Privacy Policy

1. Who we are (Data Controller)

Qida is operated by Synergy Data Analytics, C.A. (“Qida”, “we”, “us”), based in Caracas, Venezuela. For matters concerning your personal data, contact privacidad@qida.io. For support, contact soporte@qida.io.

2. Scope

This policy applies to the Qida mobile application for iOS and Android, the website qida.io and all related services operated by us. It does not apply to third-party applications, websites or services, even when we link to them.

3. Data we collect

We collect only the data necessary to operate the app, grouped as follows:

3.1. Account and profile data

• Full name, email address and password (encrypted).
• If you sign in with Google: Google identifier, name, profile photo and email associated with your Google account.
• Date of birth.
• Role: patient, caregiver, pharmacy, distributor or supplier.
• Optional profile photo.

3.2. Health data (sensitive)

• Medicines you register: name, brand, dose, frequency, schedules and dates.
• Dose records: what you took, when, and whether you marked it as skipped.
• Optional clinical profile data: sex, blood type and height.

These are sensitive personal data under Latin American data protection laws. We process them with express consent and never use them for advertising, marketing or commercial profiling.

3.3. Addresses and location

• Addresses saved in the app: label, text and coordinates (latitude and longitude).
• Your approximate location while using the app, to show nearby pharmacies. We request location only while the app is in use, never in the background.

3.4. Messages to Vita (AI assistant)

The text you send to Vita and the responses received, with minimal metadata (timestamp and internal user identifier).

3.5. Search history (optional, off by default)

If you enable the “Search history” consent in Profile → Privacy and security, we store your medicine search terms, their source (catalogue, pharmacies, Vita AI or the add-medicine flow), the number of results, your internal user identifier and timestamp. We use these searches to improve the catalogue, identify terms returning no results and adjust ranking. This consent is off by default and may be enabled or disabled at any time. Searches are automatically deleted after 18 months, and immediately when you delete your account.

3.7. Prescriptions you scan (optional, off by default)

If you use Scan prescription to add a medicine, only after accepting the notice before your first photo, we process:

• Prescription photos (up to 5 per scan). These are stored privately in your account: other users cannot view them, and only authorized Qida personnel have access (see §13).
• Information read from the paper: medicines (name, dose, frequency and duration), signing doctor (name, specialty and registration number when present), clinic, date, and the patient’s name, identity document number and age as written on the prescription. This may be a different person from the person scanning, as a caregiver may upload someone else’s prescription.

What is sent, and to whom: photos are sent to Amazon Bedrock (AWS, us-east-1 region), running Moonshot AI’s Kimi K2.5, solely to read them. AWS Bedrock contractually does not use these images to train its own or third-party models, or share them with Moonshot AI or anyone else.

You decide what is saved: the app displays the reading for review and correction before saving. We do not add medicines to your account on our own.

How to disable it: consent is off by default and can be changed in Profile → Privacy and security → Prescription scanning. The rest of the app works without it; medicines can be added manually. Photos and extracted data are deleted with your account.

3.6. Technical and diagnostic data

• Internal account identifier (UUID) and session tokens.
• Operating system version (iOS or Android), device model, language and timestamps for error and diagnostic logs (without health content).
• IP address captured by infrastructure providers.
• Whether you opened a notice we sent (account identifier and date), to measure whether those notices are useful.

We do not use Apple HealthKit or Android Health Connect. Qida does not read or write data in Apple Health or Health Connect. We do not store personal health information in iCloud or Google Drive.

4. How we use data (Purposes)

We do not use your data for other purposes. If a new use becomes necessary, we will inform you and request your express consent beforehand.

5. Legal basis for processing

• Express consent for sensitive health data, location and Vita. You may revoke it at any time without affecting previous processing.
• Performance of a contract (providing Qida) for account and functionality data.
• Legitimate interest for minimal technical data needed for security and fraud prevention.
• Compliance with legal obligations when requested by a competent authority.

6. Who we share data with

We share data only with providers strictly necessary to operate the service. Each has its own security and privacy safeguards and a contract limiting processing to the purposes described here.

We do not share your data with anyone else, sell it or provide it to advertisers.

7. Vita (AI assistant)

Vita is an AI conversational assistant for finding medicines in pharmacies, comparing prices and managing alerts. When you message it:

1. What is sent: your exact message and, where applicable, necessary context (such as approximate location for distance sorting or the medicine name).
2. To whom: Amazon Bedrock (AWS), us-east-1, running Mistral Ministral 3 14B.
3. No training: AWS Bedrock contractually does not use prompts or responses to train its own or third-party models, or share them with Mistral AI or another third party.
4. What is stored: conversations are saved in your account for later viewing and permanently deleted when you delete the account.
5. Explicit consent: before your first message, you must accept this information. Vita may be disabled in Profile → Privacy and security → Sharing with Vita AI; the rest of the app continues working.
6. Limitations: Vita is exclusively for prices and pharmacy searches. It does not give medical advice, diagnose or recommend treatments. Responses may contain errors. Consult your doctor or pharmacist for clinical questions.

8. No advertising use or data sales

We never use health, medication, location or Vita conversation data for advertising, marketing, commercial profiling, data mining or sale to third parties. We do not participate in advertising networks or display ads in the app.

9. Children

Qida is intended for people over 18. A minor may only use the app through an adult caregiver’s account (role “caregiver”). The caregiver is responsible for obtaining consent from the minor’s legal representative and for information recorded on the minor’s behalf. We do not knowingly collect minors’ data outside this arrangement. If a minor has directly created an account, email privacidad@qida.io and we will delete it promptly.

10. International transfers

Your data is stored and processed in the United States and, in part, Apple’s global infrastructure. These countries may have different data protection laws. Transfers are made on the basis of:

• Your express consent to this policy.
• Contractual clauses requiring providers to protect data to the same standard as this policy.
• Transfer mechanisms provided by each applicable local law.

11. Retention and deletion

We retain data for as long as necessary to provide the service:

• Account data: while active. Following deletion, permanently removed within 30 days, including rotating backups.
• Vita conversations: while the account is active or until you disable Vita. Deleted immediately with the account.
• Scanned prescriptions: photos and extracted data while the account is active; deleted immediately with it, including images.
• Technical security logs: up to 90 days.
• Legally required data (such as tax records if charges exist in future): for the legally required retention period.

You may directly delete your account and all personal data at any time in Profile → Privacy and security → Delete my account, without calls or emails.

12. Your rights

Regardless of your country of residence, you have the right to:

• Access: know what data we hold; use Download my data for a JSON file.
• Rectification: correct inaccurate information by editing your profile.
• Cancellation/deletion: remove data through Delete my account.
• Objection: object to specific processing, for example by disabling Vita.
• Portability: receive data in a structured, commonly used format (downloadable JSON).
• Withdraw consent at any time, without affecting prior lawful processing.
• Lodge a complaint with your country’s data protection authority.

To exercise these rights by email, clearly identify yourself at privacidad@qida.io. We respond within a maximum of 20 business days.

13. Security

• Server communications encrypted with TLS 1.2 or higher.
• Row Level Security (RLS) ensures users can only read and modify their own data.
• Avatars encrypted at rest in storage, in separate per-user folders.
• Sessions kept in secure device storage. Biometric locking (Face ID/Touch ID on iOS, fingerprint or face on Android) may be enabled in Privacy and security.
• Audit logs and access restricted to authorized staff.
• If a security incident may affect personal data, we notify you without undue delay and the relevant authority when legally required.

14. Cookies and SDKs

14.1. Website qida.io

The website uses only strictly necessary technical cookies (session preferences and navigation state). We do not use advertising or third-party analytics cookies requiring prior consent.

14.2. SDKs in the app

• Supabase Swift on iOS and Supabase Kotlin on Android: authentication and database access.
• Google Sign-In: federated Google login.
• Google Maps/Places: maps, geocoding and distances for nearby pharmacies.
• Firebase Cloud Messaging (Android): remote push notifications.

On iOS, each SDK includes its signed privacy manifest in accordance with Apple requirements.

15. No cross-app tracking (App Tracking Transparency)

Qida does not track activity in other apps or websites. We do not use advertising identifiers (Apple IDFA or Android Advertising ID) or share them with third parties. For this reason, Qida does not show the App Tracking Transparency prompt on iOS.

16. Push notifications

Medicine reminders are local, scheduled on your device. When you share care with a family member, their alerts (for example, an unrecorded dose) are delivered through Firebase Cloud Messaging on Android or APNs on iOS and may include medicine and dose time.

We may also send notices about your own account, such as a missing address or absence of a care companion. Recipients are selected only on the basis of missing account information, not health data. We record whether you open a notice (account identifier and date) to assess usefulness and avoid repeating unhelpful notices.

You may disable notifications in phone settings without losing other app functions. We never send marketing notifications without separate, explicit consent.

17. Country-specific provisions

17.1. Mexico — Comprehensive Privacy Notice (LFPDPPP)

Under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP, amended and published in the DOF on March 20, 2025), Synergy Data Analytics, C.A. informs you that processed data are described in §§3–4. Medicines, conditions and adherence are sensitive personal data processed with express consent. Primary purposes are those in §4; no secondary purposes (advertising, commercial prospecting, etc.) apply. To exercise ARCO rights (Access, Rectification, Cancellation, Objection), revoke consent, request portability or limit use, email privacidad@qida.io. The competent authority is the Secretaría Anticorrupción y Buen Gobierno, where complaints may be filed.

17.2. Colombia — Law 1581/2012 (Habeas Data)

Synergy Data Analytics, C.A. is the Controller; the infrastructure providers are Processors. Health data require prior, express, informed authorization granted by accepting this policy. You may refuse to provide sensitive data without denial of functions that do not need them. You may know, update, rectify and delete data, withdraw authorization, request proof of authorization and complain to the Superintendencia de Industria y Comercio (SIC).

17.3. Brazil — Lei Geral de Proteção de Dados (LGPD)

The bases in §5 accord with Arts. 7 and 11 of Law 13.709/2018. Sensitive data are processed on your specific and prominent consent. Art. 18 rights include confirmation, access, correction, anonymization, portability, deletion, sharing information and withdrawal of consent. Our Encarregado de Dados (DPO) may be contacted at privacidad@qida.io. The competent authority is the Autoridade Nacional de Proteção de Dados (ANPD).

17.4. Argentina — Law 25.326 (Habeas Data)

Health data are sensitive and require express written consent or equivalent, granted by accepting this policy. Access (Art. 14), rectification, updating and deletion (Art. 16) may be exercised by email. The authority is the Agencia de Acceso a la Información Pública (AAIP).

17.5. Chile — Law 19.628 (and Law 21.719 effective December 2026)

Health data are sensitive and require express consent. We recognize access, rectification, cancellation, objection and portability. Upon Law 21.719 taking effect, we additionally recognize blocking and expanded portability and notify security incidents to the Agencia de Protección de Datos Personales. Consumer rights recognized by SERNAC remain in force.

17.6. Venezuela and other countries

Residents of Venezuela or other unlisted countries have the rights recognized by local data protection and consumer legislation. Contact us at any time through the channels here.

18. Changes to this policy

We may update this policy for service or legislative changes. Material changes are notified at least 30 days in advance through a prominent in-app notice and, where possible, email. If changes require consent (such as a new purpose), we request it explicitly before applying them. The current effective date appears at the top of this page.

19. Contact

Synergy Data Analytics, C.A.
Caracas, Venezuela
Privacy: privacidad@qida.io
Support: soporte@qida.io
Last updated: September 20, 2026.