Privacy Policy

1. What Information Do We Collect?

Personal information you provide to us

In Short: We collect the personal information you directly provide when you create an account, plus the care information you choose to log.

When you register for a MedleyCare account, we collect the following personal information:

• First name
• Last name
• Email address
• Date of birth (optional) — for yourself or for a care profile you create, to support age-appropriate features such as dosing-related guidance.

We do not collect phone numbers or physical addresses, and we do not collect identity documents.

Care log and health information

To provide MedleyCare's core features, we process the care information you choose to log within a care profile — including medications, doses, symptoms, vitals, feeds, and appointments. This information may relate to you, or to another person you are caring for (a child, an aging parent, or another loved one). This information may constitute "special category" health data under the GDPR — see Section 3 for the legal basis we rely on to process it.

If you use voice logging, your spoken input is processed and converted into a text log entry as part of your care log.

Documents you upload

MedleyCare lets you upload documents — such as discharge summaries, lab results, or prescriptions — to a care profile, and generate doctor-ready PDF exports of your logged care. Uploaded documents are stored on the same secure servers as your account data, located in Germany.

As a matter of policy, ZenSkayl staff do not access, open, or review the documents you upload, ever. Access to the underlying storage systems is restricted to authorized personnel through technical access controls. We do not currently offer client-side ("end-to-end") encryption that would make documents technically unreadable even to us; if we introduce that capability in the future, we will update this Notice accordingly. See Section 9 for more on how we secure your data.

Medication photo scans

If you use the medication photo scan feature, the photo you capture is processed — including via Google's Gemini AI models — to read the label and auto-fill medication details for you to review before saving. See Section 5 for details.

Information collected automatically

We may collect limited technical data automatically when you use the Services, such as device type, operating system, app version, session duration, and feature usage patterns. This data is used solely for the purpose of maintaining, improving, and securing the Services. It does not identify you personally.

Payment data

We do not collect, store, or process any payment card numbers, bank account details, or financial instrument data. All in-app subscription purchases are processed exclusively through Google Play Billing. ZenSkayl Ltd receives only a purchase verification token and confirmation status from Google. Please see Section 6 for details.

Information about other family members

MedleyCare is built for family care coordination. When you create a care profile for another person — such as a child, an aging parent, or another loved one — you may enter that person's health and personal information into MedleyCare on their behalf. You are responsible for ensuring you have the legal right and appropriate authority (for example, as a parent, legal guardian, healthcare proxy, or otherwise authorized caregiver) to enter and share that person's information, and, where required by law, for obtaining that person's consent or acting within your lawful authority to consent on their behalf. See Section 10 for more on care profiles involving minors.

Information within a shared care profile is visible to the family members you invite to that care circle.

All personal information you provide must be true, complete, and accurate. Please notify us of any changes to your information.

2. How Do We Process Your Information?

In Short: We process your information to provide and improve the Services, manage your account, communicate with you, and comply with law.

We process your personal information for the following purposes:

• Account creation and authentication. We use your name and email address to create and maintain your MedleyCare account and to enable you to log in securely.
• Service delivery. We use the care information you log — medications, feeds, symptoms, vitals, and appointments — and any documents you upload to provide care tracking, reminders, PDF exports, and the other core features of the Services.
• Family coordination. We use care profile data to allow the family members you invite to a care circle to view and contribute to the same shared timeline.
• Subscription management. We use your account information and Google Play purchase tokens to activate and manage your subscription tier.
• Customer support. We may use your contact information to respond to support requests and resolve issues you raise with us.
• Marketing and promotional communications. With your consent, we may send you updates, newsletters, or promotional information about MedleyCare. You may opt out at any time by clicking the unsubscribe link in any marketing email or by contacting us at [email protected].
• Security and fraud prevention. We may use your information to protect the integrity of the Services and to detect and prevent fraudulent activity.
• Legal compliance. We may process your information where required to comply with applicable laws or regulatory obligations.
• Service improvement. We may use aggregated and anonymised technical usage data to understand how users interact with the Services and to improve features and functionality.

3. What Legal Bases Do We Rely On?

In Short: We only process your personal information where we have a valid legal basis to do so under applicable law.

For users in Mauritius, we process your personal data in accordance with the Data Protection Act 2017 of Mauritius and rely on the following legal bases:

• Performance of a contract: Processing your name, email address, and care log data is necessary to create and manage your MedleyCare account and to provide the Services you have signed up for.
• Legitimate interests: We may process technical and usage data for security, fraud prevention, and service improvement, where our legitimate interests are not overridden by your rights.
• Consent: Where we send marketing communications, or process health-related information you log, we rely on your consent, which you may withdraw at any time.
• Legal obligation: We may process your information where required by applicable law.

For users in the EU/EEA or UK, the equivalent legal bases under the GDPR (or UK GDPR) apply as described above. In addition, because care log information may include health data, which is a "special category" of data under Article 9 of the GDPR, we rely on your explicit consent to process this category of information, alongside its necessity for providing the Services you have requested. If you have questions about the specific legal basis applicable to your situation, please contact us.

4. When and With Whom Do We Share Your Information?

In Short: We share your information only with trusted third-party service providers necessary to operate the Services, and do not sell your personal data.

We may share your personal information with the following categories of third parties:

• Your care circle. Information within a shared care profile — including care log entries and documents — is visible to the family members you invite to that care circle.
• Google (Gemini AI models): When you use the weekly care digest or medication photo scan features, the relevant photo and/or care log entries needed to generate that output are sent to Google's Gemini API for processing. Please see Section 5 for important details.
• Google Play Billing: When you subscribe to a paid plan, your payment is processed entirely by Google Play Billing. We share only the minimum information required to verify your purchase (a purchase token and product identifier). We do not receive or store your payment card details. Please see Section 6.
• Infrastructure and hosting providers: We use GDPR-compliant cloud hosting infrastructure located in Germany to store your account data, care log data, and uploaded documents. These providers process data only on our behalf and under appropriate data processing agreements.
• Legal and regulatory authorities: We may disclose your information where required by law, court order, or government authority.

We do not sell, rent, or trade your personal information to any third party for their own marketing or commercial purposes.

5. AI Technology and Personalised Insights

In Short: MedleyCare uses Google's Gemini AI models to power an optional weekly care digest and medication photo scanning. These features are informational only and are not a substitute for professional medical advice.

MedleyCare offers two optional AI-powered features, built on Google's Gemini Flash and Gemini Flash Lite models:

• Weekly care digest: a plain-language summary of recently logged care activity for a profile.
• Medication photo scan: reads a photographed medication label to auto-fill the name, dose, and schedule fields for you to review before saving.

Data sent to Google. When you use these features, we send Google only the specific photo or care log entries needed to generate that output — not your full document library or entire care history. Google processes this data as our service provider under its API terms, and it is not used to identify you. Please review Google's privacy policy to understand how it handles data submitted to its APIs: https://policies.google.com/privacy.

By using the AI-powered features of MedleyCare, you acknowledge and accept that:

• AI-generated summaries and auto-filled medication details are provided for convenience and informational purposes only, and may contain errors or omissions.
• You should always review and verify any AI-suggested medication name, dose, or schedule against the original label or your prescribing information before relying on it.
• AI-generated content is not medical advice and is not a substitute for guidance from a doctor, pharmacist, or other qualified healthcare professional. If you have concerns about a medication, symptom, or care decision, please seek professional guidance.
• ZenSkayl Ltd makes no representation or guarantee regarding the accuracy of AI-generated content and accepts no responsibility for care decisions made on the basis of it.

6. Payment Processing (Google Play Billing)

All in-app subscription purchases for paid tiers are processed exclusively through Google Play Billing, operated by Google LLC.

ZenSkayl Ltd does not store, access, or process your payment card numbers, bank account details, or any other financial instrument data. When you initiate a subscription purchase, payment is handled entirely within the Google Play environment. ZenSkayl Ltd receives only a purchase verification token and a confirmation of a successful or failed transaction, which is used solely to activate or manage your subscription status.

By completing a purchase through Google Play, you are also subject to Google's terms of service and privacy policy. Please review Google's privacy policy to understand how your payment data is handled: https://policies.google.com/privacy.

Subscription management, cancellations, and refunds (where applicable under Google's policies) are handled through the Google Play Store. To manage your subscription, visit the Google Play subscription management page or the relevant section within the MedleyCare app.

7. Do We Use Cookies and Tracking Technologies?

In Short: We may use limited cookies and similar technologies for essential app functionality and analytics.

We may use cookies or similar tracking technologies (such as local storage tokens) for the purpose of maintaining your logged-in session, remembering your preferences, and collecting anonymised usage analytics to improve the Services. We do not use tracking technologies for advertising or to build behavioural profiles for sale to third parties.

Most browsers allow you to control cookie settings. Disabling certain cookies may affect the functionality of the Services.

8. How Long Do We Keep Your Information?

In Short: We keep your information for as long as necessary to provide the Services and comply with our legal obligations.

We retain your account information (first name, last name, email address, and date of birth if provided) for as long as your account is active or as needed to provide you with the Services. If you delete your account, we will delete or anonymise your personal information from our active databases within a reasonable period, unless we are required to retain it by applicable law (for example, for tax or fraud prevention purposes).

Care log entries and uploaded documents are retained for as long as the relevant care profile or account is active, until you delete the specific entry or document, or until the account is deleted — whichever happens first. Upon account deletion, this data is deleted within a reasonable period unless retention is required by law.

Technical and usage data that has been aggregated and anonymised so that it cannot identify you may be retained for longer periods to help us maintain and improve the Services.

9. How Do We Keep Your Information Safe?

In Short: We implement reasonable technical and organisational security measures, but no system is perfectly secure.

Your account data, care log data, and uploaded documents are stored on GDPR-compliant server infrastructure located in Germany. We have implemented technical and organisational security measures to protect your information from unauthorised access, disclosure, alteration, and destruction, including encrypted data transmission and access controls that restrict who can reach production systems. As a matter of policy, ZenSkayl staff do not access, open, or review the documents you upload.

We do not currently offer client-side ("end-to-end") encryption of uploaded documents, which would make them technically unreadable even to us. We are evaluating this as a future enhancement and will update this Notice if and when it is implemented.

Please be aware that no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security. You transmit information to us at your own risk.

10. Do We Collect Information from Minors?

In Short: MedleyCare accounts are intended to be created and held by adults. Account holders may log care information about a minor they are responsible for, such as their own child.

The Services are intended for use by adults who act as the account holder. We do not knowingly allow children under 13 to create their own MedleyCare account, and we do not knowingly solicit, collect, or store personal information directly from children under 13 as users of the Services.

MedleyCare is, however, designed to let an account holder log care information about other people they are responsible for — including minors, such as tracking a baby's feeds, diapers, and medications. This is expected and permitted use of the Services: the account holder, as the minor's parent or legal guardian, is responsible for the information they enter and for ensuring they have the right to enter it, as described in Section 1.

If you believe a minor has created their own MedleyCare account independently of a parent or guardian, please contact us at [email protected] and we will take steps to address it.

11. What Are Your Privacy Rights?

In Short: Depending on your location, you may have rights to access, correct, or delete your personal information, and to withdraw consent.

Users in Mauritius have rights under the Data Protection Act 2017, including the right to access the personal data we hold about you, the right to request correction of inaccurate data, and the right to request erasure of your data in certain circumstances.

Users in the EU/EEA or UK have additional rights under the GDPR or UK GDPR, including the right to data portability, the right to object to processing, and the right to lodge a complaint with your local data protection authority.

To exercise any of your rights, please contact us at [email protected]. We will respond to all valid requests within the timeframes required by applicable law.

Withdrawing Consent

Where we process your information on the basis of your consent — for example, marketing communications, or the health-related information in your care log (see Section 3) — you may withdraw your consent at any time by contacting us, using the unsubscribe link in any marketing email, or deleting the relevant care log entries, documents, or your account. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal, and may limit your ability to use certain features.

Account Deletion

You may request deletion of your account and associated personal data at any time by contacting us at [email protected]. We will process your request within a reasonable period. Please note that we may retain certain information where required by law or for legitimate business purposes such as fraud prevention.

12. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

13. Do We Make Updates to This Notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws and to reflect changes to our Services.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated date at the top of this notice. If we make material changes, we will notify you by prominently posting a notice within the app or by emailing you at the address associated with your account. We encourage you to review this Privacy Notice periodically.

14. How Can You Contact Us About This Notice?

If you have questions or concerns about this Privacy Notice or our data practices, please contact us at:

ZenSkayl Ltd
Email: [email protected]

15. How Can You Review, Update, or Delete the Data We Collect from You?

Based on the applicable laws of your country, you may have the right to request access to the personal information we hold about you — including your care log entries and uploaded documents — to request that inaccuracies be corrected, or to request deletion of your personal information.

To exercise any of these rights, please email us at [email protected] with the subject line "Data Request" and a description of your request. We will respond within the timeframes required by applicable data protection law.