Privacy Policy

1. Data we collect

• Account: name, email, phone number (when you sign up).
• Health: medicines, schedules, intake logs, vitals you choose to track.
• Usage: pages viewed, buttons clicked, device type, OS, browser — only when you grant Analytics consent.
• We do NOT collect biometric data, government IDs, or financial information.

2. Purpose of use

• Send medication reminders.
• Let family caregivers see real-time adherence (with consent).
• Improve the app via aggregated analytics (only with Analytics consent).
• Meet legal obligations (tax, audit).

3. Third-party services

• Neon — provides the PostgreSQL database for account and health data.
• Upstash — provides Redis for caching, rate limiting, and scheduled-job locks.
• Fly.io — hosts and processes the service API.
• Cloudflare R2 — stores uploaded files, including medicine and pill photos, profile avatars, family-feature images, and voice clips.
• Cloudflare Workers — serves the Kiangkang website and caches public website content.
• Firebase — provides authentication and session control, delivers notifications through Firebase Cloud Messaging, and is used for analytics or crash reporting in the app.
• Google Analytics 4 and Google Tag Manager — analyze website use and manage analytics tags when you grant Analytics consent.
• LINE — verifies LINE sign-in and sends or receives messages or notifications through the LINE Messaging API.
• AI service provider configured for the service (OpenAI or Anthropic, according to configuration and the fallback mechanism) — when you use an AI feature, the system sends the content and files needed for that feature for processing. This may include medicine or prescription images, chat messages or history, and relevant medicine or health information. When both providers are configured, an eligible technical failure can cause the same request to be retried with the other provider.

4. Storage region

Your account and health data are stored encrypted in PostgreSQL provided by Neon. Requests to the service API are processed on Fly.io in Singapore, and analytics data is processed in the United States by Google, so using the service involves transfers of data outside Thailand. Cross-border transfers comply with PDPA §28.

5. Your PDPA rights

• Access — request a copy of your data.
• Rectification — correct inaccurate data.
• Erasure — request deletion (account deletion in-app or via email).
• Portability — receive data in machine-readable format (in-app export).
• Withdraw consent — at any time, via Privacy Settings (in-app).
• Object to processing — for direct marketing or profiling.
• Complaint — to the Personal Data Protection Committee (PDPC) of Thailand.

6. Retention

• Account + health data: while your account is active. Deleted within 30 days of account deletion request.
• Analytics: 14 months (GA4 default).
• Logs: 90 days for security/debugging.

7. Contact