MedCabin Privacy Policy

1. Scope, operator, and key definitions

This policy applies to the MedCabin mobile app and its product website provided by Fly Design. Fly Design is the product studio name; the publisher is identified in the developer information of the store from which you download the app. “Records” means the medicine, family, visit, and health information and attachments you create. “Processing” includes entering, reading, storing, recognizing, changing, deleting, encrypting, and transferring information at your request.

Our privacy contact is flydesign.app@gmail.com. This policy distinguishes local processing in the app, transfers between devices that you authorize, and services independently provided by operating systems or app stores.

2. Categories of information we process

To provide cabinet and visit organization, the app may process:

• Household member information: names, relationships, age groups, audience labels, and notes you enter. An age group is not a precise age profile.
• Medicine records: medicine and brand names, generic names, strength, form, ingredients, indications excerpts, directions excerpts, approval numbers, license holder or manufacturer, batch number, manufacturing date, expiry date, storage place, quantity, prescription or audience labels, allergy and other notes.
• Images and edits: medicine packages, instructions, and visit-material photos you take or choose, including cropped, rotated, annotated, or compressed copies.
• Codes and links: product barcodes, medicine traceability codes, QR codes, package URLs, and lookup links created by the app.
• Visit records: visit time, symptoms or chief complaint, examination materials, results, clinician or facility details, prescriptions, and health notes you enter.
• Calendar and reminder events: calendar permission state, calendar or account names exposed by the operating system, event IDs created or linked by the app, event titles, start and end times, time zone, notes, location when entered or needed by the feature, and creation, update, deletion, and sync status. We do not read unrelated calendar events for these reminders.
• Voice input: voice and transcript data captured only after you press voice input and grant microphone access.
• Purchase and entitlement data: product IDs, purchase status, transaction dates, and subscription or one-time entitlement results returned by the store. The store handles card numbers, bank details, and full payment credentials.
• Technical information: operating system, app version, permission state, network results, and the minimum logs needed to diagnose errors, which stay on your device unless you choose to send them to us. The Google ML Kit text-recognition component also sends Google limited diagnostic and usage data, described in section 6. The current version does not collect precise location, contacts, messages, or cross-app advertising IDs for advertising.

3. Sources and collection methods

Information comes from content you enter or edit, camera and photo actions, scanning, system speech input, visit records, barcode and date parsing, on-device OCR, backups you import or records transferred from another device, and product or entitlement results returned by app stores. The app provides on-device image recognition, which runs on the device.

The app does not take photos, record audio, or read your photo library in the background, and installation does not create an account. App lock, password backoff, and biometrics protect the local entry point; they do not send your password or biometric data to us.

4. Permissions and purposes

The app requests camera, microphone, speech recognition (iOS), notifications, biometrics, local network, and calendar permissions only when a feature needs them. On Android 13 and later, turning on the temporary transfer hotspot requires the Nearby Wi-Fi devices permission, which the app declares is not used to derive location; joining the hotspot in a QR code asks for your confirmation. On Android, the app also re-registers the local reminder notifications you have set after the device restarts; this system permission does not show a separate prompt. On Android, image selection uses the system Photo Picker, with a system document picker fallback where unavailable. The app accesses only the photos you select and does not request permission to read your entire photo or video library. On other platforms, photo access is governed by the system picker and permission settings. Calendar access requires your express permission; the app reads only what is necessary and may add, update, or delete medicine-expiry and medical-visit reminders in the calendar you choose. Future synchronization stops when you revoke access.

The microphone is used only for system speech input that you start. Purposes include on-device cabinet records, stock and visit timelines, PDF export, on-device OCR, system speech and barcode features, import/export, device transfer, watch summaries, calendar reminders, app security, store purchases, and diagnostics. We do not use health records for advertising, profiling, or sale.

5. On-device processing and data flows

Medicine records, household information, visit records, photo edits, barcode parsing, on-device OCR, PDF generation, app lock, password hashes, and local encryption run on your device. Fly Design does not operate an account system, cloud synchronization, upload pipeline, or cloud storage for your medicine, health, household, photo, or visit records. We do not send, receive, or host those records in Fly Design or third-party cloud storage.

Information may be handled by a recipient or system service only when you actively export, share, print, transfer to another device, turn on the watch summary, open an external website, complete a store transaction, or authorize system calendar or system speech capabilities. That handling is not an upload or cloud hosting of your records by Fly Design.

6. On-device OCR, system speech, and accuracy

Image recognition: the app provides on-device OCR only. Local components such as PaddleOCR, ONNX Runtime, Google ML Kit, or Apple Vision analyze images. Medicine and visit images are not sent to Fly Design or recognition-provider servers for recognition. The first time you use photo recognition, the app downloads PaddleOCR model files from public storage operated by Baidu, the PaddlePaddle maintainer. That server may be located outside your country or region and receives your IP address and standard request information, but no photo, text, or record. The operating system may also download its own recognition resources.

ML Kit diagnostics: Google ML Kit, used for text recognition, photo orientation, and barcode scanning on Android, sends Google device information (such as manufacturer, model, and OS version), the app package name and version, per-installation identifiers that are not intended to identify you or your device, performance metrics, API configuration, event types, and error codes, for diagnostics and usage analytics. According to Google, this data is encrypted in transit and is not shared with third parties. It does not include your photos, recognized text, or records, and Google processes it under its own policies.

Android: the app calls the device-selected recognition service through the system SpeechRecognizer interface. Google, a device manufacturer, or a provider configured by the user may supply that service. Network use depends on the service, language, and settings.

iOS: the app calls Apple system speech recognition. Device, language, and system capabilities determine whether recognition can run locally; the system service may also process audio on Apple servers.

Device compatibility: System speech availability and processing depend on the operating system, selected service, language, and device settings. You can use keyboard input if a compatible speech interface is unavailable. Voice input you invoke through a keyboard is managed by its provider.

The app starts speech input only when you initiate it and grant permission, and uses the returned text in the current entry. We do not maintain a cloud recording library or integrate a separate cloud speech service. System services may process audio, so we cannot guarantee that system speech always works offline. You can stop recognition, revoke permission, or type manually. You must verify OCR and transcription results; they are not medical conclusions.

7. External lookups, backups, sharing, device transfer, watch summaries, and calendar sync

After scanning a product barcode, traceability code, or package link, you may open a medicines regulator, product-code service, or third-party website identified on the package. Available lookup services depend on the code, package link, and region. After you confirm, the app first checks the link's redirects and file type with a lightweight request, then opens the page in an in-app web view. These requests go directly to that site, which may receive IP, device, and request parameters. We do not control its content or privacy rules.

When you export a backup, PDF, or visit material, the app invokes system files and sharing. The email, drive, messenger, printer, or other target you choose receives the file you confirm. After the file leaves the device, we cannot control copying, forwarding, screenshots, cloud backups, or retention. Recommending MedCabin to a friend sends only a promotional message, poster, and website link through the app you choose; it never includes medicine names, photos, health records, or pairing secrets.

When you enable the reminders and calendar features and grant permission, the app creates or links medicine-expiry and medical-visit reminders only in the calendar you choose and keeps the necessary event ID to update or delete them. It should act only on events it created or that you expressly linked, and will not bulk-delete unrelated personal events. Revoking calendar access stops future sync, but events already written to the system calendar may not be removed automatically; you can delete them in the app if supported or in the system calendar.

The calendar provider may sync events to your Apple, Google, or other calendar account and devices. Its processing, backups, international transfers, and retention are governed by that provider's policy. Device-to-device transfer starts only after you explicitly begin it and pair the two phones in person by scanning a QR code. The data you select is encrypted and sent directly between the two phones: over the same Wi-Fi network when both are on it; otherwise an Android phone starting the transfer can turn on a temporary hotspot that does not share internet, with its name and password included in that session's QR code, and the scanning phone joins it after system confirmation and leaves when the sync ends. Two iPhones can also connect directly through Apple's MultipeerConnectivity, using Bluetooth and peer-to-peer Wi-Fi. Device names and local network addresses are used only for that connection. The transfer does not pass through a Fly Design server, and the app does not upload the records to a Fly Design server afterwards.

Watch summary: the watch companion is off by default and starts only after you choose members and agree in settings. When it is on, the phone builds a summary from the selected members (and any unassigned medicines you allow) covering medicines that have expired or expire within 30 days and follow-up visits in the next 30 days, with up to three detailed items plus a count of the rest. Medicines include only the name, expiry date, storage location, and linked members; visits include only the member, date and time, hospital, and department. Stock, photos, diagnoses, and doctor's instructions are never sent. The summary reaches your paired watch through Apple WatchConnectivity or the Wear OS data layer of Google Play services; the operating system carries it over Bluetooth or a network, without passing through a Fly Design server. The watch keeps the latest summary and shows it offline or while the cabinet is locked on the phone, so set a passcode on the watch. After you turn sync off, the watch clears the old summary the next time it connects to the phone; an offline watch cannot be cleared immediately, and you can also remove the app from the watch.

8. Local encryption, app lock, and security measures

Local encryption coverage: when enabled, the app uses AES-256-GCM authenticated encryption for the household record file and app-managed medicine and leaflet photos, member avatars, visit materials, and saved OCR records. Enabling encryption encrypts files managed by the app, and subsequent writes follow this setting. Decryption checks integrity and rejects an incorrect key or modified ciphertext. Image optimization operates after decryption and saves the result with encryption according to the current setting. Original medical materials are excluded from lossy storage optimization.

Keys and app lock: a random 256-bit data key is held in local system secure storage and is not included in portable backups. App passwords are stored as salted Argon2id verification values. Repeated failures trigger increasing waiting periods during which neither passwords nor biometrics can open the app. The system verifies biometrics; we do not receive raw fingerprints or facial data. App lock controls entry and is not equivalent to wrapping the data key with that password, nor does it guarantee that all runtime memory is erased when locked.

Backups and transfer: exported backups always use a separate password, Argon2id key derivation, and AES-256-GCM encryption, regardless of the local encryption setting. The app supports importing plaintext backups. Imported data is saved according to the receiving device settings; the original file is not automatically encrypted. Device transfer requires scanning a QR code for the current session, uses ephemeral key agreement and authenticated encryption, and rejects repeated messages. The QR code contains a pairing secret and should not be shared publicly.

Limits: file names, sizes, some preferences, and technical metadata are not all concealed. Runtime memory, temporary working copies required for system OCR, originals in the system photo library, authorized calendar events, intentionally shared PDFs, and copies held by other apps are not collectively protected by the local file encryption setting. Temporary decrypted working copies are cleaned after the operation; residues after an abnormal exit are cleaned on the next launch. We do not promise forensic erasure of flash storage.

The app is configured to exclude its record directories from automatic system backups on supported platforms and uses device-specific secure storage settings. System versions, manufacturer implementations, and existing historical backups may affect actual behavior. Encryption reduces risk but cannot guarantee absolute security. Protect the separate backup password and verify that backups can be restored. We do not hold your data keys or backup passwords and cannot recover lost keys for you.

9. Third-party components and independent processors

The app may use Google Play Billing and Apple App Store purchase services; camera, photo, notification, biometric, system speech, system sharing, and system-calendar frameworks; Apple WatchConnectivity and the Wear OS data layer; on-device recognition components such as PaddleOCR, ONNX Runtime, and Google ML Kit; PDF and printing components; and external lookup websites you choose to open.

On-device recognition components do not send records to their suppliers; Google ML Kit sends only the diagnostic data described in section 6. App stores handle only transaction product and entitlement information. System calendars, system speech, watch connections, sharing recipients, and external websites handle information only after you actively enable or access them, under their own policies. We do not use SDKs to create advertising profiles.

10. Storage, retention, and deletion

The default storage location is the app directory on your device and any system photo or file location you choose. Records remain until you delete the item, clear app data, or uninstall the app. Temporary images, responses, and caches created for a task are cleaned up after completion or failure where the implementation can control them; system and third-party caches may be outside our control.

If you enable calendar reminders, the app stores linkage data on the device (such as calendar ID, event ID, source record ID, and last sync status) until the related medicine or visit record is deleted, unlinked, or you ask us to clear it. Deleting an in-app record, disabling the feature, or revoking permission does not automatically delete system-calendar events or cloud copies; events already written to a calendar must be removed through an in-app cleanup action if provided or separately in the system calendar.

Deleting a medicine, member, visit, or photo in the app removes the copy within the app's control. Exported, shared, printed, transferred, or system-backed-up copies must be deleted separately by you. The minimum records required for law, disputes, security review, or store transactions are retained only as long as necessary and then deleted or de-identified.

11. Sharing, processors, and legal disclosure

We do not sell, rent, or exchange medicine or health information for advertising, and we do not upload records or appoint a third party to store them in the cloud. We do not proactively share records except for sharing, backup, printing, device transfer, system speech, system calendars, store purchases, or external web access that you start, your separate consent, or a lawful request.

12. Sensitive and children's information

Health, medicine, and visit information may receive special protection as sensitive information in your jurisdiction. You choose voluntarily to record it on your device. Obtain necessary authorization before creating records about another person. We do not use the content to infer insurance eligibility or creditworthiness, or to target advertising.

The app is intended for adults managing personal and family records, and is not directed to children registering or using it independently. Guardians may manage children’s records where lawful and with any required consent, entering only necessary information. Local requirements concerning children’s ages, guardian consent, and health data apply. If inappropriate information is recorded, delete or correct it on the device first and contact us for operational help; we cannot remotely access that record.

13. Your rights and how to request them

Depending on applicable law, you may have rights of access, correction, deletion, copying and portability, restriction, objection, withdrawal of consent, and complaint to your local data protection authority. Manage local records in the app, revoke permissions in system settings, and manage previously created events in your calendar. Revoking permission does not automatically delete earlier external copies.

Fly Design does not hold your local health records and cannot retrieve them from a server, remotely delete them, or decrypt them. For support emails you choose to send or other information we actually hold, exercise your rights at flydesign.app@gmail.com. We request only proportionate verification, respond within applicable legal deadlines, and do not discriminate solely because you exercise privacy rights. If a request is refused or limited, we explain the basis and any applicable appeal route.

We do not sell or share health records for cross-context behavioral advertising, or use records for automated decisions with legal or similarly significant effects. Additional rights granted by local law continue to apply.

14. International processing, networks, and security incidents

On-device records, on-device OCR, and local encryption do not create a cross-border transfer initiated by Fly Design. Google Play, Apple App Store, Google ML Kit diagnostics, the PaddleOCR model download server, external websites you open, sharing recipients you choose, system calendars, and system speech services may process information they receive in other regions under their infrastructure, account settings, and policies. This does not change Fly Design’s commitment not to upload or host user records.

If an incident may affect personal information that we process, we will take the containment, remediation, notice, and reporting steps required by applicable law.

15. Updates and contact

We may update this policy as features, law, or security measures change. We give appropriate notice of material changes and state their effective date. Where renewed consent is legally required, we obtain it before the relevant processing. All language versions are intended to have the same meaning. Differences in interpretation do not reduce protections under applicable law.

Contact flydesign.app@gmail.com about privacy questions or requests. Do not email passwords, complete medical records, or unrelated sensitive information. Emails you choose to send are processed by the email service to respond, resolve issues, and address necessary disputes or legal duties, then deleted or retained only as necessary.

The website cannot read local records in the app. The current website only presents product and legal information; it does not provide online accounts, uploads, cloud synchronization, or hosted user records. The current pages do not embed advertising or third-party web-font services. Website analytics starts only after your affirmative consent, as described in section 16. Like most websites, our web server and Cloudflare, the network provider that delivers the site, automatically record technical request data such as IP address, time, requested page, browser user agent, and referring page to deliver the site, prevent abuse, and troubleshoot. We use these logs only for security and operations, do not combine them with app records, and keep them only as long as needed for those purposes.

16. Website analytics

The MedCabin app does not include behavioral analytics or send medicine or health records to website analytics. This section applies only to the Fly Design website.

Only after your affirmative consent, this website loads Umami Cloud from https://cloud.umami.is/script.js to measure page views, clicks, content exposure, scroll depth, foreground time, estimated active reading time, and traffic sources so we can improve the content and download links. Reading time is an estimate based on page visibility and recent interaction, not proof that content was understood.

We send canonical pages, fixed page titles, stable content IDs, screen and browser-language information, referring domains, and allowlisted marketing values, not arbitrary URL parameters, full referrer URLs, email addresses, input, or health records. We do not call identify or set a website account ID. Umami still receives IP addresses and other network information when serving the script and receiving requests; no analytics cookies does not mean no personal information.

Your choice is stored in local localStorage under flydesign.analytics.v1 for 180 days. Declining or withdrawing does not limit reading, language switching, or downloads; change your choice through “Privacy settings” in the footer. Withdrawal stops future tracking and discards queued events, but cannot recall requests already sent. Activity before consent is not replayed.

Umami publishes a six-month retention period for its free plan; actual retention depends on the service settings. Website code cannot perform or guarantee deletion by the provider. Contact flydesign.app@gmail.com with privacy requests.