Privacy and refusals

What we hold, what leaks, and what it will not do.

Your medicine list is sensitive, and what can be inferred from it is more sensitive still. Here is the architecture, including the parts that are not airtight.

Privacy

Built so we hold as little as possible

What we hold

Your shelf is encrypted with a key made on your device and held there. What our servers hold is the sealed version and nothing else. There is no copy of your key on our side.

Anything you write during a crisis stays on your device and is never used for anything else. We do not promise never to contact anyone; we publish what triggers escalation instead, because the absolute version of that promise is the one thing that cannot be honoured.

And here is what still leaks

We can see when each piece of data arrived, to the millisecond. That is our clock stamping receipt, not yours writing. We removed the column and the network still shows us the timing, so we list it rather than claim a totality we do not have.

If you have not set a passphrase, the key is held by the phone, so anything that can unlock the phone can open your data. And a key that gets out cannot be taken back, and there is no button here that undoes that. Both are on the same list, in the app, before you have entered anything.

The refusals

What it will not do

These are not limitations we are apologising for. Each one is load-bearing, and most cost us a feature we had already designed.

It will not tell you to stop a medicineStopping is not neutral, and for some the rebound is dangerous. Every finding resolves to a question for your prescriber.

It will not diagnose youYou enter what you are experiencing; it tells you which things on your shelf list that as a documented effect. Unranked, in shelf order, with the source. It never names a condition.

It will not write you a tapering scheduleThat is practising medicine, and the wrong rate causes exactly the harm this exists to prevent. You get the published guidance, cited, for someone who can supervise it.

It will not rank or compare medicinesRanking is inference about you. Everything returns alphabetically.

It will not give you a personality typeAnything that outputs a psychological read is diagnosis in friendlier clothes, and a person told they are "the anxious type" carries that into every later reading.

It will not run a streakGamifying a daily check-in punishes people for the weeks they were too unwell to open it, and those are the weeks that matter most clinically.

It will not claim a pattern it cannot supportA few weeks of days is below what an honest personal pattern analysis needs, so it says that rather than drawing you a chart.

It will not present an absence of findings as safety"Nothing on your shelf lists that" means exactly that, and the app says so rather than letting it read as reassurance.

The refusals are the product.

If a feature cannot be built without implying "consider stopping", it does not get built in that form.

Read the evidence For clinicians