Privacy Policy

1

Overview

Dosley ("we", "our", or "us") is a mobile application that helps you track medication injections, weight, side effects, and reminders.

This Privacy Policy explains what information we collect, how we use it, and the choices you have.

2

Data Controller

Stefan Creanga Email: stefancreanga@outlook.com

3

Information We Collect

Information you provide

Depending on how you use Dosley, you may provide:

• Account information (if you create an account): email address and optional profile details (such as display name).

• Health tracking data you enter in the app, such as:

• Medication selection, medication name, and dose information

• Injection logs (date/time, dose, injection site, notes)

• Weight entries

• Side effect logs

• Reminders (e.g., injection and weight reminders).

Guest Mode data

If you use Dosley in Guest Mode, your tracking data is stored locally on your device. Guest Mode data is not automatically synced to the cloud. Because Guest Mode data stays on this device, it may be lost if you uninstall the app, clear storage, or move to a new device.

Automatically collected information

We use Expo EAS Insights to collect limited app usage and performance telemetry (such as app launch and startup events) to monitor reliability. We also use Sentry for crash reporting, error diagnostics, and masked session replay when an error occurs. In addition, we use Mixpanel for pseudonymous product analytics so we can understand onboarding, logging, export, Apple Health, and premium feature usage. Mixpanel events may include technical metadata such as platform, language, guest status, premium status, and the medication name you selected in the app. We do not use advertising trackers and we do not sell personal information. Our service providers may also process basic technical information as part of operating their services (for example, IP address, device/app information, and service logs).

4

Legal Basis for Processing

We process your data based on the following legal grounds under GDPR:

• Account information (email, display name) - Contract performance (Art. 6(1)(b))

• Medication selection, medication name, and dose information - Explicit consent (Art. 9(2)(a))

• Injection logs - Explicit consent (Art. 9(2)(a))

• Weight entries - Explicit consent (Art. 9(2)(a))

• Side effect logs - Explicit consent (Art. 9(2)(a))

• Injection site flags - Explicit consent (Art. 9(2)(a))

• Pen supply data and reminder settings - Contract performance (Art. 6(1)(b))

• Push notification tokens and device information - Legitimate interest (Art. 6(1)(f))

• App launch/startup telemetry (Expo EAS Insights), error diagnostics (Sentry), and pseudonymous product analytics events (Mixpanel) - Legitimate interest (Art. 6(1)(f))

5

How We Use Your Information

We use information to:

• Provide and operate the app (tracking, charts, reminders).

• Sync your data across devices when you use an account.

• Respond to support requests.

• Maintain security and prevent abuse.

6

Where Your Data Is Stored

Cloud services (accounts)

If you use an account, Dosley relies on the following providers:

• Clerk for authentication and account management.

• Convex for application data storage (database and file storage used by the app).

• Expo (EAS Insights) for limited app launch/startup telemetry and performance monitoring, Sentry for crash reporting and masked session replay, and Mixpanel for pseudonymous product analytics. This applies to all users, including those in Guest Mode.

On-device storage

Dosley stores some information locally on your device using encrypted on-device storage for tracking data.

• Guest Mode: encrypted storage is device-only and may not be recoverable if you move to a new device or restore from a backup.

• Signed-in users: the app may keep an encrypted offline cache locally, which can be restored as part of device backups. Your account data is stored in Convex.

Notifications

If you enable reminders, the app schedules local notifications on your device. Notification content may be visible on your lock screen depending on your device settings.

7

International Data Transfers

Our service providers (Convex, Clerk, Expo, Sentry, and Mixpanel) may process your data on servers located in the United States. These transfers are protected by appropriate safeguards, including standard contractual clauses or equivalent mechanisms as required by GDPR Chapter V. You may contact us for more information about the specific safeguards in place.

8

Sharing and Disclosure

We do not sell your personal information.

We share information only:

• With our service providers (e.g., Clerk, Convex, Expo EAS Insights, Sentry, and Mixpanel) to operate the app.

• When you choose to share data (for example, exporting data using your device share sheet).

• If required by law, legal process, or to protect the rights and safety of users and our service.

9

Your Choices and Rights

Export

You can export some of your tracking data from within the app (Profile > Export Data).

Delete

• Account users: You can delete your account from within the app (Profile > Delete Account). This deletes your account and associated Dosley data from our service providers.

• Guest Mode users: You can remove Guest Mode data by deleting the app or clearing the app's storage from your device settings.

Withdraw Consent

You can withdraw your consent for health data processing at any time from Profile > Account > Health Data Consent. Withdrawing consent will permanently delete all your health data and close your account. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Lodge a Complaint

If you are in the EU/EEA, you have the right to lodge a complaint with your local data protection authority. For users in Romania: ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal) - https://www.dataprotection.ro.

10

Data Retention

We keep your account data for as long as your account is active. When you delete your account, we delete associated data from our systems, subject to limited retention where required for legal, security, or operational reasons.

11

Children's Privacy

Dosley is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

12

Medical Disclaimer

Dosley is not a medical device and does not provide medical advice. Dosley is designed to help you track and organize information. Always consult your healthcare provider for medical decisions.

13

Changes to This Policy

We may update this Privacy Policy from time to time. If we make changes, we will update the "Last Updated" date.

14

Health Data Processing (GDPR Art. 9)

Dosley processes special category health data under GDPR Article 9. Our legal basis for this processing is your explicit consent (Art. 9(2)(a)).

Health data we process

• Injection logs, doses, injection sites, and rotation history

• Weight measurements and progress data

• Side effect records and severity ratings

• Medication selections, medication names used in analytics properties, and pen supply tracking

Withdrawing consent

You can withdraw your consent at any time from Profile > Account > Health Data Consent. Withdrawing consent will permanently delete all your health data and close your account. This action cannot be undone.

Consequences of withdrawal

When you withdraw consent, all health data stored in our systems is permanently deleted. You may export your data before withdrawing consent. You can create a new account after withdrawal, but previous data cannot be recovered.

15

For EU/EEA Users (GDPR)

If you are located in the EU/EEA, you have the following rights under the GDPR:

• Right of access - request a copy of your personal data (Art. 15)

• Right to rectification - correct inaccurate personal data (Art. 16)

• Right to erasure - request deletion of your personal data (Art. 17)

• Right to data portability - receive your data in a structured format (Art. 20)

• Right to withdraw consent - withdraw consent at any time without affecting prior processing (Art. 7(3))

• Right to lodge a complaint - file a complaint with your local data protection authority

16

For California Users (CCPA/CPRA)

If you are a California resident, you may have additional rights regarding access and deletion. Dosley does not sell personal information.

17

Contact

If you have questions about this Privacy Policy, please contact the data controller: Stefan Creanga - stefancreanga@outlook.com

Privacy Policy — Dosley