Privacy Policy

Last updated: 24 September 2026 · Version 0.2 (draft)

MedTrack is a personal medical tracker built by ToneThread (trading as WEBLOCS). It helps you keep your medications, doses, and how they affect you in one place — nothing more. This policy explains what information MedTrack collects, why, where it's kept, and the choices you have. We wrote it to be read, not skimmed past: if a section doesn't make sense, that's on us to fix.

1. What this covers

This policy applies to the MedTrack application at this domain and its web pages. It does not cover third-party services you might separately connect (for example, if you export data to a pharmacy system or eScript network) — those have their own policies, and we'll tell you clearly if MedTrack ever adds an integration like that.

2. The two ways MedTrack can hold your data

MedTrack is local-first. You do not need an account to use it:

• Signed out (local mode). Everything you log — medications, doses, times, notes — is stored only in your browser's local storage, on your device. We never see it, it never touches our servers, and it stays there until you clear your browser data or export it yourself. This is the default for anyone who opens the app without signing in.
• Signed in (account mode). If you choose to create an account (currently via Google sign-in), your entries are also stored server-side in our database, so you can access your history from more than one device. Signing in does not retroactively upload anything you logged locally before that point unless you explicitly choose to sync it.

3. Information you give us

• Account details — if you sign in with Google, we receive your name, email address, and profile identifier from Google. We do not receive or store your Google password.
• What you log — medications, doses, times, symptoms, side effects, free-text notes, and any glucose or other health readings you choose to enter.
• Imported data — if you use the Apple Health import feature, only the specific records you select from your export are processed and stored; we do not receive ongoing or automatic access to your Apple Health account.
• Preferences — settings such as your theme (light/dark) and display options.
• Technical data — standard web server logs (IP address, browser type, timestamps) generated automatically by visiting the site, kept briefly for security and debugging.

4. How your information is used

Only to run the tracker: to store what you log, show your history and trends, render your medication timelines, and (for account holders) keep your data in sync. We use your account email only for account-related communication — password/sign-in issues, and material changes to this policy or the terms. Your health information is never sold, and is never used to serve you ads or to build an advertising profile.

5. Where it is stored and how it is protected

Account-mode data is stored in a managed PostgreSQL database. Access to the database and hosting infrastructure is restricted to the people who operate MedTrack, and is protected by access controls, encrypted connections in transit, and standard operational security practices. No method of storage or transmission is 100% secure, and we can't guarantee absolute security — but we treat health data as sensitive by default in how we design and operate the system, not as an afterthought.

6. Sensitive health information

Medication and health data is sensitive information under Australian privacy law (and equivalent laws elsewhere). We collect it only because it's the entire point of the app — helping you track it — and we do not use it for any purpose beyond providing the service to you. We do not share it with insurers, employers, advertisers, or data brokers, under any circumstances. Any future integration with a prescriber, pharmacy, or health provider would be opt-in, clearly explained before you turn it on, and separately revocable.

7. Sharing and disclosure

We do not sell your data, in whole or in part, ever. We may share limited information only in these circumstances:

• Service providers who help us run MedTrack (for example, our database host), bound by contract to protect your data and use it only to provide their service to us.
• At your direction — for example, if you export your own data and send it somewhere yourself.
• Legal requirements — if we're required to disclose information by law, court order, or a valid legal process, we'll disclose no more than is required and will tell you unless we're legally prohibited from doing so.
• Business transfers — if MedTrack is ever acquired or its assets transferred, your data may transfer as part of that, subject to the same protections described here (or better).

8. Cookies and local storage

MedTrack uses a session cookie to keep you signed in if you have an account, and browser local storage to hold your data in local mode and to remember preferences like your theme. We don't use third-party advertising or tracking cookies.

9. Data retention

Local-mode data lives on your device for as long as you keep it there — we have no visibility or control over it. Account-mode data is retained while your account is active. If you delete your account, we delete your logged data within [30 days], except where we're required to retain limited records for legal or security purposes for longer.

10. Your choices and rights

• Access and export everything you've logged, at any time, from within the app.
• Correct or delete individual entries yourself.
• Close your account and request deletion of your account-mode data.
• Ask us what personal information we hold about you, and request its correction, under the Australian Privacy Principles (or the equivalent rights available to you under GDPR, CCPA, or other applicable law if you're located elsewhere).

To exercise any of these, use the export/delete tools in the app, or contact us using the details below.

11. International users

MedTrack is operated from Australia and our infrastructure may be located in Australia or other jurisdictions where our hosting provider operates. If you use MedTrack from outside Australia, your information may be transferred to and processed in a jurisdiction with different data protection laws than your own. We take reasonable steps to protect your information wherever it's processed.

12. Eligibility

MedTrack is intended for adults managing their own medication, or for a parent/guardian tracking on behalf of a dependant. It is not directed at children, and we do not knowingly collect information directly from children under 13 (or the relevant age of digital consent in your jurisdiction) as independent account holders.

13. Security incidents

If we become aware of a data breach that's likely to result in serious harm to you, we'll notify affected users and any relevant regulator (such as the OAIC in Australia) as required by law, and explain what happened, what we're doing about it, and what you can do to protect yourself.

14. Changes to this policy

We may update this policy as MedTrack develops. If a change is material, we'll flag it in the app or on this page, and update the "last updated" date above. We won't use a policy change to retroactively justify using your existing data in a materially different way without telling you first.

15. Contact

Questions about privacy, or to exercise any of the rights above: privacy@tonethread.com — [confirm this address is monitored before publishing]. Postal address for formal correspondence: [ToneThread / WEBLOCS registered address, ABN].