Privacy Policy — KitsuMedi

As of: 2026-07-05 · Version 0.9.0

1. Who is responsible?

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Tobias Bauer (binshaper) Martinusstr. 41 52525 Heinsberg Germany

Email (privacy & general inquiries): [email protected]

Email (bug reports): [email protected]

We have not appointed a data protection officer because the legal requirements for doing so do not currently apply to us.

2. Scope of this notice

This notice applies to:

the KitsuMedi app (Android, package ID app.kitsumedi.android) — it is content-identical to the text you find inside the app under “Settings → Privacy”,
the minimal product page binshaper.com/apps/kitsumedi (marketing landing page linking to this notice and the Play Store listing).

For the app itself, only the text embedded in the app is legally authoritative; this hosted version is provided for the Play Store and the website and is updated in lockstep with the in-app version whenever a content-relevant change occurs.

3. Principle: Offline-first

KitsuMedi is an offline-first app. All health-related data — medications, intake history, vital signs, emergency info, and cycle entries — are by default stored and processed only on your device. Without your explicit activation, this data does not leave your device. Only the optional features described in sections 5 to 8 of this notice can transmit data to a server at all — and they are all off by default.

4. What data do we process locally on your device?

KitsuMedi processes the following data locally on your device:

Medication plan — active ingredient, brand, strength, dosage form, schedule, treatment periods, stock, optional photo and notes.
Intake logs — scheduled and actual intake times, status (“taken”, “snoozed”, “missed”, “skipped”), optional note, optional “administered by” tag.
Vital signs — blood pressure, pulse, weight, blood glucose, body temperature, oxygen saturation.
Emergency info — allergies, chronic conditions, advance directive, emergency contacts, blood group — entirely up to you what you enter.
Cycle data — optional, separately enabled per person, off by default.
Person profiles in multi-person mode — name, photo, color, date of birth, relationship type (e.g. “self”, “child”, “parent”, “partner”).
App settings — reminder modes, comfort mode, language, vacation mode, sound behavior.
Backups as encrypted files (‘.kitsumedi’) that you export yourself and store wherever you choose — we have no access to them.

The local database is encrypted with AES-256 (SQLCipher). The database key lives in the Android Keystore and does not leave the device. Backup files are encrypted with AES-256-GCM using a password you choose; only you know this password.

Legal basis: Art. 6 (1) (b) GDPR (performance of the user contract) and, for special categories of personal data (health data and possibly data concerning sex life for cycle tracking), your explicit consent under Art. 6 (1) (a) in conjunction with Art. 9 (2) (a) GDPR. You give this consent by actively entering the respective data into the app; you can withdraw it at any time by deleting the data.

5. Optional feature: Family & Care Sync (Caregiver Sync)

KitsuMedi offers an optional cloud feature called Family & Care Sync that lets you synchronize selected data with a second device (for example the phone of a caregiving relative) in encrypted form. This feature is off by default. It only becomes active when you pair a device through the wizard at “Settings → Family & Care” and confirm a mandatory consent checkbox.

5.1 Purpose

The purpose is to let caregiving relatives view the medication plan and adherence history of the person they care for on their own phone — and, depending on the assigned role, to confirm intake. The feature is solely about care transparency, not advertising, profiling, analytics, or resale.

5.2 Which data is transmitted?

Per paired pair (owner device ↔ caregiver device), the following data is transmitted in encrypted form:

Always: medication master data (name, dose, schedule) and intake logs of the last 30 days.
Only with separate opt-in: vital signs of the last 30 days, cycle entries, emergency info. Each of these three data classes must be enabled individually per pair and confirmed via a confirmation sheet; the default is off.
Never: backup files, notes and intake entries marked as “private”, data of persons other than the one explicitly shared in that specific pair, photos and attachments.

In multi-person mode, each person has their own pair with its own pseudonymous pair ID. Someone caring for several people (e.g. a daughter looking after both parents) therefore pairs multiple independent pairs — each with separate consent per person.

5.3 End-to-end encryption

All transmitted content is end-to-end encrypted:

Symmetric encryption with AES-256-GCM (96-bit random nonce, additional authenticated data bound to pair ID, direction, version, and app namespace).
Key derivation with HKDF-SHA-256 into separate sub-keys for encryption and authentication.
Per-request authentication with HMAC-SHA-256 in constant time — the server never knows the secret key.
The shared key (‘sharedKey’) is exchanged between the two devices during initial pairing (QR code or short-lived pairing code) and afterwards lives exclusively in the Android Keystore of both devices via expo-secure-store. It is never transmitted to the server.
The server cannot decrypt the content and only ever sees ciphertext, IP address, timestamp, HTTP status, and a monotonically increasing per-pair version counter.

The encrypted packets are exchanged through a Cloudflare Worker at worker.binshaper.com. The processor is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, together with Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany.

What Cloudflare sees: pseudonymous pair ID (UUID v4), HMAC auth header, encrypted snapshots, IP addresses, timestamps, HTTP status. Cloudflare has no access to plaintext because the key is never shared with Cloudflare.
Processing location: Cloudflare operates a global edge network. Cloudflare Workers KV stores data in regional data centers and caches it across the network; a hard EU-only restriction is not technically enforceable in the tier we use. It is therefore possible that encrypted packets and request metadata (in particular IP addresses) are processed or cached in data centers outside the EU.
Basis for third-country transfers: Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF); the transfer to the US relies primarily on the EU Commission’s adequacy decision (Art. 45 GDPR) together with the DPF. In addition, the Cloudflare Data Processing Addendum provides the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) for transfers to other third countries.
Data processing agreement: The Cloudflare Customer DPA (currently referenced version v6.4) is automatically part of the Cloudflare Self-Serve Subscription Agreement once Cloudflare services are used — no separate signature is required for self-serve customers. The EU Standard Contractual Clauses are included in the DPA.
Cloudflare’s sub-processors: an up-to-date list is available on the Cloudflare Sub-processors page. We check this list periodically for relevant changes.
Cloudflare logs: on the worker side, only HTTP status, pair ID, and an activity timestamp (‘lastSeen’) are logged — no ciphertext bytes, no payload content, no personal identifiers beyond the pseudonymous pair ID.

5.5 Pseudonymization

The pair ID is a random UUID v4 without any link to your identity. No link to your name, email, or any other identifier exists on the server side. The personal reference only arises once the two paired devices decrypt the pair ID and map it onto their locally stored person records.

5.6 Retention in the cloud

Encrypted snapshots (inbox entries): 30-day sliding window; every new upload extends the TTL.
Pair metadata (pair ID, last activity timestamp, HMAC verification material): until revoke or until prolonged inactivity.
Pairing codes: at most 15 minutes.
Cloudflare edge logs: about 7 days per the Cloudflare standard.

5.7 Withdrawal and deletion

You can end Family & Care Sync at any time (“Revoke pair” at “Settings → Family & Care”). A revoke deletes the pair and all related inbox entries on the Cloudflare Worker, removes all mirrored data on the caregiver device, and removes the key material from the keychain on both devices.

Legal basis: Art. 6 (1) (a) in conjunction with Art. 9 (2) (a) GDPR (explicit consent to the processing of health data). You can withdraw this consent at any time with effect for the future; processing that already happened remains lawful.

6. No cloud backup, no analytics, no advertising tracking

KitsuMedi offers no cloud backup. Backups remain local as an encrypted file and are never automatically transmitted to a server. KitsuMedi uses no analytics, advertising, or tracking components — no behavioral SDKs, no advertising IDs, no profiling.

7. Crash diagnostics via Google Play (Android Vitals)

If you install KitsuMedi through the Google Play Store, Google may collect technical crash and ANR reports (Android Vitals / Play Console) as part of app distribution — without you having to enable a separate switch inside the app. These reports typically contain app version, device type, and technical error information, not medication names or other health data from your local store. KitsuMedi uses no separate crash SDK (no Sentry, no Firebase Crashlytics) — Android Vitals is the only automated diagnostics source.

The processor, or in part independent controller, is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and, where applicable, Google LLC for US processing. Legal basis: Art. 6 (1) (b) GDPR (use of the Play Store distribution channel). Details are in Google’s privacy policy and in the Play Store listing under “Data safety”.

You can additionally, and voluntarily, contact us via “Report a problem” (More → About) or by email at [email protected].

8. Subscription (from planned version 0.9.0)

Status: planned, not yet in production as of this document. KitsuMedi will introduce an optional subscription model with version 0.9.0. This section describes the planned processing so the privacy policy is complete without delay once the feature ships. Until then, KitsuMedi performs no payment processing.

Planned model:

A 30-day trial with full owner access (own medications, reminders, multi-person, backup, PDF export, emergency info).
Afterwards: continuation requires an active subscription (monthly or yearly), or an automatic fallback to the free caregiver-only mode (viewing/confirming someone else’s medications without managing your own — free forever).
Handled via Google Play Billing. KitsuMedi does not process credit card or other payment data itself — this remains entirely with Google.
RevenueCat, Inc. (San Francisco, USA) will be used as a processor for entitlement management (matching purchase events, trial status, entitlement flag). Data categories processed: pseudonymous app user ID, purchase events, product IDs, platform, device type.
Legal basis: Art. 6 (1) (b) GDPR (performance of the subscription contract).
Third-country transfer: to the US (Google, RevenueCat) based on the respective providers’ standard compliance frameworks (standard contractual clauses or certifications); details will be finalized and added here before the feature goes live.

Once this feature is live, we will update this section with final contractual details (RevenueCat DPA link) and remove the “planned” notice.

9. When you contact us

If you use the feedback button in the app or write to us directly by email ([email protected] for privacy and general inquiries, [email protected] for bug reports), we process the data contained in the email to answer your inquiry. Legal basis: Art. 6 (1) (b) GDPR (in the context of app use) or Art. 6 (1) (f) GDPR (legitimate interest in providing a response and support). Retention: until the inquiry is closed, at most 24 months; statutory retention obligations remain unaffected.

10. Website binshaper.com/apps/kitsumedi

The product page only processes technically necessary server log data from the hosting provider (IP address, user agent, timestamp, requested page) to provide and secure the page. No analytics or tracking cookies beyond technically necessary functions are used. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the secure operation of the website).

11. Your rights

Under the GDPR you have in particular the following rights:

Access (Art. 15) — all your data is fully visible inside the app. Via “Settings → Export backup” you get a machine-readable copy.
Rectification (Art. 16) — you can edit any entry directly in the app.
Erasure (Art. 17) — “Settings → Delete all data” removes the entire local data set; “Family & Care → End pair” deletes all cloud content of the pair in question; uninstalling the app removes all local data including key material.
Restriction of processing (Art. 18) — you can disable individual data classes per pair (vitals, cycle, emergency info) and run the app entirely offline.
Data portability (Art. 20) — the backup export delivers your data as a structured file in a format you can decrypt yourself.
Objection (Art. 21) — you can object to processing for the future at any time by disabling the respective feature or uninstalling the app.
Withdrawal of given consents (Art. 7 (3)) — possible at any time for the future; the lawfulness of processing up to the point of withdrawal remains unaffected.
Complaint to a supervisory authority (Art. 77) — see section 15.

To exercise these rights you usually do not need to contact us, because all paths are implemented directly inside the app. If you still need help, write to [email protected].

12. Retention overview

Data category	Retention
Local data (medications, vitals, emergency info, cycle, persons)	until you delete it yourself or uninstall the app
Cloud inboxes (Family & Care Sync, encrypted)	about 30 days sliding window, immediate deletion on pair revoke
Cloud pair metadata	until revoke or until prolonged inactivity; pairing codes at most 15 minutes
Crash reports (Google Play Vitals)	per Google standard and Play Console policies; no health data from the app
Email correspondence	until the inquiry is closed, at most 24 months
Cloudflare edge logs (status codes, IP, no payload)	per Cloudflare standard about 7 days
Subscription / purchase history (planned from version 0.9.0)	per Google Play / RevenueCat retention; details to follow before go-live

13. Security measures

We use measures that reflect the state of the art:

AES-256 encryption of the local database (SQLCipher), with the key in the hardware-backed Android Keystore.
AES-256-GCM for backup files and for every Family & Care Sync snapshot, with a 96-bit random nonce and additional authentication bound to pair, direction, version, and app namespace.
HKDF-SHA-256 to derive separate sub-keys for encryption and authentication.
HMAC-SHA-256 in constant time for server authentication — the server does not know the secret key.
TLS 1.2 or higher for all HTTPS connections.
Optional app lock with fingerprint or device PIN.
Pseudonymization of pair IDs, data minimization in server logs, rate limits per pair and per IP bucket.
Privacy by default: vitals, cycle, and emergency info are off in Family & Care Sync by default; each sensitive data class needs its own opt-in plus a confirmation sheet.

14. Changes to this notice

We update this notice whenever the app changes in a privacy-relevant way (new data categories, new processors, new cloud features — in particular once the subscription described in section 8 goes live). We announce substantial changes in the in-app changelog with the respective app version. The current version is always available at “Settings → Privacy” in the app as well as at this hosted URL.

15. Supervisory authority

If you believe we are not processing your data in line with the GDPR, you can lodge a complaint with a supervisory authority. The competent authority for us as a provider based in North Rhine-Westphalia is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) Kavalleriestraße 2-4 40213 Düsseldorf Germany

You can also lodge a complaint with the supervisory authority at your place of residence or work — an overview of the German state data protection authorities is available at bfdi.bund.de.

16. Contact for privacy inquiries

You can address privacy inquiries to [email protected] at any time. We usually respond within a week, and in any case within the statutory deadline of one month (Art. 12 (3) GDPR).