Android testing required each tester's address to be entered in the Google Play Console, operated by Google in the United States. Without that entry, the invitation link did not work.

People who had signed up selecting "Android" or "both" therefore had their email address disclosed to Google, outside Québec, for that sole purpose. Since that date, in Canada, Android testing goes through a public Google Play link that you join yourself with your Google account, under Google's rules: we no longer send any address to Google. Outside Canada, the test is by invitation and the address of the person requesting it is passed to Google (or Apple) to register them as a tester, as described above.

Nothing beyond your email address was shared with Google in this context: not your first name, not where your visit came from, and no health data whatsoever.

Cookies, trackers and traffic measurement

This website sets no advertising or tracking cookies.

We use Vercel Web Analytics and Vercel Speed Insights, provided by Vercel Inc., to measure traffic and the site's technical performance. These tools work without cookies and collect: the page viewed, the referring page, the approximate country or region, the device type, and a visitor identifier turned into a non-reversible fingerprint.

This measurement exists only to know how many people visit the site and whether it works properly. It cannot identify you, and it is never cross-referenced with the mailing list.

Legal bases

Mailing list signup relies on your consent, which you give by submitting the form after reading the text shown immediately above the button. You may withdraw it at any time.

Aggregate analytics are based on our legitimate interest in keeping the site secure and working properly.

At a high level, these activities are framed by the General Data Protection Regulation (GDPR, art. 13), Québec's Law 25, and Canada's PIPEDA.

Health data in the app: it is processed on your device, under your sole control. When you turn on a feature that passes it, encrypted, through our servers — the "Ensemble" caregiver mode or the HoraDose cloud — that processing rests on your explicit consent, given in the app when you turn the feature on and withdrawable at any time by turning it off (GDPR, art. 9(2)(a); Law 25: manifest, free and informed consent, given for specific purposes).

Retention

We automatically delete mailing list signups on the following schedule: 60 days after an unsubscribe; 12 months after a signup that never led to an invitation; 24 months with no invitation and no message.

These are maximums.

When someone unsubscribes, we keep a non-reversible fingerprint of their address indefinitely — never the address itself. It is the only way to guarantee they are not contacted again by mistake.

App data kept on our servers: messages and information relayed between a caregiver and the person they support are encrypted and unreadable to us; they are deleted at the latest 3 days after receipt, or 8 days if they were never delivered, and our server sees only routing information (pseudonymous technical identifiers of the link and of the accounts, with no name or content, and sending time), never the content. The read copy the caregiver keeps on their own phone is not on our servers: it is erased as soon as their phone receives the end of remote help; otherwise (phone off, offline, or Ensemble subscription ended), it stops being readable after at most 30 days (7 days for the journal and mood) and is erased 30 days later; the tokens used to send a notice to a loved one are kept as long as the link exists; the anonymous daily signal and the usage counters are purged after at most 400 days; HoraDose cloud copies (at most 3 versions, with the app version of each device, technical information with no health data) are kept until you erase your data in the app — they stay recoverable even if your Premium subscription ends; your subscription status and your video-call minutes ledger are kept as long as your account exists. When you delete your account, the consents recorded on our servers and your subscription rights are deleted with it, and your links with a caregiver are ended; the copy your caregiver keeps on their phone is then erased as soon as their phone sees the link has ended, otherwise on the schedule above; we keep only a proof of erasure that contains no identifier.

Your rights

You can unsubscribe at any time in one click, from the link included in every message we send. The withdrawal takes effect immediately.

You also have the right to access, correct and delete your information. To exercise these rights, or for any privacy question, write to us at privacy@horadose.com. We answer at that address.

Portability: in the app, Settings › Privacy › "Export all my data" produces a complete file in a structured, machine-readable format (JSON) that you can keep or hand to another app. Because that file is not encrypted, keep it somewhere safe.

You also choose, in the app (Settings › Privacy › "Your privacy choices"), what is measured and what you have agreed to, and you can erase everything.

The HoraDose app — your health data stays on your device

All the health data you enter in the app (medications, schedules, doses, mood, journal, appointments, contacts) is stored on your device, in an encrypted database. By default it never leaves it.

If you turn on a feature that moves it — sharing with a caregiver, backup, or syncing between your devices — it is encrypted on your device BEFORE it leaves, and the key is never shared with us. Anything passing through our servers is therefore unreadable to us. Each of those features is described below.

HoraDose is not a medical device and does not replace the advice, diagnosis, or treatment of a healthcare professional.

What the app collects when you use certain features

Account: the app works without an account, and never asks you for an email address or a password. The features that connect two devices — the "Ensemble" caregiver mode, backup and sync through our servers — rely on an anonymous identity created automatically on your device. It holds nothing that identifies you: no name, no email address, no phone number.

Caregiver sharing (optional): if you choose to share information with a caregiver, it is end-to-end encrypted on your device before being sent. Our servers act only as a temporary relay: they cannot read the content, which is deleted shortly after delivery to the recipient (exact times in the Retention section).

What your loved one sees, and who decides: the person being supported chooses, through separate consents they can withdraw at any time, what their loved one receives — the state of today's doses, a notice when a dose is not confirmed on time, their location if they turn it on, and, if they allow it, the remote-help items described below, (a) to (e). They can see in the app the list of notices sent to their loved one. HoraDose verifies neither the identity nor the legal status of the people you invite: sharing is granted under the responsibility of the person who invites. Someone who manages another person's data declares, when doing so, that this person asked them to and understands it, or that they are their legal representative (mandatary, tutor or curator); we do not verify these mandates. To send a notice to a loved one, our servers keep that device's notification token and a deadline; no health content is involved.

Remote help (Ensemble) — what the person being helped can allow: without their agreement, a caregiver does not see the name or dose of the medications. The person being helped can choose, explicitly, separately and revocably at any time, to allow them: (a) to see their medication list, schedules and doses (history of the last 3 months), as well as their appointments, the contacts they choose to share, their meals, wake-up and bed times, reminders and refills; (b) to read their journal, mood, symptoms, activity and situations, read only; (c) to suggest changes to them, which they accept or decline one by one; (d) to apply some changes "without asking me" — they are notified each time and can put them back as before; (e) for a person who declares they legally represent them, to note a dose on their behalf. None of this is turned on to begin with. These choices are valid for 12 months, then must be confirmed again; without confirmation, remote help stops.

Remote help — transit, retention and responsibility: this information is encrypted end to end on the device that sends it (that of the person being helped or of the caregiver); our servers only relay sealed messages, unreadable to us, whose content is erased after receipt. The caregiver keeps on their phone a read copy of what is allowed, only while the person being helped allows it: it is erased as soon as their phone receives the end of remote help. If the end cannot reach it (phone off or offline, the caregiver's Ensemble subscription ended, the phone of the person being helped lost), the copy stops being readable after at most 30 days (7 days for the journal, mood, symptoms, activity and situations), then is erased 30 days later. Remote help also pauses when the caregiver's Ensemble subscription ends. The legal basis for this sharing is the explicit consent of the person being helped, which they can withdraw at any time in the app. Only the caregiver linked by the person being helped can see this information, and only within the scope they chose. A person who declares they legally represent the person being helped (mandatary, tutor or curator) does so under their own responsibility: HoraDose does not verify mandates.

Backup and sync (optional): you choose where your copies go, and your data is encrypted on your device before anything is sent. By default, the backup goes to your own personal cloud space (iCloud or Google Drive) when it is available; if it is not, and you have chosen nothing else, no copy is sent. If you are a Premium subscriber, you can instead choose the HoraDose cloud (hosted on our servers, several copies kept) or your own Dropbox account (see the next section). You can also export a one-off encrypted copy to a file you keep yourself. The encryption key is never given to our servers or to Dropbox; if you use iCloud or Google Drive, it may also be kept in your Apple or Google account's end-to-end encrypted keychain, so you can recover your data on a new device. Whatever the destination, the content of your copies stays unreadable to us and to the provider hosting them. Our servers are involved only if you choose the HoraDose cloud: your copies are then kept there and, to sync your devices, your data passes through them, encrypted.

Crash reports: to fix technical failures, the app sends anonymized crash reports (device model, OS and app version, technical trace). These reports never contain your health data.

Purchases and subscriptions: payments are processed by Apple or Google. We receive a transaction identifier and your subscription status to activate your features — no health data and no banking information.

Anonymous usage statistic: the app sends a daily anonymous signal (a random identifier generated on your device, not linked to your account, along with the app version, platform, and language) that lets us measure overall usage. When that signal arrives, our servers derive the COUNTRY the connection comes from, from the request's IP address: that address is neither stored nor logged, only a per-country counter is incremented, and the precision never goes below the country. It contains no health data, no activity pattern can be tied to a person, and you can turn it off in the app settings. These signals are automatically purged after at most 400 days.

Anonymous usage counters: the app also counts which screens are used and which features are turned on (initial setup steps reached, screens opened, reminders allowed, a device or a loved one connected, subscription screen shown). These counters carry NO identifier — neither the random number above nor any other — and keep no time more precise than the calendar day: nothing lets us, or anyone, tie a use to a person or reconstruct an individual's path. They are governed by the same setting as the daily signal, in the app settings, and purged after at most 400 days.

Backup to Dropbox (Premium, optional)

This destination is reserved for Premium subscribers and is never turned on without you: you choose it in the app by signing in to your own Dropbox account.

What is sent: one file per copy, encrypted on your device before it leaves. Its name contains neither your name nor your device's name, only "HoraDose", a technical code that reveals nothing about you, and the date and time of the copy. The file carries a short unencrypted technical header (version, date, size, integrity fingerprint) that contains no health data. Neither HoraDose nor Dropbox can read its content: Dropbox only sees that the file exists, its name, its size and its date.

Limited access: HoraDose can only reach the folder reserved for it in your Dropbox, "Apps › HoraDose". The permissions requested are limited to listing, reading and writing the files in that folder (files.metadata.read, files.content.read, files.content.write). HoraDose has no access to your other files and does not look at your account information (name, email address). Dropbox's authorization page may mention basic access it grants to every app by default; HoraDose does not use it.

Sign-in tokens: you sign in on Dropbox's own page, in your phone's secure browser; HoraDose never sees your password. The resulting sign-in tokens are kept only on this device, in its secure storage (iOS Keychain, Android Keystore). Our servers never receive them: the app talks directly to Dropbox.

Removing access: to stop using Dropbox, choose another destination in the app. HoraDose then erases this device's tokens and asks Dropbox to revoke its access. You can also remove access at any time in Dropbox, under Settings › Connected apps. Copies already stored stay in your Dropbox until you delete them (see our Data Deletion page).

Storage of your copies at Dropbox is governed by your terms of use and by Dropbox's privacy policy. Its servers may be located outside Québec and Canada, including in the United States. We never receive your copies or your sign-in tokens.

Deleting your app data

You can erase all your data directly in the app (since your data lives on your device, deletion is immediate and permanent), or delete your account if you have one. For any request, see our Data Deletion page or write to us at privacy@horadose.com.

Our processors and recipients

Here is every company that may receive information through the site or the app, and why. Supabase (Canada): hosting of our servers — anonymous identities, the encrypted relay of the caregiver mode, the encrypted copies of the HoraDose cloud, consents, subscription status. Sentry (United States): anonymized crash reports. RevenueCat (United States): subscription status, under a pseudonymous identifier. Apple and Google: purchases, notifications and app updates and, outside Canada, the registration of testers who request an invitation (email address). Expo (United States): delivery of notifications and app updates. LiveKit: end-to-end encrypted video calls between a caregiver and the person they support. Health Canada and the U.S. FDA (openFDA): when you scan or type a drug number, that number is checked against their public registry — nothing else is sent. Google Maps: on Android, the map showing a loved one's location is drawn by Google Maps; the location being viewed passes through Google to be displayed. Dropbox: only if you choose that destination, in your own account. Cloudflare (Turnstile): on this site, the anti-bot protection of the forms. Vercel: hosting of the site, traffic measurement and the approximate country of the connection (code only, not stored).

None of these providers receives your health data in readable form. We never sell or rent any information, and none of it is used for advertising.

Transfers outside Québec and the European Union

Our servers are hosted in Canada. Some providers named above — Sentry, RevenueCat, Expo, Apple, Google, Dropbox, LiveKit, Vercel, Cloudflare — process information outside Québec and Canada, notably in the United States. These transfers are limited to the named providers and to the stated purpose; no readable health data travels through them.

For people in the European Union and the United Kingdom, these transfers rely on the standard contractual clauses adopted by the European Commission and by the UK authority. Canada also benefits from an adequacy decision of the European Union and of the United Kingdom for the information we host there.

Person in charge of the protection of personal information

Under Québec's Law 25, the person in charge of the protection of personal information is the person exercising the highest authority within PoulinSoft. You can reach them at privacy@horadose.com.

Confidentiality incidents

We keep a register of confidentiality incidents. If an incident presents a risk of serious injury to you, we notify the Commission d'accès à l'information du Québec and the people concerned, as Law 25 requires; in the European Union, the competent supervisory authority within 72 hours (GDPR, art. 33); in the United States, the people concerned in accordance with the federal rules that apply to health apps.

Minimum age

HoraDose is for people aged 18 and over, and each person declares it before starting. We do not knowingly collect any information about a minor. If you enter information about a minor in the app, you declare that you are their parent or guardian. If you learn that a minor has used the app without that consent, write to us at privacy@horadose.com: we will delete the information concerned from our servers.

Death

Health data lives on the person's device; upon death it stays under the control of those who hold the device, like any personal belonging. A caregiver can end the "Ensemble" link from their own device; an heir or estate representative can request the deletion of the server account and of the HoraDose cloud copies by writing to us at privacy@horadose.com, with proof of their capacity.

California residents

Categories of information we process: anonymous identifiers created on the device, encrypted health data we cannot read, commercial information (subscription status), technical data (anonymized crash reports, usage counters without any identifier). We do not sell or share your personal information within the meaning of California law, and we do not use or disclose sensitive information for purposes other than those described here.

You have the right to know, to delete, to correct, and not to be treated differently for exercising your rights. You can exercise them in the app (Settings › Privacy) or by writing to us at privacy@horadose.com.

Washington State residents

Our separate Consumer Health Data Privacy Policy, required by Washington's My Health My Data Act, is published on the "Health data" page of this site, reachable from the footer.