Privacy Policy

2.1 Account data

• Email address — used for login, reminders, and system notifications
• Password — stored only as a bcrypt hash (cost factor 12). We never store or see your actual password.
• Email verification status and timestamp
• Account creation date

2.2 Health and medication data

• Medication names and dosages you enter
• Known drug allergies you declare
• Medical conditions you optionally enter (e.g. diabetes, hypertension)
• Patient profile names (typically first names or initials)
• Medication reminder schedules you configure

This is your most sensitive data. We treat it accordingly — see Section 5 for security details.

2.3 AI interaction data

• Questions you ask the AI medication assistant
• Drug names from your profile (sent as context to AI providers)
• AI response quality feedback (thumbs up/down)

Your name, email, and account identity are never sent to AI providers. Only drug names and your questions are sent.

2.4 Technical and usage data

• IP address (used for rate limiting and security)
• Device type and browser (inferred from User-Agent header)
• Pages visited and features used (anonymized, via PostHog)
• Request timestamps
• Error reports (personal health information scrubbed before transmission to Sentry)

2.5 Audit log data

Every action on patient data is recorded in a tamper-evident audit log including: who performed the action, which profile was accessed, what action was taken, the outcome, and the timestamp. This is a security and compliance requirement, not optional. Audit logs are retained in pseudonymized form even after account deletion.

Users you authorize

If you share a profile, users you invite can see the medication list and health information on that profile, according to the role you assign them. You control this and can revoke access at any time.

AI providers — Groq and Google Gemini

Your questions to the AI assistant and drug names from your profile are sent to these providers to generate responses. Your name, email address, and account identity are not included. These providers have their own privacy policies and data processing terms.

NeonDB — database infrastructure

Your patient data (medications, allergies, profiles) is stored on NeonDB's PostgreSQL infrastructure, hosted on AWS in the United States. NeonDB handles data with encryption at rest and in transit.

Resend — email delivery

Your email address and the content of reminders and system notifications are sent to Resend for delivery.

Sentry — error monitoring

Technical error reports are sent to Sentry to help us fix bugs. Personal health information (medication names, allergies, medical conditions) is scrubbed from these reports before transmission using a PHI scrubbing layer.

PostHog — usage analytics

Anonymized usage events (e.g. "interaction check run", "reminder set") are sent to PostHog. No personal health data is included in these events. These help us understand which features are useful.

Law enforcement

We will disclose your data to law enforcement or regulatory authorities only when required by applicable law, court order, or when we believe in good faith that disclosure is necessary to protect our legal rights, protect your safety or the safety of others, or prevent fraud.

Password security

Passwords are hashed with bcrypt (cost factor 12) before storage. The original password is never stored or transmitted after the initial set. Password reset tokens are single-use and expire after 30 minutes.

Session management

JWT access tokens expire after 30 minutes. Refresh tokens expire after 7 days. All sessions are validated server-side via Redis on every request — logging out actually invalidates your session, not just deletes a cookie. Sessions are revoked across all devices when you change your password or log out from all devices.

Access control

Every request that accesses patient data verifies that the requesting user has permission for that specific patient's data (IDOR prevention). Role-based access control limits what caregivers and viewers can do. Rate limiting prevents brute force attacks.

Encryption

All data in transit is encrypted via HTTPS/TLS. Data at rest is encrypted by NeonDB (AES-256). Redis session data uses password authentication.

PHI protection in logs

Before any error or event data leaves our servers to monitoring providers, it passes through a PHI scrubbing layer that removes medication names, allergy information, and medical conditions from log entries.

Audit trail

Every create, read, update, or delete operation on patient data is recorded in a tamper-evident audit log with user ID, profile ID, action type, outcome, IP address, and timestamp. This log cannot be deleted by users.

Input security

User input is sanitized before being sent to AI providers (prompt injection defense). AI responses are HTML-stripped before being returned to users (XSS prevention). SQL injection is prevented by using parameterized queries throughout.

Right to access

You can view all your data at any time from your dashboard. To request a data export, email privacy@pillara.site and we will provide it within 30 days.

Right to deletion (right to erasure)

You can permanently delete your account from Settings → Account → Delete Account. This deletes your user account, all profiles you own, all medications, all reminders, and all notifications. Audit logs are retained in pseudonymized form (the UUID points to no personal data after deletion). This is compliant with NDPR.

Right to correction

You can update your profile, medications, allergies, and account details at any time from the dashboard.

Right to object

You can stop using the service and delete your account at any time. To object to specific processing activities, contact privacy@pillara.site.

Right to data portability

Contact privacy@pillara.site to request your data in a machine-readable format.