Privacy Policy
Last updated: October 13, 2026
Overview
This policy explains what Medbit LLC (“MedBit,” “we,” “us”) collects through the MedBit mobile app (“the App”) and the medbit.app website, and what we can and cannot see about you. It's written to be precise rather than reassuring: where we genuinely cannot access something, we say so; where we can, we say exactly what and why.
The short version: your medical records, documents, medications, and every other piece of health content you enter are encrypted on your device with a key we never have. We could not read them even if compelled to. The few things our servers do see — mostly what's needed to run optional features like alerts and backup — are listed in full below.
Definitions
- Vault
- The collection of encrypted health and personal records you create in the App.
- Recovery phrase
- The 12-word BIP-39 phrase generated on your device at signup. Every encryption key MedBit uses is derived from it, and it is never transmitted to or stored by us.
- End-to-end encrypted (E2EE)
- Data is encrypted on your device, with a key only you hold, before it is ever written to storage or transmitted anywhere.
- Personal health record (PHR)
- A record of identifiable health information that an individual — not a doctor, insurer, or clearinghouse — creates and maintains. Regulators use this term to describe consumer apps like MedBit that are not HIPAA-covered entities.
- Consumer health data
- Personal information that is linked or reasonably linkable to you and identifies your past, present, or future physical or mental health status, as defined by laws such as Washington's My Health My Data Act.
- Alert contact
- A person whose email address you add in the App (which can include yourself) so they're told if a scheduled item isn't marked done in time.
How MedBit is built to protect you
MedBit is end-to-end encrypted on the client side. When you create or restore a vault, you receive a 12-word recovery phrase. Every encryption key MedBit uses — the vault key, the backup transport key, the identity key used to sign requests — is derived from that phrase entirely on your device.
The phrase itself, and every key derived from it, is never transmitted to or stored by our servers. Our servers only ever receive a public key (to verify request signatures), the limited data listed below, and opaque encrypted bytes they cannot open.
The App works fully offline without a membership. If you never use a membership feature, our servers receive only your account registration (public key and email).
Regulatory framework
MedBit stores information that would typically be considered sensitive health data, so several overlapping frameworks are relevant — even though, as explained below, HIPAA itself is not one of them.
| Law | Applies because… | Our approach |
|---|---|---|
| HIPAA | Binds “covered entities” (health plans, healthcare clearinghouses, most providers) and their “business associates.” MedBit has no clinical, insurance, or provider relationship with you — everything in your vault comes from you — so we are not a HIPAA covered entity or business associate, and HIPAA doesn't directly govern our practices. No federal agency certifies apps as “HIPAA compliant.” | We designed MedBit to meet or exceed the technical safeguards HIPAA's Security Rule requires of covered entities anyway: encryption at rest and in transit, strict access controls, audit logging, and minimum-necessary data collection on our servers. |
| FTC Health Breach Notification Rule (16 CFR Part 318) | Applies to vendors of personal health records offered directly to consumers — like MedBit — that fall outside HIPAA. | If a breach of unsecured identifiable health information ever occurs, we will notify affected individuals without unreasonable delay and no later than 60 days after discovery, notify the FTC as required, and notify the media if a breach affects 500 or more residents of a state. |
| State consumer health data laws (e.g., Washington's My Health My Data Act, Nevada SB 370, Connecticut) | Give residents of certain states specific rights over consumer health data, including rights to know, delete, and withdraw consent, and require a consumer health data privacy policy. | This policy is also our Consumer Health Data Privacy Policy. We collect consumer health data only as necessary to provide features you request, never sell it, and never share it except with the service providers listed below. See “Additional rights” below. |
| California CCPA/CPRA & Confidentiality of Medical Information Act (CMIA) | CCPA/CPRA treats health information as “sensitive personal information.” CMIA protects medical information maintained by certain businesses, including some apps. | California residents can exercise the rights described below. We do not sell or share personal information for cross-context behavioral advertising, we use sensitive personal information only to provide the service, and we run no advertising or analytics SDKs at all. |
| COPPA | Protects children under 13 from having personal information collected online without parental consent. | MedBit accounts are for adults. We do not knowingly collect information from children under 13. |
| GDPR / UK GDPR | May apply if we process personal data of individuals located in the EU/UK. | MedBit is designed and offered for users in the United States. See “International data transfers.” |
Data we can never see
The following lives only in your on-device encrypted vault and — if you use Cloud Backup — as doubly encrypted records on our servers. We cannot decrypt any of it under any circumstances, including in response to a legal request, because the decryption key never exists anywhere but your device.
| Category | Fields |
|---|---|
| Profile | Full name, email, date of birth, sex, blood type, height, weight, phone |
| Emergency contacts | Name, relationship, phone |
| Allergies | Allergen, reaction, severity |
| Insurance plans | Payer, plan name/type, member ID, group ID, subscriber name, effective date, phone, attached card scan |
| Providers | Names, specialties, and contact details you enter |
| Medical records | Visits, labs, imaging, surgeries, immunizations, and medications, each with their own details |
| Documents | Uploaded PDFs and photos — insurance cards, lab reports, scans — stored as encrypted files |
| Medication reminders, refills & intake logs | Labels, schedules, quantities on hand, and taken/missed/skipped history |
| Health trackers | Definitions and logged entries (blood pressure, glucose, weight, mood, sleep, and more) plus custom trackers |
| Care tasks & appointments | Titles, due dates, locations, providers, and notes |
| Alert contact names | The name you give each alert contact (e.g. “Mom”) — only their email address is sent to our servers |
| Your on-device activity log | A record of your own sign-ins, unlocks, and views — visible only to you, in the App |
| Membership status | A local copy of which paid features your membership includes |
Data our servers do store
This is the complete list of what our servers collect, and why. None of it is the content of your vault. We collect it directly from the App as you use the features described; we don't buy or receive data about you from anyone else, other than your membership's status from Apple or Google.
| Category | Fields | Purpose |
|---|---|---|
| Account | An account ID derived from your public key, the public key itself, account creation and last-seen timestamps | Authenticate requests and identify your account without a username or password |
| Account email | The email address you enter at signup | Notify you if your data is ever involved in a security breach, and handle deletion requests you send us. Never used to log in, never used for marketing, and never linked to vault content. |
| Device integrity check | Whether your app passed Apple App Attest or Google Play Integrity, the platform, and when | Confirm requests come from the genuine MedBit app on a real device, to prevent abuse of email alerts and storage |
| Membership | Store purchase identifiers, which plan you're on, its status and renewal/expiry date, whether a renewal payment is failing, and whether a period has been paid for | Verify your membership with Apple or Google and unlock the features it includes. We never receive your payment card or billing details. |
| Cloud backup (Plus and above) | Each vault record and document as encrypted bytes we cannot open, plus its record type (e.g. “records”, “trackers”, “documents”), a random record ID, a checksum of the encrypted bytes, its size, and when it last changed | Back up your vault and restore it to a new device. The record types, counts, and sizes are visible to us; the content is not. |
| Alert contacts | Each contact's email address, whether they've confirmed it, which kinds of items they want to hear about, whether they've unsubscribed, and the optional name you choose for how you appear in their emails | Send missed check-in alerts to the people you choose |
| Check-in schedule (when alerts are on) | For each scheduled item: its kind (medication, tracker, appointment, or care task), its due times over the next 30 days, and the grace period before an alert | Know when to send an alert. We see that, for example, a medication is due at 8:00 AM — never which medication, dose, appointment, or task. |
| Operational & access logs | Account ID, action type (e.g. “backup uploaded”, “alert sent”), IP address, timestamp, and a record of emails sent (type and time, not content) | Security, abuse and fraud prevention, rate limits, and operating the service |
Service providers
We share the minimum necessary data with the service providers below, who process it on our behalf, and with no one else. We do not sell your personal information or consumer health data, and we never have. We run no analytics, crash-reporting, or advertising SDKs of any kind, and collect no product-usage telemetry beyond the operational logs described above.
We may disclose the limited data our servers hold if required by law, such as a valid subpoena or court order — there is no vault content we could disclose. If MedBit is sold or merged, this data would transfer to the successor, which must continue to protect it under this policy.
| Third party | Data shared | Purpose |
|---|---|---|
| Amazon Web Services (United States) | Everything in “Data our servers do store”, including encrypted backup files (S3), and alert contact email addresses and alert email text (Simple Email Service) | Hosting our servers and storage, and delivering verification and alert emails |
| Managed database provider (United States) | The server-side database holding the data described above | Database hosting |
| Apple App Store / Google Play | Purchase identifiers (to look up your membership's status), and device integrity requests | Process and verify in-app purchases, and confirm the app is genuine. Apple and Google handle all payment details under their own privacy policies. |
| Twilio SendGrid | What you type into this website's feedback or account-deletion forms, including any email address you provide; and, if you sign up for launch updates, your email address | Delivering those form submissions to our support inbox, and sending launch and update emails to people who signed up |
What alert contacts receive
When you add an alert contact, we email them a confirmation code, and they only receive alerts once they've confirmed. Missed check-in alerts use fixed wording: the name you chose for how you appear (if any), the kind and number of items not marked done (for example, “2 medications”), and an unsubscribe link. They never include medication names, doses, appointment details, times, or anything else from your vault. Contacts can unsubscribe at any time, and the App will tell you if they do.
Only add people who have agreed to receive these emails.
Biometrics, camera, and notifications
Face ID / fingerprint unlock happens entirely inside your device's operating system. MedBit receives only a success or failure result and never has access to any biometric data.
If you allow camera or photo access, it's used on your device to attach photos and scans to your vault or to scan a recovery-phrase QR code. Images you save become encrypted vault documents; nothing is uploaded except as part of an encrypted backup.
Reminder notifications are scheduled entirely on-device — no reminder content is sent to our servers, and no push token is registered with MedBit. Notification text (which may include a medication name you chose) appears in your device's notification tray, governed by your device's settings rather than ours.
This website
medbit.app does not use analytics, advertising, or tracking cookies. If you submit the feedback or account-deletion form, we receive what you type, including any email address you provide, and use it only to respond to or carry out your request. If you sign up for launch updates, we store your email address and the date you signed up, and use them only to email you about MedBit's launch and major updates. Every such email includes an unsubscribe link, and we never sell or share the list. Our hosting provider may process your IP address and standard request logs to serve and secure the site.
Data retention
- Vault content on your device stays until you delete it or the App — we have no copy to retain or delete.
- Cloud backup: the latest version of each record is kept until you delete it in the App or delete your account. When you delete a record, a content-free marker (record type, ID, and time) remains so your other devices know to delete it too. If your membership ends, your backup is kept so you can still restore it; if we ever limit how long we keep backups for ended memberships, we'll update this policy first.
- Check-in schedule: each due time is deleted once you mark the item done, or about 2 days after an alert is sent. The whole schedule is deleted if you don't open the App for about 30 days, or about 30 days after your membership ends.
- Email send records (type and time) are deleted after about 2 days.
- Account, email, alert contacts, and membership records are kept while your account exists and deleted when you delete it.
- Access logs are kept as long as reasonably necessary for security, fraud prevention, and legal compliance. When you delete your account, the log entry recording the deletion is kept without your account ID.
- Website form submissions are kept in our support inbox as long as needed to respond and to keep a record of the request.
- Launch-update signups are kept until you unsubscribe or ask us to delete them.
Your rights and choices
- Delete your account at any time in the App (Profile → Delete account & vault). This erases your local vault and your account, backups, alert contacts, schedule, and membership records from our servers. If you no longer have the App, use the form at medbit.app/delete-account or email us. Deleting your account doesn't cancel a store subscription — cancel that in your App Store or Google Play settings.
- Turn features off: removing alert contacts or ending your membership stops the related collection.
- Export individual records or documents out of the App via your device's share sheet, at any time.
- Access requests: we'll tell you what server-side data we hold about you on request. Because vault content is encrypted with a key only you hold, we cannot produce a decrypted copy of it — only you, using your recovery phrase, can access it.
- Correction: update any vault field directly in the App — we have no separate copy to correct.
- Sale / targeted advertising: not applicable — we do not sell or share personal information, and do not use it for advertising.
- We won't discriminate against you for exercising any of these rights.
Additional rights for California residents
To the extent the CCPA/CPRA applies, California residents may request to know the categories and specific pieces of personal information we've collected (described in this policy), request deletion, request correction, and limit the use of sensitive personal information (we already use it only to provide the service). We do not sell or share personal information. To exercise these rights, contact us using the information below; we'll verify your request by confirming it through the account email on file. You may use an authorized agent.
Additional rights for Washington, Nevada, and other states
Washington's My Health My Data Act, Nevada SB 370, and similar laws give residents rights over consumer health data. Under them, you may confirm whether we collect your consumer health data and access it, request a list of the third parties we've shared it with (the service providers above), withdraw consent, and request deletion. We collect consumer health data only from you, through the App, to provide the features you request.
To exercise these rights, email support@medbit.app. We'll respond within 45 days (extendable once by 45 days where permitted, with notice). If we decline your request, you may appeal by replying to our decision with “Appeal” in the subject line; we'll respond to appeals within 45 days, and if you're unhappy with the result you may contact your state attorney general.
Children's privacy
MedBit accounts are for adults 18 and older, and the App is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.
International data transfers
MedBit is offered to users in the United States, and our servers and service providers are located in the United States. If you use MedBit from elsewhere, your data will be processed in the United States.
Security and breach notification
We protect server-side data with encryption in transit and at rest, signed requests, access controls, and rate limits. Because vault content is end-to-end encrypted, a breach of our servers alone could not expose your medical records, documents, or other vault content. If a breach involving your personal information (such as your account email, alert contacts, or check-in schedule) ever occurs, we will notify you at your account email and notify regulators as described in “Regulatory framework” and as required by applicable state law.
Changes to this policy
We may update this policy from time to time. We'll reflect changes by updating the “Last updated” date above and, for material changes, by showing a notice in the App before they take effect. We won't use data we've already collected in a materially different way without your consent.
Quick reference: can MedBit see this?
| Data | Decrypted access? |
|---|---|
| Medical records, documents, trackers, reminders, profile, insurance, emergency contacts, your name | No — never, under any circumstance |
| Your recovery phrase and every key derived from it | No — never leaves your device |
| Account email | Yes — collected only for breach notification and deletion requests |
| Alert contact emails and the name you appear as in their emails | Yes — needed to send the alert |
| The kind of each scheduled item and its due times (alerts on) | Yes — e.g. “a medication is due at 8:00 AM”, never which one |
| Backup record types, counts, sizes, and timestamps | Yes, metadata only — never the content |
| Your plan and its renewal status | Yes — verified with Apple or Google |
| IP address, request timestamps, action names | Yes — via operational and access logs |
| Payment card or billing details | No — handled entirely by Apple/Google |
| Biometric data, camera images, photos | No — processed on your device only (photos you save are part of your encrypted vault) |
Contact us
Medbit LLC is responsible for the data described in this policy. Questions about this policy, or requests to exercise any of the rights above, can be sent to support@medbit.app.