Privacy notice

1. Controller

The controller (responsable) of the personal data described in this notice is Cedric Alejandro Borreguín Ortega, an individual with Mexican taxpayer ID (RFC) BOOC970103QM4, domiciled at Calle 11 núm. 143, Col. Puesta del Sol, C.P. 97203, Mérida, Yucatán, Mexico (“Dozzitt”, “we”).

For anything related to your personal data, write to privacidad@dozzitt.com. The controller's details are also on the Who is behind it page.

2. Data the app stores

To work, the app keeps the following in a database on your phone:

• Profiles: the name and icon of each person or pet whose medicines you track.
• Medicines: name, dose, strength, form, icon, notes, schedule, start and end dates, and reminder type.
• Intake records: which doses you marked as taken or skipped, and when.
• Preferences: language, theme, time format, first day of the week and the backup folder.

This information can reveal things about your health or someone else's, so the law treats it as sensitive personal data. That is exactly why it never leaves your device: the app has no account and no server, the Android version does not request the internet permission, and no version connects to the internet. We have no access to this information, cannot view, correct or delete it, and never process it.

You control it entirely from the app: you can change it, delete medicines or profiles, or delete all of it by uninstalling the app.

3. Data we do receive

We only receive personal data when you choose to give it to us:

• If you write to us (support, privacy or any other address): your email address, your name if you include it, and whatever you tell us in the message.
• If you join the beta: Apple (TestFlight) and Google (Google Play and Google Groups) show us the email address or name you joined with, and any feedback, screenshots and crash reports you choose to send through those platforms.
• If you write to us to hear about the launch or Plus: your email address and the message you send, which we keep as a record of your authorization.

We don't ask for, and ask you not to send us, information about your health or medicines. If you include it in a message, we will use it only to answer you and delete it when your case is closed.

4. Purposes

Necessary purposes (without them we can't do what you ask):

• Answering your messages and support requests.
• Giving you access to the beta, running it, and handling the feedback and bugs you report.
• Handling requests to exercise your rights.

Non-necessary purposes (you can refuse without affecting the above):

• Emailing you about the app's launch or Dozzitt Plus, only if you asked us to.

To stop receiving these emails, reply to any of them or write to privacidad@dozzitt.com. We don't use your data for advertising, profiling or automated decisions, and we don't sell it.

We keep emails for as long as we need them to help you and at most one year after our last exchange, unless the law requires us to keep them longer. Beta data is deleted when the beta ends.

5. Phone permissions

The app only asks for the permissions it needs to remind you of your doses. None of them is used to send information off the phone.

6. Backups

Backups are optional and you turn them on. The app saves a copy of your data to a folder you choose, or creates a file you decide who to send to. You can protect backups with a passphrase; they are then encrypted with AES-256-GCM using a key derived from your passphrase, on your phone.

If you pick a folder synced with a cloud service (such as iCloud Drive or Google Drive), the file reaches that service by your choice and under that provider's terms. We never receive the file.

7. Processors and transfers

We don't transfer your personal data to third parties or share it with anyone for their own purposes.

To operate, we use the following processors, which handle data only on our behalf and under our instructions:

• Google LLC (Firebase), which hosts this website, and processes your IP address and technical browser data to deliver the pages.
• Cloudflare, Inc. (Email Routing), which receives the emails sent to our dozzitt.com addresses and forwards them to our mailbox.
• Google LLC (Gmail), where the emails you write to us are stored.

These providers may process data outside Mexico or Colombia, with equivalent safeguards. When you download the app or join the beta, Apple and Google process your data as independent controllers under their own privacy notices.

8. Security

The best security measure is not having your data: the app sends it nowhere. On the phone it depends on the device's own security, so we recommend using a screen lock. The key for protected backups is kept in the iOS Keychain or the Android Keystore. The emails you send us are stored in accounts protected with two-step verification.

9. ARCO rights (Mexico)

Under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, you can access the data we hold about you, rectify it, cancel it or object to its processing. You can also revoke your consent or limit the use of your data.

To do so, write to privacidad@dozzitt.com and include:

• your name and a way to reply to you;
• a document proving your identity or, where applicable, your representative's;
• a clear description of the data and the right you want to exercise;
• anything else that helps us locate your data.

We will answer within 20 business days at most and, if your request is granted, carry it out within the following 15 business days. It's free.

Remember that we have no access to the data you keep in the app; you manage that directly from the app.

If you believe your right to data protection has been violated, you can go to the Secretaría Anticorrupción y Buen Gobierno, the competent authority.

10. Habeas data (Colombia)

If you live in Colombia, this notice is also our information processing policy under Law 1581 of 2012 and its regulations. By writing to us, joining the beta or asking us to notify you, you give us your prior, express and informed authorization to process your data for the purposes in section 4. Answering questions about sensitive data is optional.

As the data subject you have the right to:

• know, update and rectify your data;
• request proof of the authorization you gave us;
• be told how we use your data;
• revoke the authorization and ask for your data to be deleted;
• access your data free of charge;
• file complaints with the Superintendencia de Industria y Comercio, after first raising your query or claim with us.

To exercise them, write to privacidad@dozzitt.com. We will answer queries within 10 business days and claims within 15 business days at most, extendable in the cases and terms set by law, in which case we will let you know.

11. Children

Dozzitt is not directed at children under 13 and we don't knowingly receive data from children. An adult may use a profile to track the medicines of a child in their care; that information, like everything in the app, stays on their phone.

12. This website

This site uses no cookies, analytics, pixels or tracking tools. It only stores the language you chose in your browser, to show it to you next time; that value never leaves your browser. Like any web server, our hosting provider logs the technical requests needed to deliver the pages and protect them against abuse.

13. Dozzitt Plus

Dozzitt Plus, an optional subscription with online backup, sync and shared care, does not exist yet. Nothing in this notice applies to it. Before launching it we will update this notice to explain what data it will process and how, and ask for your consent where the law requires it. Its design calls for end-to-end encryption, so that not even we can read your data.

14. Changes to this notice

If we change this notice, we will publish the new version on this page with its effective date and record what changed in the change history. If the change is significant, we will also announce it in the app's release notes.