Privacy policy
Last updated: 24 October 2026
This policy explains what information the Hoidio app handles, why, where it is stored and what rights you have. We have written it in plain language. If anything is unclear, email support@hoidio.com.
1. Who is responsible
The data controller is Laryngology Courses Oy (Business ID 3421195-7), Espoo, Finland. Contact for all privacy matters: support@hoidio.com.
2. The short version
- You can use Hoidio without an account. Then everything you enter stays only on your phone.
- If you sign in, your information is also saved in our database in the EU (Frankfurt, Germany) so it is backed up and can be shared with caregivers you choose.
- Only you and the caregivers you invite can see your information.
- There are no ads, no tracking or analytics, and we never sell your information.
3. What information we handle
Information you enter in the app
Medicines (name, strength, dose, times, instructions, purpose, prescriber, storage place, and from a scanned box: barcode, expiry date, batch and pack size), doses marked as taken, refill dates and prescription details, doctor visits, side effects, symptoms and allergies, measurements (blood pressure, pulse, blood sugar, weight, pain score), water intake, daily “I'm OK” check-ins, emergency contacts (name, relationship, phone number) and your app settings.
Much of this is health information, which the law treats as a special category of personal data. We handle it only to provide the app to you.
Account information (only if you sign in)
Your email address, the name you choose to show, your phone's time zone and language, and a technical notification address (push token) so that reminders and alerts can reach your phone. If you sign in with Google, Apple or Facebook, that service tells us your email address; we do not receive your password.
Caregiver information
When you invite a caregiver, we store the link between your accounts, the access level you chose (everything, or the medicine schedule only), the order in which caregivers are alerted, and a short log of alerts already sent so they are not repeated. Invite codes expire after 48 hours.
Information we do not collect
We do not collect your location, contacts list, photos or browsing activity. The camera is used only to read the code on a medicine box; no photos are taken or saved.
4. Why we use it and our legal basis
| Purpose | Legal basis (EU GDPR) |
|---|---|
| Showing your medicines, schedule and records, and sending your reminders | Providing the service you asked for (Art. 6(1)(b)); for health information, your explicit consent (Art. 9(2)(a)) |
| Saving a backup in the cloud when you sign in | Providing the service (Art. 6(1)(b)); explicit consent for health information (Art. 9(2)(a)) |
| Sharing with caregivers you invite, and alerting them about missed doses, missed check-ins, and daily, weekly or monthly summaries | Your explicit consent (Art. 9(2)(a)), given when you create an invite. You can remove a caregiver at any time. |
| Sending sign-in codes by email | Providing the service (Art. 6(1)(b)) |
| Answering your support requests | Our legitimate interest in helping you (Art. 6(1)(f)) |
You can withdraw your consent at any time by removing caregivers, signing out, or asking us to delete your account. Withdrawing consent does not affect what was done before.
5. Who else handles your information
We use a small number of service providers who process information only on our instructions:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in (only if you sign in) | EU – Frankfurt, Germany |
| Resend | Sending sign-in code emails | EU – Ireland |
| Expo (650 Industries, Inc.) | Delivering push notifications to caregivers' phones | United States |
| Apple and Google | Delivering notifications to iPhone and Android phones | Global |
A caregiver notification contains short alert text. A missed-dose alert includes your name, the medicine's name and dose, and the scheduled time; a missed check-in alert includes your name and check-in time; a summary includes your name and the number of doses taken and check-ins (and, for caregivers with full access, the number of side effects logged). This text passes through Expo and Apple or Google on its way to the caregiver's phone. When information is transferred outside the EU, we rely on the EU Standard Contractual Clauses.
Looking up a medicine box online: only if you tap “Find the name online” after scanning, the app sends the barcode number (nothing else) to the public Open Food Facts and Open Products Facts databases to find the product name.
Your reminders on your own phone are created by the phone itself and do not pass through our servers.
6. How long we keep it
- Without an account: on your phone until you delete it in the app or uninstall the app.
- With an account: as long as you have the account. When you ask us to delete your account, we delete your information from our database within 30 days. Backups held by our database provider are cleared on their normal cycle.
- Support emails: up to 2 years after the matter is closed.
7. Your rights
You have the right to:
- see the information we hold about you and get a copy of it,
- correct it (most information you can edit directly in the app),
- have it deleted,
- restrict or object to its use,
- receive it in a machine-readable format (data portability),
- withdraw your consent at any time.
To use these rights, or to delete your account, email support@hoidio.com from the email address of your account. We answer within one month.
You can also complain to the Finnish data protection authority, the Office of the Data Protection Ombudsman (tietosuoja.fi), or to the authority in your own EU country.
8. Security
Information is sent over encrypted connections. In our database, access rules ensure that your record can be read only by you and the caregivers you invited, and changed only by you. Sign-in uses one-time codes, so there is no password to steal.
9. Children
Hoidio is meant for adults. We do not knowingly collect information from children under 16 without a parent's or guardian's consent.
10. Not medical advice
Hoidio helps you organize your health information. It does not give medical advice and does not replace your doctor or pharmacist.
11. Changes to this policy
If we change this policy, we will update the date at the top. If the change is significant, we will also tell you in the app.