Dosewise
Privacy policy
Dosewise is built so that we can't see your medications or doses. There are no accounts, ads, analytics, or trackers. What syncs is encrypted on your device with a key our server never receives.
What stays on your devices
Everything you enter: names, medications, schedules, doses taken or skipped, supply counts, and notes. It's stored on each phone or browser that's part of your care circle, and it's readable only there.
How syncing works
Each care circle has a random key, created on the device that started it. Every change is encrypted with that key (AES-256-GCM) before it leaves the device. The key travels only inside invite links and computer link codes, in the part of the link after the "#", which browsers never send to any server.
Anyone who has your invite link can open your care circle. Share it only with people you trust, the way you would a house key.
What our server stores
- Encrypted changes, each with a random ID, the order it arrived in, and when it arrived. We can't decrypt them.
- A one-way hash (SHA-256) of an access code derived from your key, so only devices with the key can read or add changes.
- When you link a computer, a one-time encrypted package for that computer. It's deleted as soon as the computer picks it up, or after 10 minutes.
We don't store names, email addresses, phone numbers, contacts, or location, because we never ask for them.
IP addresses and our host
Dosewise runs on Cloudflare, which handles every request to dosewise.cloud. To stop abuse, our server counts how often an IP address creates a care circle or links a computer. Those counts are deleted within an hour. We've turned off request logging and Cloudflare's analytics. Cloudflare processes network data to deliver and protect traffic under its own privacy policy.
Health information
Medication data is sensitive, so Dosewise treats all of it as private. Reminders and missed-dose alerts are scheduled on your phone, not by our server. Dosewise isn't a healthcare provider, and we don't share your data with insurers, advertisers, data brokers, or anyone else.
Looking up a medication
When you search for a medication by name, or check for interactions, the medication names are sent to our server. Our server looks them up in public U.S. government drug databases (the National Library of Medicine's RxNorm and the FDA's drug labels) on your behalf. The lookup doesn't include your key, your care circle, or anything about you. We don't log it, and the government services see only our server, not you. Their public answers are cached for a day, keyed only by medication name. Searching is optional: you can always type a medication in yourself.
Backups and recovery
Every care circle syncs from the moment it's created, encrypted as described above, so you can get it back if a device is lost, reset, or the app is deleted. There are three ways back, and none of them lets us, Google, or Apple read your medications:
- Your recovery link. It's the circle's invite link, saved by you, for example in a password manager. Anyone with it can open the circle.
- Android's backup. On Android, the app's data, including the circle keys, is included in Android's backup to your Google account only when that backup is encrypted with your phone's screen lock, so Google can't read it.
- iCloud Keychain. On iPhone, the circle keys are kept in iCloud Keychain, which Apple encrypts end to end. Your medications themselves come back from our server, still encrypted.
Deleting your data
- From a device: delete the app, or choose "Unlink this computer" in the web app's Settings.
- From our server: choose "Delete from the server" in the web app's Settings. This erases every encrypted change and the access hash for everyone in the care circle. Only a marker remains so the same ID can't be reused. Devices keep their own copies until you remove them.
Sharing and selling
We don't sell or share your data, and we couldn't read it if we wanted to. If we're legally required to hand over what we store, all we have is encrypted data we can't decrypt.
Children
Dosewise isn't directed at children under 13, and we don't knowingly collect personal information from anyone.
Changes
If this policy changes, we'll update this page and the effective date above. If a change affects what leaves your device, we'll also say so in the app.
Contact
Questions? Email support@dosewise.cloud.