DoseNext Privacy Policy

01Who we are

DoseNext is built and published by Andrii Kolisnyk, an independent developer based in Ukraine. Under the EU and UK General Data Protection Regulation I am the data controller for the information described on this page.

Anything about this policy, or any request under it, goes to kolisnyk7@gmail.com and reaches me directly. There is no support desk in between.

02The one rule

Your treatment never leaves the device. Medication names, dosages, instructions, notes, photographs, the times you take things and the record of what you took are held on your iPhone and, if you leave sync on, mirrored to your own private iCloud. They are never sent to me, to an analytics service, to an advertiser, or to anyone else.

03What is on your device

All of this is created by you, stays in the app’s own store, and is never transmitted to me:

Treatment courses

WhyA name, optional notes, the dates it runs, how often it repeats and the daily schedule — the thing the whole app is built around.

Where it goesOn the device. Mirrored to your own iCloud if sync is on.

Medications

WhyName, dosage, optional notes and how many units make up a dose, so the app can tell you what to take and how much.

Where it goesOn the device. Mirrored to your own iCloud if sync is on.

Photographs of a medication

WhyOptional. A picture of the actual tablet or its packaging is often the fastest way to tell two similar pills apart.

Where it goesOn the device, downscaled and re-encoded on the way in. Mirrored to your own iCloud if sync is on.

Your intake record

WhyWritten only when you resolve a dose — taken, completed or skipped — with the time you confirmed it and a snapshot of how the dose read at the time, so retiming a dose next week never rewrites what you took last week.

Where it goesOn the device. Mirrored to your own iCloud if sync is on.

Refill counts

WhyOnly if you turn counting on: how many units are left, and the threshold you want warning at.

Where it goesOn the device. Mirrored to your own iCloud if sync is on.

Settings

WhyThe language you chose, whether the one-minute warning is on, whether the Lock Screen activity is allowed, whether sync is on.

Where it goesOn the device.

Feedback or support messages

WhyOnly what you choose to write to me, when you write to me.

Where it goesEmail.

There is no account and no sign-in. Nowhere in DoseNext is there a field asking for your name, your email address, your date of birth, your phone number or your doctor’s details. It does not know who you are, and it does not need to.

04iCloud sync

Your schedule, your history and your refill counts are mirrored to your own private iCloud database, so a new phone picks up where the old one left off. That is the whole of the architecture: the cloud identity is the iCloud account already on your device, and the data sits in a container only that account can read.

• I cannot see it. It is your iCloud, under Apple’s terms, not a server of mine. I have no access to it, no console for it and no copy of it.
• It is optional. Turn sync off in Settings and DoseNext keeps a purely local store. The change takes effect at the next launch, because whether a store mirrors is decided when it is opened — and Settings says so rather than pretending otherwise.
• It is on unless you turn it off. The thing people need sync for — a new phone, or a lost one — is worth nothing if it was never switched on before the phone was lost.
• No account, no problem. A device with no iCloud account, or one that cannot reach it, opens the same store and behaves exactly as it did before sync existed.

How Apple handles data in iCloud is governed by the Apple Privacy Policy, not by this one.

05Usage analytics — off until you turn it on

DoseNext can report anonymous usage data, through Mixpanel, to show me which parts of the app people actually use. It is off unless you switch it on in Settings, and until you do, the SDK is not started at all: no identifier is generated and no request is made. A switch that is off is off, rather than collecting quietly and filtering later.

If you do switch it on, this is the whole of what is sent:

Which action, from which screen

WhyA fixed list of event names — a dose confirmed, skipped or undone, a course created, a reminder opened, a step of the introduction seen, the paywall seen, a purchase started or finished. The name of the event and nothing about the medication it concerned.

Where it goesMixpanel, EU data centre.

Counts and yes/no answers

WhyHow many medications a course has, how many actions a day, whether it has an end date, how far the introduction got, whether reminders were allowed, whether a dose was confirmed early, on time or late.

Where it goesMixpanel, EU data centre.

A random install identifier

WhyThere are no accounts here, so a profile needs something stable to hang on. It is a random value generated on your device the first time it is needed, meaningless anywhere else, and it never existed before you gave consent.

Where it goesOn the device, and Mixpanel. Deleted when you switch sharing off.

The build, not you

WhyThe platform (`ios`), the app version, and the language code the app is being read in — the language alone, not the full locale, which would carry your region with it.

Where it goesMixpanel, EU data centre.

Your IP address

WhyNot collected by the app, but carried by the network request itself, as it is by any web service. Mixpanel derives an approximate city and region from it in the ordinary way.

Where it goesMixpanel, EU data centre.

The Mixpanel project has EU data residency, so events go to Mixpanel’s European endpoint. Mixpanel is a data processor acting on my instructions; see the Mixpanel Privacy Policy.

Switching it off in Settings stops the SDK, opts the install out, and deletes the install identifier. Turning it back on later starts a new profile rather than picking the old one back up, which is what "stop sharing" ought to mean.

06Purchases and Premium

DoseNext is free, with an optional Premium subscription. I never see your payment details. Everything you buy is billed by Apple, which holds the card and issues the refunds.

• Apple — takes the payment and confirms the transaction. Apple’s handling of it is governed by the Apple Privacy Policy.
• RevenueCat — decides whether your Premium entitlement is active, and manages the subscription state across your devices. It receives an anonymous app user identifier, the transaction data Apple returns, your storefront country, and the device and app version. It is configured when the app launches. It never receives anything about your medication or your schedule. See the RevenueCat Privacy Policy.

Prices, periods and any free trial come from the App Store in the currency of your own storefront. Nothing about the price is assembled by the app, and no trial is advertised that the store has not granted.

07Reminders and the Lock Screen

Reminders are local notifications, scheduled on your device by iOS and delivered by iOS. They are not sent from a server — there is no server — so no notification passes through me or anyone else. Permission is asked for once, during the introduction, and can be withdrawn at any time in Settings → Notifications → DoseNext.

The Lock Screen activity — the one that can show the next dose and a Taken button without unlocking — is off until you ask for it. A medication name on a Lock Screen is legible to whoever picks the phone up, and that is not a decision to make on your behalf, so it is a switch in Settings and the app says plainly who can see it.

The same caution applies to widgets and to Apple Watch: what they show is the next dose, drawn from a small snapshot the app writes into its own shared container on your device. That snapshot carries no notes, no photographs and no history.

08Photographs of your medication

A medication can carry an optional photograph. DoseNext uses the system photo picker, which runs outside the app: iOS shows you your library, and hands the app only the single image you pick. That is why DoseNext never asks for access to your photo library — it has none, and it cannot see anything you did not choose. There is no camera access either.

A chosen image is downscaled and re-encoded before it is stored, kept alongside the rest of your data on the device, and mirrored to your own iCloud if sync is on. It is never uploaded anywhere else. Removing the photo in the medication editor deletes it.

09What DoseNext never does

• No sale or sharing of personal data. Not to data brokers, not to advertisers, not to anyone, for any price.
• No advertising. There is no ad SDK in the app and no use of the Identifier for Advertisers.
• No tracking across apps or websites, and no third-party tracking of any kind.
• No health data to anyone. Nothing about your treatment is shared with an analytics service, an insurer, a pharmacy, an employer or a health platform. DoseNext does not read from or write to Apple Health.
• No profiling and no automated decisions about you. Nothing in the app suggests moving a dose, taking less, or stretching a packet out.

10Why we are allowed to do this

For readers in the EEA and the UK, the legal bases are these:

• Your medication data is special-category health data (Article 9). It is processed on your device to give you the app you asked for, on the basis of your explicit consent, given by entering it. It is never used for anything else, and you withdraw that consent by deleting it or deleting the app.
• iCloud sync — your consent, given by leaving sync on, and withdrawn by turning it off.
• Usage analytics — your consent, given by switching it on, and withdrawn by switching it off. No health data is involved in it at all.
• Purchases and Premium — necessary for performance of the contract between us (Article 6(1)(b)).
• Answering your email — my legitimate interest in replying to you (Article 6(1)(f)).

11How long anything is kept

• On your device — until you delete it, or delete the app. Deleting DoseNext removes the whole store: courses, medications, photographs, history, refill counts and settings.
• In your iCloud — until you delete it, under Apple’s own retention. Deleting the app from one device does not empty the shared iCloud database; see Privacy Choices for how to clear it.
• Analytics — kept by Mixpanel under my project’s retention settings, and detached from any identifier the moment you switch sharing off, since the identifier itself is deleted.
• Email — kept as long as needed to deal with what you wrote about, and then deleted.

12Security

Data on the device is protected by iOS file protection, encrypted at rest with a key tied to your device passcode — so set a passcode, because it is the lock on all of this. iCloud data is encrypted in transit and at rest by Apple. The analytics connection is TLS. DoseNext makes no other network request of its own.

I use reasonable safeguards, but no system is completely secure and no service can honestly promise otherwise.

13Children

DoseNext is a general-audience app and is not directed at children. It does not knowingly collect personal information from a child. A parent or carer managing a child’s medication is welcome to use it — nothing they enter is transmitted anywhere — but the account holder is expected to be an adult.

14International transfers

Because your treatment data stays on your device and in your own iCloud, there is no transfer of it to discuss. The two transfers that do exist are the analytics connection, which goes to Mixpanel’s EU data centre, and the billing connection to Apple and RevenueCat, which may be processed in the United States under the standard contractual clauses and equivalent safeguards those companies publish.

15Your rights

Depending on where you live, you have the right to access the data held about you, to have it corrected, to have it deleted, to restrict or object to its processing, to withdraw a consent you gave, and to receive your data in a portable format. In California you also have the right to opt out of the "sale" or "sharing" of personal information — which does not happen here, so there is nothing to opt out of.

Most of these you exercise yourself, in the app, in seconds. Privacy Choices is the page that says how.

To make a request of me instead, email kolisnyk7@gmail.com and I will answer within 30 days. You also have the right to complain to your local data protection authority.

16Changes to this policy

This policy will be updated as the app changes. Updates are posted on this page with a new date at the top, and anything material — a new recipient, a new category of data, a change to what analytics sends — is announced in the App Store release notes as well.

17Contact

Andrii Kolisnyk — independent iOS and macOS developer, Ukraine.

App support and privacy contact — kolisnyk7@gmail.com. Use it for anything about this document, a privacy request, a deletion request, or a problem with the app. I read and answer these myself; there is no support desk in between.

Freelance and hiring enquiries go somewhere else — kolisnyk9@gmail.com, or the contact panel on the portfolio. The two inboxes are deliberately separate, so app support is never sitting behind a pile of work enquiries.