1. Who we are
Health Agenda is run by Gromik Software S.R.L., registered in the Republic of Moldova (“we”, “us”, “our”), which is the controller of the personal data described here. We follow Moldova’s Law No. 133/2011 on personal data protection and, for users in the EU and UK, the GDPR and UK GDPR.
Health Agenda stores health information, which is a special category of personal data. We collect it only to provide the features you use, and we never sell it or use it for advertising.
2. Information we collect
Account information — your name and email address, whether you register directly or sign in with Google (in which case Google shares your name, email, and profile picture with us). Passwords are stored only as a hash.
Health data you enter — family member profiles (people and pets), allergies, medicines and dosing schedules, illness episodes and symptom logs, treatments, appointments, and any documents or photos you upload (e.g. prescriptions, medical reports, medicine photos). This is the core purpose of the app, and it is only ever visible to your account unless you explicitly create a share link.
Conversations with the Ask Health Agenda assistant — messages you send and the AI’s replies, stored so you can revisit past conversations. We also count how often you use AI features to apply plan limits and track our costs.
Sharing — share links you create, what they include, the recipient email if you add one, and when a link is opened, so we can tell you it was viewed.
Subscriptions — your plan and its status, renewal dates, and the subscription and transaction IDs we receive from Paddle (web), Apple (iPhone app) or Google Play (Android app). We never see your card details.
Usage and device information — basic technical data such as IP address, browser or app version, and timezone, used only to keep the service secure and functioning correctly (e.g. scheduling reminders in your local time).
We do not use advertising identifiers, third-party ad networks, or cross-app tracking.
3. How we use your information
We use your data to: operate the core features of the app (medicine cabinet, illness tracking, reminders, appointments); send account-related emails (email verification, password reset, dose and appointment reminders, trial and billing notices); power the document-analysis and Ask Health Agenda AI features, when you choose to use them; create the share links and PDFs you request; manage your subscription; and keep the service secure, debug issues, and improve the product.
4. Legal basis
We process account, subscription, and usage data to perform our contract with you. We process health data on the basis of your explicit consent, which you give when you add it and can withdraw at any time by deleting the records or your account. We process technical data on the basis of our legitimate interest in keeping the service secure and working.
5. Who we share data with
We use a small number of service providers to run Health Agenda, each bound to only process your data on our behalf:
- Anthropic (Claude, USA) — processes prescription/report documents and Ask Health Agenda conversations you initiate, in order to generate the extracted data or reply. Under our commercial agreement, this content is not used to train their models.
- DigitalOcean — hosts our servers, database, and uploaded files.
- Resend — delivers transactional emails (verification codes, password resets, reminders).
- Google — provides the optional “Sign in with Google” authentication method.
- Paddle — our reseller and Merchant of Record for web subscriptions; processes your payment and billing details under its own privacy policy.
- Apple — handles subscriptions bought in the iPhone app.
- Google Play — handles subscriptions bought in the Android app.
Beyond these providers, your data is shared with other people only when you choose to — for example, by creating a share link for an illness record, which you can restrict to a specific recipient email and revoke or let expire at any time. We may disclose data if required by law or a valid court order, and will tell you unless legally prohibited.
6. International transfers
Some providers, including Anthropic, Google, Apple, and Paddle, process data outside Moldova and the EU. Where required, these transfers rely on Standard Contractual Clauses or equivalent safeguards.
7. Data retention
We keep your data for as long as your account is active. Share links expire automatically after the period you choose when creating them. If you delete your account, all of your data — family members, medicines, illnesses, documents, and chat history — is permanently deleted from our systems, and share links stop working at once. We keep only anonymous AI usage totals that can no longer be linked to you. Paddle, Apple and Google keep their own billing records where tax law requires.
8. Your rights and controls
- Access & export — download a complete copy of your household’s data at any time from Settings → Sharing & privacy → Export data.
- Correction — edit or delete any family member, medicine, illness, or other record directly in the app.
- Deletion — permanently delete your account and all associated data from Settings → Account.
- Sharing control — every share link is opt-in, can be restricted to one recipient, and can be revoked at any time.
You can also ask us to access, correct, export, restrict, or delete your data, object to processing, or withdraw consent by emailing [email protected] from your account address. We’ll respond within 30 days. You have the right to complain to the National Center for Personal Data Protection of the Republic of Moldova, or to your local data protection authority in the EU or UK.
9. Security
Data in transit is encrypted (HTTPS). Passwords are hashed and never stored in plain text. Uploaded documents and photos are never public: they’re served only through signed links that expire. Access to the app is protected by token-based authentication, and changing your password immediately revokes access from your other sessions. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard practices.
10. Family members, including minors and pets
Health Agenda lets an account holder (an adult, 18 or older) manage health records on behalf of family members, including children and pets. These profiles are not separate user accounts — they are managed entirely by, and are the responsibility of, the adult who owns the account. We do not knowingly allow children to create accounts, and will delete any we find.
11. Changes to this policy
If we make material changes to this policy, we’ll update the “last updated” date above and notify you by email or in-app notification before they take effect.
12. Contact us
Gromik Software S.R.L., Republic of Moldova. Questions about this policy or your data? Email [email protected].