Important: core mobile features may be used without signing in. Cloud synchronisation is optional.
1. Controller and contact
MediBox is operated by Andrius Grudinskas. For privacy requests, email info@medibox.lt.
2. Data we may process
- Account details such as name, email address, provider identifiers and technical user ID.
- Family and health information you choose to enter, including profiles, medicines, allergies, conditions, intake history, reminders and appointments.
- Notes, doctor or facility details and appointment reasons.
- Security, device and support-request information needed to operate and protect the service.
- Subscription status, Stripe customer identifiers and legally required payment records. MediBox does not store full card details.
3. Purposes and legal basis
Data is processed to provide the service and perform your agreement, synchronise authorised devices, administer subscriptions, keep the service secure and answer requests. Where required, processing is based on consent or a legal obligation. Health information is not used for advertising.
4. AI features
AI may organise public medicine-leaflet information into a draft. Personal or family health data should not be required for this operation. Suggested content is shown for your review before saving.
5. Service providers and transfers
Google Firebase provides account, synchronisation and security infrastructure. Google and Apple may provide sign-in. Stripe processes payments and subscriptions. Interneto vizija provides website hosting. Providers process only the data needed for their service under their own terms and applicable data-processing safeguards.
Where infrastructure is outside the European Economic Area, an applicable lawful transfer mechanism is used, such as European Commission Standard Contractual Clauses or another recognised safeguard.
6. Retention and security
Local data remains on your device until removed. Cloud data is retained while the account or relevant record is active. Payment and accounting records may be retained where law requires it. Deleted data may remain in protected backups for a limited technical period until backups are overwritten. Access controls and encrypted transfer are used, but no system can promise absolute security.
7. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing. Export data or delete the account in the MediBox account Data section, or contact info@medibox.lt. You may also complain to the Lithuanian State Data Protection Inspectorate.
8. Children and family members
A responsible adult must have the right to add and manage information about a family member, including a child. MediBox is not intended for a child to create an independent account without appropriate adult supervision.
9. Website cookies
MediBox does not use advertising or behavioural-tracking cookies. Essential technical cookies may be used for administration, security and forms.
10. Updates
This policy may change when features or legal requirements change. The latest version is published here.