The short version
Your health data is yours. We collect only what's needed to run the app. We store it securely with row-level isolation. We never sell it, share it, or use it for advertising. You can delete everything at any time by emailing support@preptrackr.app.
The sections below explain each point in detail. If something isn't clear, email us.
1. Who we are
PrEP Trackr is a personal health tracking app for people on PrEP (pre-exposure prophylaxis). It is operated by an individual based in Québec, Canada, as a non-commercial project. You can reach us at support@preptrackr.app.
Person responsible for the protection of personal information (as required by Québec's Act respecting the protection of personal information in the private sector, "Law 25"): Jade, operator of PrEP Trackr — support@preptrackr.app. This person handles all requests about your personal information and any privacy complaint.
2. What data we collect
We collect only the data required to operate the app and provide the features you use.
| Data type | Why we collect it |
|---|---|
| Email address and name | To create and authenticate your account. |
| Dose logs | Timestamps of when you log a PrEP dose. Optional: photos of your pill and notes you add. |
| Testing records | HIV and STI test dates and results that you choose to enter. |
| Lab results | Values you enter (e.g. CD4, viral load, kidney function markers) and any lab report files you attach. |
| Side effects journal | Side effects and notes you choose to record. |
| Sexual activity type | If you set it, the type of sex you selected (anal, vaginal or both). Used only to pick which CDC build-up timeline the coverage estimate uses. |
| On-demand (2-1-1) course data | If you log a 2-1-1 course: the course start time, the number of pills logged per day, and the date of your most recent sex in that course (needed to time the follow-up doses). |
| App settings | Reminder times, notification preferences, PrEP type, dosing regimen (daily or on-demand), pause status, pill supply count, and the date and version of the Terms you accepted. |
| Country and device platform | The country you select in your profile (optional) and a coarse platform label (e.g. iOS, Android, Windows) derived from your browser. Used for aggregate usage statistics only. |
| Activity metadata | Account creation date, the date you were last active, and a count of which app tabs you open. Used to understand which features are used and to keep the service running. |
| Feature requests | Ideas, votes and comments you post in the Ideas tab. These are visible to other users under the name on your profile. |
| Push notification token | A browser-issued token that allows us to send dose reminders to your device. Stored per device. Deleted when you unsubscribe. |
| Session data | An authentication token stored in your browser to keep you signed in. This is a standard session cookie and is not used for tracking. |
We do not collect: precise location data, contacts, browsing history, advertising identifiers, or any health data beyond what you explicitly enter into the app.
Consent. The data you enter is sensitive health information. By creating an account and acknowledging the in-app notice, you give explicit consent for us to store and process it for the sole purpose of providing the app's features to you. You can withdraw that consent at any time by deleting your account.
3. How your data is stored and secured
PrEP Trackr uses Supabase as its backend database, hosted on AWS infrastructure in the United States. Your personal information is therefore stored and processed outside Québec and outside Canada. Before choosing this arrangement we assessed the privacy risks of that transfer, taking into account the sensitivity of the information, the purposes for which it is used, the protection measures in place, and the legal framework of the United States. We concluded that the information receives adequate protection through the technical and contractual safeguards described in this policy. You can request a summary of that assessment at any time. All data is stored with row-level security (RLS) enabled — meaning database rules enforce that your records can only be read or written by your own authenticated account. No other user can access your data.
Operator access. PrEP Trackr is run by a single operator. To keep the service running and respond to support requests, the operator has an admin view showing account details (name, email, sign-up date, last-active date, platform, country) and aggregate activity, including whether doses and tests have been logged. The operator does not read your notes, photos, lab values, test results or side-effects entries as part of routine operation, and only looks at individual records when you ask for help with them or when required by law.
All data is transmitted over HTTPS (TLS). Passwords are never stored in plain text — authentication is handled by Supabase Auth, which uses bcrypt hashing.
Photos you attach to dose logs are stored in Supabase Storage, also scoped to your account with access controls.
4. What we never do with your data
- We do not sell your data. Ever. To anyone.
- We do not share your data with advertisers, data brokers, insurance companies, employers, or any third party.
- We do not use your health data for advertising or to build profiles for marketing.
- We do not use third-party analytics trackers (such as Google Analytics, Meta Pixel, etc.) that would expose your data to other companies.
- We do not connect to your clinic, pharmacy, or health system. Your app records are entirely separate from any medical records.
- We are not a HIPAA covered entity. HIPAA does not apply to this app. We protect your data under this policy and applicable consumer health-data and privacy laws instead.
5. Push notifications
If you enable dose reminders, your browser creates a push subscription token and we store it in the database. This token is used exclusively to send you notifications you've requested. We do not use it to track usage or send unsolicited messages. You can unsubscribe at any time in the app's settings, which deletes the token from our database.
6. Third-party services
We use a small number of third-party services to operate the app:
- Supabase (database and auth) — Privacy policy
- Vercel (web hosting) — Privacy policy
- Cloudflare Turnstile (bot protection on signup form) — uses no user data for profiling; Privacy policy
- Migadu (email delivery, Switzerland) — sends account emails such as sign-up confirmations and password-reset links; receives only your email address and the message itself; Privacy policy
No other third-party services receive your health data or personal information.
7. Your rights and choices
- Access: You can view all your data in the app at any time.
- Correction: You can edit or delete individual records in the app.
- Deletion: You can request complete deletion of your account and all associated data by emailing support@preptrackr.app. We will confirm deletion within 7 days.
- Portability: You can ask for the data you entered in a structured, commonly used machine-readable format (JSON or CSV).
- Withdrawing consent: You can withdraw your consent to the processing of your health information at any time by deleting your account.
- Complaints: If you are not satisfied with how we handle a privacy request, you can file a complaint with the Commission d'accès à l'information du Québec.
- Export: If you want a copy of your data before deleting, let us know and we'll provide it.
- Notifications: You can disable push notifications in the app settings at any time, which removes your push token from our database.
8. Data retention
We retain your data as long as your account is active. If you delete your account, all data is permanently deleted within 7 days. We do not maintain backups of deleted user data beyond standard infrastructure backup windows (30 days), after which it is fully purged.
8a. Confidentiality incidents
If a confidentiality incident involving your personal information occurs (for example unauthorised access, use, disclosure or loss), we will take reasonable steps to reduce the risk of harm, record the incident in our register of confidentiality incidents, and, where the incident presents a risk of serious injury, notify the Commission d'accès à l'information du Québec and the affected users as required by Law 25.
9. Children
PrEP Trackr is not intended for use by people under 18. We do not knowingly collect data from minors. If we become aware that we have done so, we will delete the account and associated data promptly.
10. Changes to this policy
If we make material changes to this privacy policy, we will update the "last updated" date at the top and, if the changes are significant, notify active users by email. Continued use of the app after a change constitutes acceptance of the updated policy.
11. Contact
Questions about this policy, requests to access or delete your data, or any privacy concerns: email us at support@preptrackr.app. We respond to all privacy-related requests within 7 days.