Version: v1.4Effective Date: October 19, 2026Controller: Viking Media Labs Inc., a Canadian corporation operating DoserlyPrivacy contact: privacy@doserly.comMail: 72 Victoria St S, Kitchener, ON N2G 4Y9, Canada

Summary

Doserly stores health records in an encrypted local database and syncs account data through US-based Supabase and PowerSync services. Optional analytics is off by default. The current app does not record sessions: optional session replay, offered in earlier versions, has been removed. Importing selected phone-health-store readings requires a separate Doserly choice before the operating-system permission screen; those readings sync to the adult account holder's primary self profile. AI reports require a user-initiated pre-send permission. The report path reduces direct identifiers, but its person-level health summaries remain sensitive personal information. Wearable summaries are excluded from OpenAI requests while the separate option is disabled. We do not sell consumer health data or use it for targeted advertising.

1. Information, sources, and purposes

Account and profile information. We process your email, authentication and security records, preferences, subscription status, consent receipts, and profiles you create. An adult account holder may enter information about a dependent, including a child, or a pet. A dependent cannot create their own account through that profile. We do not collect a child's information directly through a child account; information an adult enters about a child remains sensitive and may be subject to that child's rights.

Health and wellness information you enter. This may include medications, supplements and compounds; doses, schedules, adherence, symptoms, laboratory results and reference ranges; protocols, notes, photos, inventory and other records. Scanning and text recognition occur on device; saved results and attachments you choose to keep may sync to the account.

Optional health-store import. The primary adult self profile may choose available steps, heart-rate or resting-heart-rate readings, sleep periods and stages or derived duration, and paired systolic/diastolic blood-pressure readings from Apple Health or Health Connect. The phone store can contain data written by a watch, companion app, phone, or other source. Actual types depend on what you select and the store provides. We retain source, timing, coverage, and reconciliation information needed to show readings, changes, and your own trends. Imported readings and person-level averages, trends, or possible associations remain account-linked health information. Doserly's separate, initially off account-sync choice precedes the OS health permission; OS permission by itself does not allow Doserly account sync. Imports may be queued offline and later sent to Supabase and PowerSync in the United States. A separate opt-in controls background collection where the app offers it.

Device and service data. We process app version, device and operating-system details, language/time zone, security events, sync and consent history, crash/performance data, and support messages. Optional PostHog analytics runs only if enabled. Earlier app versions also offered optional masked session replay; the current version does not record sessions. Masked recordings made earlier by people who turned replay on are kept only under PostHog's retention settings, and you can ask privacy@doserly.com to delete them. Supplement lookup may send a search term, barcode or selected product identifier to FatSecret or Open Food Facts; these providers may see ordinary network metadata. We do not send your full health history merely because you search a supplement.

Private service reports. To understand whether account sync and app releases are working, we use records already synced to Doserly to count accounts that have completed onboarding, saved an item or dose, or configured reminders, including accounts that have declined optional analytics. These restricted reports include the number of accounts represented and current analytics-consent coverage. We hide small weekly groups and other counts that could reveal a group of fewer than ten accounts. Reports contain no account or health-record identifiers, names, medication details, or doses. Configured reminders do not tell us whether your phone accepted or delivered a notification. Delayed sync can change counts, and deleted accounts no longer contribute to these account reports.

We also count accepted sync uploads by app update and protocol version to check release reliability. These operational counts do not contain health-record content or account identifiers. A separate restricted record uses a hashed app-installation identifier and its last-seen day to count active installations by protocol; it is not linked to your account and is removed after a 35-day retention period through scheduled cleanup. Already combined operational counts cannot be traced back to an account for removal. These reports do not send new health events to PostHog, enable optional analytics, or measure health outcomes or whether you opened the app on a particular day.

AI report data. If you request a report, Doserly assembles selected medication/compound, dose/adherence, symptom, lab, protocol, correlation, and report-window facts. Before sending to OpenAI, the current report path replaces record IDs and entered names with private aliases, uses relative day tokens, gives custom items generic labels, and removes notes and other free text. Retrieval uses library canonical names only, omitting custom items. Provider metadata uses one random submission token. An outbound guard checks provider-bound writer, repair, polling, token-count, and retrieval requests for identifiers and source text and blocks a request it detects as unsafe. The prompt can still reveal sensitive health facts or identify someone by context. This is de-identified health-summary processing, not anonymity. Doserly restores display details to the report saved in your account.

Wearable summaries are excluded from current OpenAI submissions while the server option is off. If separately enabled later, a per-request switch is off by default. With your express selection, the report may include current and prior 28-day metric averages, observed-day counts and coverage, source labels, and screened possible dose/outcome associations with dates and uncertainty measures. Raw wearable samples, sample timestamps, and health-store record IDs are excluded from that summary request. These person-level summaries remain personal health information.

We use these data to operate tracking, account sync, reminders, requested reports and lookups, security, support, and billing; to meet legal duties; and, only with the applicable choice, for analytics. Account-linked trends serve the account holder. We do not use your health records to produce population-level health insights. Any future use for that purpose would require an updated notice and an applicable legal basis.

2. Recipients and sharing

Provider contracts and safeguards apply according to each provider's role. We do not sell personal information or consumer health data, share health data with data brokers, or use health data for targeted advertising. If you direct an export, a copy outside Doserly follows the destination's controls; Doserly remains responsible for its own handling before handoff.

3. OpenAI processing and retention

AI reports are manually requested. Doserly's Edge Function sends them directly to OpenAI's Responses API in background mode. The current request does not set store: false. Under the standard API controls described in the 2026-09-23 review, response application state is retained for at least 30 days by default; separate abuse-monitoring logs may contain prompts, outputs, or derived metadata and are retained up to 30 days by default, with legal or safety exceptions that can extend retention. OpenAI does not use API data to train its general models by default unless the API customer opts in; Doserly has not opted in for user reports. Doserly separately stores completed reports in the account. Deleting a Doserly report cannot immediately erase a previously processed provider request or provider-held copy. The actual hosted project settings and provider retention remain subject to verification; contact privacy@doserly.com for a specific rights request.

4. Choices, rights, and deletion

You can turn optional analytics off in Settings > Privacy and control notifications in Settings > Notifications. AI reporting requires a new allow action for each request. Cancel a pending request or decline the next pre-send sheet to stop a future OpenAI submission; a completed request cannot be withdrawn retroactively. In a saved report, tap "Report a problem with this content" to flag an output in-app, or contact support@doserly.com. Wearable-to-AI inclusion remains unavailable while disabled and, if enabled, requires its own per-request selection.

Stop importing in Settings > Wearables stops this phone's new reading collection/sending, while saved Doserly history remains and another connected phone may continue. Manage Apple Health or Health Connect permission separately in the phone's health settings. Delete imported wearable history is a separate account-wide request. It stops this phone's import and removes imported readings from the Doserly account and connected devices after the request is accepted and they sync; manual records and phone-health-store data remain. Offline devices may retain copies until reconnecting. A later explicit seven-day reimport can restore previously deleted readings. Delete Account is broader and follows the Account and Data Deletion page. Saved reports, provider copies, backups, and legally retained records can follow separate deletion timelines.

Depending on applicable law, you may request confirmation, access (including categories and identities of recipients of your consumer health data), correction, export, deletion, consent withdrawal, restriction, or an appeal of a rights decision. Use the in-app export/deletion controls or email privacy@doserly.com; we may verify identity and authority. We respond within legally required periods. For Washington consumer health data requests, the ordinary response period is 45 days, subject to permitted extensions and appeal procedures. See the Consumer Health Data Notice for state-specific rights and a regulator complaint route.

5. Retention and security

Active account records and saved reports remain while needed to provide the service, unless deleted or subject to a justified retention duty. Security/audit logs may be kept for up to one year after an event; support records for one year after resolution; some records may be kept as required for law, security, fraud prevention, or disputes. Account deletion begins removal of account-linked records; backups may persist until their normal cycle and provider-held copies may follow different schedules. We cannot promise a fixed 30-day erasure of every copy. Doserly uses encrypted local storage and access controls, but no system has zero risk. For detailed deletion or recipient-notice requests, contact privacy@doserly.com.

6. Children and dependents

Only adults who have reached the age of majority where they live can open accounts. We do not offer a 16–17 account route. An adult account holder may manage a dependent's profile, including a child's, only with lawful authority or consent. The adult supplies the dependent's information; the dependent does not use the account as its owner. We may seek proof of authority and handle a valid access, correction, withdrawal, or deletion request for that dependent under applicable law. If a person below the required age has opened an account, contact privacy@doserly.com so we can review and remove it as appropriate.

7. International and regional rights

Account and selected wearable data are processed through US-based Supabase and PowerSync. A separately requested AI report is processed by US-based OpenAI. US authorities may request data under applicable law. We use contractual and other safeguards and review overseas processing under applicable Canadian, Quebec, and Australian rules. A provider agreement alone does not prove that every Australian Privacy Principle obligation is satisfied.

United States. The Consumer Health Data Notice describes Washington-standard categories, sources, uses, recipients, consent, rights, appeals, and geofencing. Nevada gives covered consumers access, deletion, and consent rights under its own consumer-health-data rules; Connecticut rights and opt-out/appeal requirements apply where that law covers the processing. Other state rights apply when their statutory conditions are met. We do not sell consumer health data.

Canada. PIPEDA and applicable provincial law may give you access, correction, and withdrawal rights. Quebec cross-border assessment and French-language obligations require separate review. Complaints can be made to the Office of the Privacy Commissioner of Canada or an applicable provincial authority.

Australia. Applicable Privacy Act and Australian Privacy Principles rights may include access, correction, and complaints to the Office of the Australian Information Commissioner. We assess overseas recipients and reasonable steps for each flow; the US location and recipient purposes are above. Nothing here reduces non-excludable consumer or privacy rights.

8. Updates and contact

We will show material changes with an effective date and request fresh affirmative acceptance where required. The app's version check prompts account holders to review and accept updated Terms and Privacy Policy before continuing. For privacy requests, appeals, processor details, or complaints, email privacy@doserly.com or write to Viking Media Labs Inc., 72 Victoria St S, Kitchener, ON N2G 4Y9, Canada. Legal notices: legal@doserly.com. General support: support@doserly.com.