Privacy Policy

What we collect

• Your email address, and if you sign in with Google, your name.
• Your child's first name, date of birth, and sex.
• The care information you add: visit summaries, next-step tasks, your child's current care plan, and any documents you upload (like referral letters or lab forms).
• Your consent choices, and a record of key actions in your child's care thread (like when a task was completed or a document was added), so you have a dependable history to look back on.

How we use it

• To show you your child's care thread, upcoming next steps, and current plan.
• To remind you by email and in the app when something is coming up, due, or overdue.
• To generate New Zealand's standard Well Child and immunisation schedule for your child automatically, so you don't have to track it yourself.

We don't use your information for advertising, and we don't sell it.

Who we share it with

We use a small number of services to run Medly. We don't share your child's information with anyone else without your direction.

• Supabase stores your data and handles sign-in and file storage, on servers located in Australia.
• Resend delivers your reminder emails.
• Google, only if you choose to sign in with your Google account.
• Anthropic, only when you tap "Suggest tasks" on a document you've uploaded — the document's content is sent to generate draft task suggestions for you to review and approve. Anthropic doesn't use this content to train its models.
• PostHog tells us how Medly is used — for example, how many people added a next step, or where people get stuck. It receives only anonymous counts of actions, never anything you or your child have written: no names, notes, conditions, appointments, documents or email addresses. It runs only if you've agreed to "Process my data" in Settings, and you can turn it off there at any time. These counts are processed in Europe.

Where your data is stored

Your child's health information — everything you enter, and every document you upload — is stored on servers in Australia. We chose this region deliberately, to keep your data close to home rather than further afield.

The one exception is the anonymous usage counts described above, which are processed in Europe. They contain no health information and nothing you've written. If you have questions about what this means for you, get in touch (below).

Security

• Your child's information is only ever accessible from your own account — this is enforced at the database level, not just in the app.
• Uploaded documents are kept private and only ever accessed through short-lived secure links generated for you.
• Data is encrypted both in transit and at rest.

How long we keep your information

We keep your information for as long as your account is active. You can remove a child's profile at any time in Settings, which removes their care data with it. If you'd like your whole account and its data deleted, contact us (below) and we'll take care of it.

Your rights

Under New Zealand's Privacy Act 2020, you can ask to see the personal information we hold about you and your child, and ask us to correct it. You can already do most of this yourself — edit your care plan, tasks, and visits directly, update your consent choices, or remove a child's profile in Settings. For anything else, contact us.

Children's information

Medly is used by parents and caregivers to manage a child's care — a child does not create their own account or give their own consent. As the caregiver, you're responsible for the accuracy of what you enter about your child and for deciding what to share with Medly.

Changes to this policy

If how we handle your information changes, we'll update this page and the date at the top.

Contact us

Questions about your privacy or your data? Email us at privacy@medly.nz.

This policy is issued by Medly Limited.