Kidiaro Privacy Policy
Version: 0.1-beta Effective date: 4 November 2026
1. Who we are
Kidiaro is published by BTG LABS SRL, a company registered in Romania (CUI RO36057423, Trade Register no. J12/6312/2021), with its registered office at Colonia Sopor 11A, 400482 Cluj-Napoca, Cluj, Romania. BTG Labs decides why and how your data is used. In data protection terms it is the "controller".
Privacy contact: [email protected]. This policy is published at https://kidiaro.app/privacy. Data protection officer: none appointed.
2. The short version
- Kidiaro works on your phone with no account and no internet. Without an account, your child's information stays on your phone.
- To share with the other parent, to have your record again when you change phone, or to start a trial or buy a plan, you create an account with your email address. From then on we keep a copy of your family's record on our server, so every phone you sign in on shows the same record. The server can read this copy; it is not end-to-end encrypted.
- Photos (rash photos and your child's profile photo) stay on your phone. They are never sent to our server.
- We do not sell data, show ads, run analytics or use your child's information for research. The app has no crash-reporting or advertising component.
- Kidiaro records what you enter and reminds you. It does not calculate doses, check doses or give medical advice. Follow your doctor's or pharmacist's instructions.
3. What we collect
On your phone (always). What you enter, stored in the app's private database:
- for each child: given name, optional family name, birth date, gender, a colour, and an optional profile photo;
- medicines (name, form, strength as you type it), the schedule you set (dose, unit, times, time zone, your own limit of doses in 24 hours, notes), and the log of doses given or skipped (time, dose, who gave it, whether it was early or over your own limit, note);
- temperatures, drinks, symptoms (with the severity you choose and notes), sick days (episodes when the child was unwell), weight, height and head size, allergies, conditions, and optional rash photos;
- the details of the parents or guardians you enter (name, relationship, optional email), and your own first name and role;
- your settings: language, reminder and notification choices (including whether the lock screen may show names), and the follow-up reminders you ask for;
- a random identifier of the phone (a device id), used to tell phones apart when you share.
Free-text fields (notes, medicine names, symptom words) can hold anything you type. Please do not type more than you want to keep.
On our server, only if you create an account. From sign-up, a copy of the same information, except photos, settings and local reminders, and with who logged each entry (the name you gave and the device id). Also:
- your email address, and a sign-in session (a secret token, its creation and expiry time; it lasts 180 days and is renewed as you use the app). We do not keep your network address or your phone model with the session. The name field of the account is left empty;
- the sign-in code while it is valid (10 minutes, stored in scrambled form);
- a record of your consent: which text you agreed to (a fingerprint of it), its version, language and the app version, when you agreed and, if so, when you withdrew;
- your phones: the device id, when it was first seen and when it last connected;
- which family you belong to and your role in it (owner or guardian), and invitations you create (we keep only a scrambled form of the invite link, its expiry and whether it was used);
- a record that a child was removed (the child's id and the time, no health information);
- a record of an account deletion request (account id, time, language, status, deadline, and when and by whom it was completed);
- counters used to limit abuse, kept under scrambled keys (no readable network address or email);
- a technical request log: method, path with identifiers hidden, result and duration. It contains no request content and no health information.
Other parties:
- Sign-in codes, and the emails that tell you an account deletion was requested and completed, are sent by email through Resend. Resend sees your email address, the message and delivery details. The messages contain no name and no health information.
- Subscriptions: the app includes RevenueCat's software. It may contact RevenueCat, even if you have no account, to read the status of a purchase made in the App Store or Google Play. RevenueCat gets a random identifier (after you sign in, this is your Kidiaro account id, a random code, not your email), your subscription state, the type of device and, as with any internet service, your network address. Apple and Google handle your payment as independent controllers under their own terms. None of them receives health information.
- Hosting: our server and database run at the hosting provider named in section 6, which stores everything held on the server, including backups.
Reminders are made by your phone and need no internet. We use no push-notification service, so no notification content passes through any server.
We do not collect a national identification number (CNP), your location or your contacts. The app contains no analytics, advertising or crash-reporting tools.
4. Why we use it, and on what basis
| What | Why | Legal basis |
|---|---|---|
| Your child's health information on your phone | Reminders, dose log, history, report for the doctor | Without an account this information stays on your phone. BTG Labs does not receive or process it; you use the app for your own family |
| The same information on our server | Keep your record across phones; show both parents the same record | Your explicit consent (Art. 6(1)(a), 9(2)(a) GDPR), given on its own screen when you create the account. You give it as the parent or guardian, for your own information and your child's |
| Account and sign-in, emails about them | Let you sign in, share and restore | Contract (Art. 6(1)(b)) |
| Consent record | Prove what you agreed to | Legal duty to demonstrate consent (Art. 7(1)) |
| Technical logs and rate limits | Security, fixing faults, preventing abuse | Legitimate interest (Art. 6(1)(f)) |
| Subscription | Check your plan | Contract |
You do not need an account to use the free version. If you do not agree to the account consent, no account is created and nothing is sent to us.
5. Sharing with the other parent, leaving and signing out
You invite the other parent with a link. The link works once, expires after 48 hours, and you can cancel it. A family has two parents. Each parent sees every child, medicine and dose in the family, and who logged it. If both parents log the same dose, both entries are kept.
If a parent leaves or withdraws consent, sync stops on their phone and they keep the copy already on it. The shared record stays on the server for the parent who remains. Their email address is removed from the guardian entries they wrote, but the name on doses they logged stays, as part of the child's care record. Their account (email address) remains until they delete it. If the last parent leaves, the shared record is erased from the server.
If you sign out, the record is cleared from that phone, including photos, which cannot be brought back. The record stays in your account and returns when you sign in again. Changes not yet sent to the server are lost if you sign out before they are sent; the app warns you.
6. Where it is kept, and who receives it
Server data is kept on Microsoft Azure in the European Union, in Germany West Central (Frankfurt, Germany). Microsoft is a processor acting on our instructions, under Microsoft's Data Protection Addendum. Your data stays in the EU (Microsoft EU Data Boundary). Because Microsoft's parent company is in the United States, any access from outside the EU is covered by the EU Standard Contractual Clauses in Microsoft's Data Protection Addendum and by the EU-US Data Privacy Framework.
| Who | What they receive | Where |
|---|---|---|
| Microsoft Azure (hosting) | everything on the server, including backups | Germany West Central (Frankfurt, Germany) |
| Resend (email) | your email address and the content of the emails we send you | EU sending region (Ireland). Resend is a processor under its data processing agreement; as a US company, transfers are covered by Standard Contractual Clauses (and the Data Privacy Framework where applicable) |
| RevenueCat | random identifier or account id, subscription state, device type, network address; no health information | United States. RevenueCat is a processor under its data processing agreement; transfers are covered by Standard Contractual Clauses / the Data Privacy Framework |
| Apple App Store, Google Play | purchase and payment data, under their own terms | their own terms |
| The other parent in your family | everything in the family record, including who logged each dose | their phone |
| Authorities | only where the law requires |
If you export your records or copy the record for a doctor, you choose where it goes.
We do not sell data.
7. How long we keep it
- On your phone: until you delete it (a child, an entry, or everything through Delete account), or until you sign out of an account.
- On our server: while your account exists, until you remove the child, the family is erased (the last parent leaves) or you delete your account.
- An entry you delete (a dose, a medicine, a note): it is marked as deleted and stays on the server, with its content, for up to 90 days so that your other phone and the other parent can catch up, and is then removed by a daily job. Removing a whole child erases that child's records from the server at once.
- Account deletion: see section 8.
- Server logs: 30 days.
- Backups: data you delete is removed from backups within 30 days.
- Account deletion requests: a record without health information (account id, times, language, status) is kept for 3 years after the deletion, to show we acted, and is then deleted automatically. The consent records (which version you agreed to and when, and whether you withdrew it; no health information) are kept for the same 3 years after your account is deleted, and are then deleted automatically.
- RevenueCat: the customer record is deleted together with your Kidiaro account: when the account deletion completes, Kidiaro asks RevenueCat to delete it. Purchase records kept by Apple and Google are under their own policies.
8. Your rights
You can, in the app: export your child's data (Settings > Data, a PDF and a FHIR file, free, works offline); copy the record as text for the doctor (Show to doctor); correct data by editing; remove a child; stop sharing; sign out; delete your account.
You can also write to [email protected] to ask for access, correction, deletion, restriction, objection or portability. We answer within one month.
Deleting your account. When you ask for deletion in the app, you are signed out at once. Records on the phone are hidden for 7 days and then erased (or erased at once if you tick that option, which cannot be undone). On the server, a daily job deletes your account and your data after 7 days, and in any case within 30 days at the latest. During the 7 days you can cancel by opening the app. We send you an email with the date and another when it is done. If you share with another parent, they keep the shared record and your name stays on the doses you logged; if you are the only parent, the family record is erased. If your trial or plan has ended you can also choose Delete data, which deletes your account at once and cannot be undone.
You can withdraw consent at any time. This does not affect what happened before. You can complain to the Romanian authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro, or to the authority in your own country.
9. Security
Connections to our server use encryption (TLS). Each family can reach only its own data. The sign-in token is kept in your phone's secure storage (Keychain on iPhone, Keystore on Android). Sign-in codes are valid for 10 minutes, are stored scrambled and are limited to five tries. We keep health information out of logs. By default, reminders show the child's first name and the medicine on a phone that is unlocked; on a phone locked with a PIN, pattern or fingerprint they show only "Medicine due", where the phone allows it. On a phone with no screen lock, anyone holding it can read them. You can switch names off in Settings > Notifications, and reminders then always show only "Medicine due". When you tap Copy record on the Show to doctor screen, the text goes to your phone's clipboard, where other apps may be able to read it; the app tries to clear the clipboard after 2 minutes, when it still holds that text (this can be later, or not happen, if the app is closed or the phone blocks it). The server can read the data you keep in your account. No system is completely secure; if a breach affects you we will tell you and the authority as the law requires.
10. Children
Kidiaro is for parents and guardians, not for children. Children do not use the app or create accounts. A parent or guardian enters the child's information and consents as the child's parent or guardian.
11. Changes
When this policy or the consent text changes in a way that matters, we show the new version and ask you again before sync continues. The date of the latest version is at the top.