Submitting a request?Email support@medtime.app with “Consumer Health Data Request” in the subject. Don’t include sensitive health details in your first message.

MedTime Consumer Health Data Policy

MedTime is operated by Sonic Wall LLC. This Consumer Health Data Policy supplements the MedTime Privacy Policy and describes how MedTime collects, uses, processes, discloses, and retains consumer health data. It also explains the rights available under applicable U.S. state consumer health privacy laws, including the Washington My Health My Data Act and Nevada's consumer health data law.

Effective date: September 8, 2026

Last updated: September 8, 2026 Privacy contact: support@medtime.app

Scope

This policy applies to consumer health data processed through:

  • The MedTime iOS and iPadOS app
  • MedTime's optional SMS alert-delivery service
  • MedTime support communications, if you choose to include consumer health data

"Consumer health data" in this policy means personal information that is linked or reasonably linkable to a person and identifies or is used to identify that person's past, present, or future physical or mental health status, as defined by applicable law.

MedTime is an organization and reminder tool, not a health care provider, health plan, medical device, or emergency or clinical-monitoring service. It does not provide medical advice, diagnosis, or treatment.

The current MedTime app does not provide an appointment scheduler or calendar import. It also does not share profiles with other MedTime users. A legacy appointment saved in an earlier MedTime version may be converted on-device into a medical-history event during migration.

Categories of consumer health data collected and how they are used

MedTime processes only the information you choose to enter, import, attach, or generate by using requested app features.

Profile and health-background information

This can include a profile name, birthday, blood type, allergies, profile photo, notes, and, for pet profiles, species and breed. MedTime uses this information to identify and organize separate records for each person or pet you manage.

Medication and treatment information

This can include medication names, alternate names, reasons for taking a medication, instructions, dosage values and units, dosage history and dates, prescriber and pharmacy associations, medication images, notes, and archived status. MedTime uses this information to maintain medication records, display dosage history, link related records, and create reminders at your direction.

Reminder and adherence information

This can include reminder schedules, frequency and repeat selections, reminder time, notification settings, critical-alert and contact-alert settings, scheduled occurrence times, snooze status, whether an occurrence was marked taken or missed, and the time a status was recorded. MedTime uses this information to schedule notifications, present today's reminders and history, and, if separately enabled, determine when to send a generic missed-reminder SMS.

Medical-history information

This can include diagnoses, symptoms, procedures, other medical events, start and end dates, status, notes, and links to related medications or care contacts. MedTime uses this information to organize and display the medical-history timeline and related records.

Care-provider, pharmacy, and insurance information

This can include names, specialties, facility names, mailing addresses, telephone numbers, email addresses, websites, insurance carrier or plan names, policy names, policy numbers, group identifiers, policyholder names, notes, and related record links. MedTime uses this information to organize care records and to let you initiate a call, open a saved address in Maps, or contact a saved destination. MedTime does not contact a provider, pharmacy, or insurer automatically.

User-selected notes, photos, and files

This can include free-form notes, profile or medication photos, insurance-card images, medical-event images, and PDFs you choose to attach. MedTime uses this information only to store, display, link, and export the records you request. MedTime does not analyze photos to create biometric identifiers and does not analyze notes or files to infer new medical diagnoses.

Optional alert-service information

If you configure or use external missed-reminder alerts, the alert service processes:

  • The alert contact's name and verified mobile number
  • Pseudonymous profile, reminder, recipient, and installation identifiers
  • Reminder frequency, repeat values, hour and minute, time-zone identifier, alert delay, and active status
  • Scheduled-occurrence, taken, snoozed, attempted, and delivery-status information
  • Limited security and abuse-prevention information, such as an Apple App Attest key identifier, public key, attestation receipt, assertion counter, app environment and bundle version, validation category, one-time security challenges, and a cryptographically hashed network-address rate-limit key

The alert service does not receive medication names, dosage values, notes, attachments, insurance information, medical-history details, profile names, or exported health reports. Telnyx receives the verified destination mobile number and the content and delivery metadata of the requested SMS. A missed-reminder SMS says only that a MedTime medication reminder was not marked taken; it does not identify the medication or dosage.

MedTime does not provide external alert delivery by email.

Support information

If you send consumer health data in a support request or diagnostic export, Sonic Wall LLC uses it only to respond to the request, investigate reliability or security, and comply with applicable law. Please do not send medication lists, insurance-card images, policy numbers, medical attachments, or other health details unless support specifically asks for information that is necessary to resolve your request.

Sources of consumer health data

MedTime obtains consumer health data from these categories of sources:

  • You or a person acting at your direction, when information is typed, selected, imported, attached, linked, corrected, exported, or deleted
  • Device features you choose to use, such as the camera, photo library, Files picker, and a contact card you select after granting permission
  • Your use of MedTime, which creates reminder occurrences, taken or missed states, timestamps, snooze states, record relationships, and other feature state
  • Your private iCloud/CloudKit database, when Apple returns records previously synced from a supported device signed in to the same Apple Account
  • An alert recipient, when that person receives and enters a verification code, replies STOP or HELP, or otherwise interacts with the optional SMS service
  • Apple platform services, for limited App Attest security signals needed to protect optional alert-service requests

MedTime does not purchase consumer health data from data brokers, advertising networks, health care providers, pharmacies, insurers, or social networks.

Purposes and manner of processing

MedTime collects, uses, and processes consumer health data only to:

  • Provide profiles, medication records, reminders, adherence history, dosage history, medical-history records, care contacts, insurance records, attachments, and related links requested by you
  • Schedule and reconcile local notifications, including notification actions to mark a reminder taken or snooze it
  • Store records locally and, when iCloud is available, sync supported records through your private CloudKit database
  • Deliver an optional generic SMS verification or missed-reminder notice to a verified mobile number
  • Let you review, correct, archive, restore, delete, import, or export records
  • Maintain security, prevent abuse, troubleshoot reliability, respond to support requests, and comply with law

MedTime processes this information through its on-device data store, Apple platform services, and, when you configure or use external SMS alerts or when a previously requested alert-service cleanup is retried, the MedTime alert-delivery service. MedTime does not use consumer health data for advertising, behavioral profiling, data brokerage, or automated medical decision-making.

Local storage and private iCloud sync

MedTime is local-first. Records open from a data store on your device. If iCloud is available, supported records sync in the background through the private CloudKit database associated with your Apple Account so they can remain available on supported devices signed in to that account.

MedTime does not use its public or shared CloudKit databases to share these profiles and does not offer invitations or profile sharing with other MedTime users. Apple processes iCloud and CloudKit data under its own terms and privacy commitments.

Categories of consumer health data disclosed and recipients

MedTime may disclose the following categories of information only as needed for a feature you request:

  • Apple Inc. may process the categories of app records you choose to store and sync through your private CloudKit database. Apple may also process limited device, notification, StoreKit, and App Attest information needed to provide and secure Apple platform services.
  • Cloudflare, Inc. hosts the optional alert-delivery service and its operational database. It processes the limited alert-service and security information described above. The recipient mobile number is encrypted before it is stored in the alert-service database, and verification codes are stored in non-reversible form.
  • Telnyx LLC receives the recipient mobile number, generic verification or missed-reminder message content, and delivery-related metadata needed to send an SMS. It does not receive the medication name, dosage, notes, attachments, insurance information, or medical-history details from MedTime.
  • Recipients and apps or services you select may receive the specific records, images, PDFs, or reports you deliberately export through an Apple share sheet or another system destination. MedTime does not choose the recipient or automatically transmit those exports.
  • Government authorities or other recipients required by law may receive only information that Sonic Wall LLC is legally required to disclose. Sonic Wall LLC will evaluate and respond to legal requests consistent with applicable law.
  • A successor in a business transaction may receive applicable information if Sonic Wall LLC is involved in a merger, acquisition, bankruptcy, reorganization, or sale of assets. Any successor must assume applicable consumer health data obligations.

Sonic Wall LLC does not have any affiliate with which it shares consumer health data. Service providers are permitted to process information only for the requested service and related security, reliability, and legal-compliance purposes.

The term "disclose" above is used for transparency and does not concede that every service-provider or consumer-directed transfer is legally defined as a "share" under every state law.

No sale, advertising, cross-context collection, or geofencing

MedTime does not sell consumer health data for money or other valuable consideration. It does not condition access on authorization to sell consumer health data.

MedTime does not include third-party advertising SDKs or behavioral-advertising tracking. It does not permit a third party to collect consumer health data over time across MedTime and unrelated websites or online services for profiling or advertising.

MedTime does not collect precise geolocation information for health-related purposes and does not implement geofences around health care facilities or other health-service locations to identify or track people, collect consumer health data, or send health-related messages or advertisements. Tapping an address you saved can open Apple Maps at your direction; MedTime does not receive your current location from that action.

Consent and how to withdraw it

MedTime processes consumer health data when you request the corresponding feature—for example, by entering a record, selecting an attachment, enabling iCloud on your device, or separately setting up and verifying an SMS alert contact. Where applicable law requires consent, MedTime will request affirmative consent before collecting or sharing the relevant additional category of consumer health data or using it for an additional purpose.

You can withdraw consent for future processing or disclosure by:

  • Deleting the relevant record or all MedTime data using in-app controls
  • Turning off MedTime's iCloud access in Apple device settings and deleting synced records through the available app or Apple controls
  • Disabling external contact alerts, removing the alert contact, or replying STOP to an SMS
  • Revoking camera, photo, contact, or notification permission in Apple device settings
  • Submitting a consumer health data request as described below

Withdrawing consent does not affect processing that occurred before withdrawal. Some features may no longer function when the information needed to provide them is removed.

Retention and deletion

MedTime applies these retention practices:

  • App records: Records remain in the on-device store and, when enabled, your private CloudKit database until you delete them. Supported records moved to Recently Deleted remain recoverable for up to 30 days unless you permanently delete them sooner. Deletions sync through CloudKit subject to network availability and Apple's iCloud behavior. Deleting the app alone does not necessarily delete data already synced to iCloud.
  • Active alert settings: A verified alert contact and active reminder schedule remain in the alert service until you remove or disable them. Removing an alert contact requests deletion of its contact and associated schedule records from the active service. If the service is unavailable, MedTime stores only an opaque cleanup identifier in durable device and private iCloud key-value storage and retries automatically. Residual delivery and completion records age out under the periods below.
  • Short-lived alert-service records: App Attest challenges expire after five minutes; rate-limit records are retained for about two hours; expired unverified contact enrollments and stale snooze or retry records are scheduled for deletion after about two days.
  • Inactive schedules: Disabled reminder-escalation records are scheduled for deletion after 30 days.
  • Delivery and completion history: Final delivery-attempt records and generic completed-occurrence signals are scheduled for deletion after 90 days.
  • App Attest security keys: A security key remains while needed to protect an associated alert contact or reminder schedule. An unassociated key that has not been updated is scheduled for deletion after 90 days.
  • Support and legal records: Support correspondence, privacy-request records, and related security information are retained only as reasonably necessary to resolve the matter, document compliance, protect the service, or meet legal obligations, then deleted or de-identified when no longer needed.

When Sonic Wall LLC authenticates a valid deletion request, it will delete covered consumer health data from systems it controls and notify applicable processors or other recipients as required by law. Deletion from archived or backup systems may be delayed only as permitted by applicable law and as necessary to restore those systems—no more than six months for a request governed by Washington law or two years for a request governed by Nevada law. Data awaiting deletion from a backup is not restored for ordinary use.

Your consumer health data rights

Depending on where you live and applicable law, you may have the right to:

  • Confirm whether MedTime is collecting, using, sharing, or selling consumer health data concerning you
  • Access consumer health data concerning you
  • Receive a list of third parties and affiliates with whom consumer health data concerning you was shared or sold and, where required, a way to contact them
  • Review and correct consumer health data concerning you
  • Withdraw consent and ask MedTime to stop future collection or sharing
  • Delete consumer health data concerning you
  • Appeal a refusal to act on a request
  • Exercise these rights without unlawful discrimination

MedTime does not sell consumer health data, so a request to stop sale will confirm that practice.

You can review, edit, export, and delete much of your information directly in MedTime. Using those controls is usually the fastest way to act on locally stored and private iCloud-synced records.

How to submit a request

Email support@medtime.app with the subject Consumer Health Data Request. State the right you want to exercise and the state where you reside. Do not include medication names, diagnoses, full insurance identifiers, attachments, passwords, App Store receipts, or SMS verification codes in the initial email.

MedTime does not require you to create a new account to make a request. Because MedTime has no separate user account and local or private CloudKit records are not indexed by your support email address, Sonic Wall LLC may ask for limited additional information or an in-app step reasonably necessary to authenticate you and connect the request to the correct data. If the request cannot be authenticated using commercially reasonable efforts, Sonic Wall LLC may ask for additional information or may be unable to act on the request.

Where applicable law permits an authorized agent to submit a request, the agent may use the same email process. Sonic Wall LLC may require proof of the agent's authority and may verify the consumer's identity directly.

Sonic Wall LLC will respond without undue delay and within 45 days as required by applicable law. When reasonably necessary and legally permitted, it may extend the response period once by up to 45 additional days and will explain the extension during the initial response period. Responses are free at least twice per year. MedTime may charge a reasonable fee or decline requests that applicable law permits it to treat as manifestly unfounded, excessive, or repetitive.

Appeals

If Sonic Wall LLC refuses to act on your request, you may appeal within a reasonable period after the decision by emailing support@medtime.app with the subject Consumer Health Data Appeal. Include the request reference number, if one was provided, and explain why you believe the decision should be reconsidered. Do not include additional health details unless requested.

Sonic Wall LLC will respond to an appeal in writing within 45 days and explain the action taken or the reasons for denying the appeal. If an appeal is denied, eligible consumers may contact the Washington State Attorney General or the Nevada Attorney General, as applicable.

Security

Sonic Wall LLC limits access to consumer health data to people and service providers for whom access is reasonably necessary to provide a requested service, protect it, or comply with law. MedTime uses reasonable administrative, technical, and organizational safeguards appropriate to the nature and volume of the information. These include private CloudKit storage, encryption of alert destinations at rest in the alert service, non-reversible storage of verification codes, request rate limiting, and Apple App Attest protections for alert-service requests on supported physical devices. No storage or transmission method can be guaranteed completely secure.

Information about another person

MedTime can organize separate profiles for people or pets. If you enter consumer health data about another person, you should have that person's authorization or other lawful authority to do so. MedTime does not use these profiles to share data with another MedTime user.

Changes to this policy

Sonic Wall LLC may update this policy to reflect changes in MedTime, service providers, or legal requirements. Material changes will be posted on this page with a new "Last updated" date and, when appropriate, communicated in the app or through another reasonable channel. When applicable law requires affirmative consent before MedTime processes a new category of consumer health data, uses data for a new purpose, or discloses data to a new category of recipient, MedTime will request that consent before the new processing begins.

Contact

Sonic Wall LLC

Attn: Privacy support@medtime.app

For general privacy practices that are not specific to consumer health data, review the MedTime Privacy Policy.