Privacy Policy

VitaBox · ThreadedCodeLabs · Effective June 15, 2026

This Privacy Policy describes how VitaBox, provided by ThreadedCodeLabs, collects, uses and protects the user's information (hereinafter, the "User").

1. Data We Collect

1.1 Account data

When the User registers with VitaBox, we collect:

• Email address.
• Username (provided by the User or by the authentication provider).
• Profile picture (if signing in with Google).
• Unique user identifier (UID) generated automatically by Firebase Authentication.

1.2 Medication data

The User may voluntarily enter:

• Medication name, type, dose and unit.
• Stock control: total stock, current stock and alert threshold.
• Personal notes about the medication.
• Medication identifier in the database consulted (CIMA in Spain, FDA NDC in the US, Health Canada DIN or the French BDPM CIS code) if the medication is looked up.
• Marketing authorization holder (laboratory) of the medication.

1.3 Treatment and intake data

• Treatment status (active/inactive), start date, frequency and duration.
• Intake history: date, time, dose administered and notes.
• Scheduled reminders: times and frequencies.

1.4 Symptom data

• Symptom types customized by the User.
• Symptom logs: severity (1-5), date, time and notes.
• Symptom follow-up reminders.

1.5 Shared household data

When the User takes part in a shared household:

• Household name and member list (UIDs and display names).
• Shared medications: the same fields as personal medications.
• Shared intake history: includes the name of the member who logged the intake.
• Personal preferences regarding shared medications (allergies, favorites, treatment) which are NOT shared with other members.
• Temporary invitation code (valid for 24 hours).

1.6 Subscription data

If the User purchases the Premium subscription, we process limited information necessary to manage it: subscription status (active/inactive), plan and expiration date. Billing is processed by Google Play; we do NOT collect or store the User's card details.

1.7 Advertising data

The free version displays advertisements through Google AdMob. In order to display advertisements and, where applicable, personalized advertisements, the User's consent is obtained through Google's User Messaging Platform (UMP). AdMob may process device identifiers in accordance with its own privacy policy. The User can remove advertisements by subscribing to Premium or manage their consent from within the application.

1.8 Usage and analytics data

The application uses Google Analytics for Firebase to measure feature usage in aggregate form (for example, how many users create a shared household or use the data export feature). These events do not include health data or content entered by the User; they may include device or installation identifiers which Google processes in accordance with its own privacy policy. The purpose is to improve the application and decide which features to develop.

1.9 Doctor and appointment data

The User may voluntarily enter:

• Doctors: name, specialty, notes and details of their offices (facility name, address, phone number, email and accepted insurance).
• Appointments: associated doctor, date and time, duration, reason, location, type (in person, online or lab work), video consultation link, laboratory, reminders and, where applicable, the household member for whom the appointment is scheduled.

2. How We Use the Data

The User's medical and account data are used to:

• Provide the application's functionality (medication management, reminders, stock control, symptom tracking).
• Synchronize data across the same User's devices.
• Share medications and stock within the User's shared household.
• Send local notifications for intake reminders and low stock alerts.
• Manage the Premium subscription (verify status, handle renewals and cancellations).

The User's medical and account data (medications, intakes, symptoms, household) are NOT used for:

• Advertising or marketing.
• Sale to third parties.
• Medical or statistical research.

The advertising displayed in the free version is managed by Google AdMob and may use device identifiers, as described in section 1.7 and subject to prior consent. Health data is never shared with the advertising network.

Legal basis for processing

The processing of account and usage data is based on the performance of the contract (provision of the service). The processing of health data (medications, intakes, symptoms) is based on the User's explicit consent, which may be withdrawn at any time by deleting such data or their account. Personalized advertising is based on the consent given through Google's platform.

3. Storage and Security

3.1 Infrastructure

Data is stored on Firebase (Google Cloud Platform), with servers located in the European Union. Firebase complies with the EU General Data Protection Regulation (GDPR).

3.2 Security rules

Access to data is protected by Firebase Firestore security rules:

• Each User can only read and write their own personal data.
• Shared household data is only accessible to household members.
• Personal preferences regarding shared medications are only accessible to their owner.

3.3 Authentication

Account access is protected by Firebase Authentication, which supports:

• Sign-in with email and password.
• Sign-in with Google (OAuth 2.0).

4. Data Sharing

4.1 Within the shared household

When joining a shared household, the following data will be visible to all members:

• Medication name, type, dose, stock and notes.
• Intake history (who took what and when).
• Doctors that the User adds to the household (name, specialty, notes and details of their offices).
• Appointments that the User adds to the household (doctor, date, reason, location, type and the household member for whom they are scheduled).

Doctors and appointments that the User keeps as personal (outside the household) are not shared.

The following data is NOT shared:

• Personal medication allergies.
• Medications marked as favorites.
• Treatment and reminder settings.

4.2 With third parties

We do not share the User's data with third parties, other than the necessary technical services:

• Firebase (Google): data storage and authentication.
• Google Play Store: distribution of the application and processing of subscription payments.
• Google AdMob: advertising in the free version (does not receive health data).
• Google Analytics for Firebase: aggregate measurement of application usage (does not receive health data).
• Public medication databases (CIMA from the Spanish AEMPS, openFDA from the US FDA, the Health Canada drug database and the French public medication database): when a medication is searched, the search text is sent to them. They do not receive account or health data, although, like any server, they can see the device's IP address. Queries to openFDA involve a transfer to the US.

5. User Rights

In accordance with the GDPR, the User has the right to:

• Access: view all of their data stored in VitaBox.
• Rectification: modify their data at any time from within the application.
• Erasure: delete their account and all associated data.
• Portability: export their data in a readable format.
• Objection: stop using VitaBox at any time.

To exercise these rights, the User may use the options available in the application or contact ThreadedCodeLabs at threadedcode.labs@gmail.com. The User also has the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) if they consider that the processing of their data does not comply with the regulations.

6. Data Retention

The User's data is kept for as long as their account remains active. When the account is deleted:

• All of the User's personal data (medications, intakes, reminders, symptoms) is deleted without undue delay.
• If the User was a member of a shared household, they are removed from the household but the shared medications remain accessible to the other members.

If the account remains inactive for an extended period, ThreadedCodeLabs may delete the associated data. Where there is a legal obligation to retain certain information (for example, billing records arising from a subscription), such information will be retained only for the period required by applicable tax and commercial regulations, and will be deleted at the end of that period.

7. Minors

VitaBox is not intended for people under 18 years of age. We do not knowingly collect data from people under 18 years of age. If ThreadedCodeLabs becomes aware that data from a minor has been collected, the necessary measures will be taken to delete such information.

8. Changes to this Policy

ThreadedCodeLabs may modify this Privacy Policy at any time. Changes will be notified to the User through the application. Continued use of VitaBox after notification of changes constitutes acceptance of them.

9. Contact

For any queries relating to the privacy of their data, the User may contact ThreadedCodeLabs at: threadedcode.labs@gmail.com