Privacy Policy

What we collect

• Your email address, and if you sign in with Google, your name.
• Your child's first name, date of birth, and sex.
• The care information you add: visit summaries, next-step tasks, your child's current care plan, and any documents you upload (like referral letters or lab forms).
• Your consent choices, and a record of key actions in your child's care thread (like when a task was completed or a document was added), so you have a dependable history to look back on.

How we use it

• To show you your child's care thread, upcoming next steps, and current plan.
• To remind you by email and in the app when something is coming up, due, or overdue.
• To generate New Zealand's standard Well Child and immunisation schedule for your child automatically, so you don't have to track it yourself.

We don't use your information for advertising, and we don't sell it.

When you share records with someone

You can send part of your child's record to a provider involved in their care. Nothing leaves unless you choose to send it, and when you do:

• They get one link, covering only the areas of care you pick. Documents outside those areas are not reachable from it.
• The link expires after 14 days, and you can withdraw it sooner at any time in Settings. Withdrawing it stops the whole link working immediately.
• Every time it is opened is recorded, and you can see that in Settings, who opened it and when.
• Sending to a school is a separate decision. Sharing with your child's school or another education provider needs its own permission, which you turn on in your profile and can turn off again. We ask separately because a school handles health information under the Privacy Act and the Education and Training Act rather than the Health Information Privacy Code, different people, for a different purpose, so it should not be covered by a permission you gave about clinical care.

Who we share it with

Aside from the sharing you choose, described above, we use a small number of services to run Medly. We don't share your child's information with anyone else.

• Supabase stores your data and handles sign-in and file storage, on servers located in Australia.
• Resend delivers your reminder emails.
• Google, only if you choose to sign in with your Google account.
• Anthropic, only when you tap "Suggest tasks" on a document you've uploaded, the document's content is sent to generate draft task suggestions for you to review and approve. Anthropic doesn't use this content to train its models.
• When you accept, change or decline one of those suggestions, we record which of those three you did, and, if you changed something, which fields you changed. That's how we tell whether the suggestions are actually any good. We keep no record of the document, what it said, what was suggested, what you changed it to, which child it concerned, or that it was you: the note is a date and three words, and it can't be traced back to you or your child.
• PostHog tells us how Medly is used, for example, how many people added a next step, or where people get stuck. It receives only anonymous counts of actions, never anything you or your child have written: no names, notes, conditions, appointments, documents or email addresses. It runs only if you've turned on "Help improve Medly" under Settings → Profile and consents, which is off until you do, and you can turn it off again there at any time. These counts are processed in Europe.

Where your data is stored

Your child's health information, everything you enter, and every document you upload, is stored on servers in Australia. We chose this region deliberately, to keep your data close to home rather than further afield.

The one exception is the anonymous usage counts described above, which are processed in Europe. They contain no health information and nothing you've written. If you have questions about what this means for you, get in touch (below).

Security

• Your child's information is only ever accessible from your own account, this is enforced at the database level, not just in the app.
• Uploaded documents are kept private and only ever accessed through short-lived secure links generated for you.
• Data is encrypted both in transit and at rest.
• We keep a record of who opened your child's records and when, so you can see it in Settings. Some things also raise an alert on their own: if activity appears from an account that no longer has access, or if a link you sent to one person starts being opened from several different places, we tell you. This watches access through Medly, it cannot see everything. When a document or a shared link is opened we also store a one-way fingerprint of the network it came from. It cannot be turned back into an address or a location, it changes every month, and it exists for one reason: to notice when a link you sent to one person is being opened from several different places. This record is deleted after twelve months.

How long we keep your information

We keep your information for as long as your account is active. You can remove a child's profile at any time in Settings, which removes their care data with it. To delete your whole account and everything in it, go to Settings → Delete account. It happens immediately and cannot be undone. If you have already uninstalled the app, the same request can be made at medly.nz/delete-account.

Your rights

Under New Zealand's Privacy Act 2020, you can ask to see the personal information we hold about you and your child, and ask us to correct it. You can already do most of this yourself, edit your care plan, tasks, and visits directly, update your consent choices, or remove a child's profile in Settings. For anything else, contact us.

Children's information

Medly is used by parents and caregivers to manage a child's care: a child does not create their own account or give their own consent. As the caregiver, you're responsible for the accuracy of what you enter about your child and for deciding what to share with Medly.

Changes to this policy

If how we handle your information changes, we'll update this page and the date at the top.

Contact us

Questions about your privacy or your data? Email us at privacy@medly.nz.

This policy is issued by Medly Limited.