Effective date: July 2026
Ogden Group LLC (“we,” “us,” “our”) operates RxCal, a medication reminder and adherence tracking application (the “Service”). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.
By creating an account or using RxCal, you agree to the collection and use of information as described in this policy. If you don’t agree, please don’t use the Service.
1. Information We Collect
Account information. When you create an account, we collect your email address and a securely hashed password (we never store your password in plain text – authentication is handled by our infrastructure provider, Supabase, using industry standard hashing).
Health and medication information. This is the core purpose of the Service, so we collect what’s necessary to make it work: medication names, dosages, forms, and instructions you enter; schedules and reminder times you set; dose logs (when a dose was taken, skipped, or snoozed, and when you logged it); pill counts and refill thresholds, if you choose to track them; and daily mood check ins, if you choose to use that feature.
Caregiver and family information. If you use caregiver mode, we collect the display name and relationship (e.g., “parent,” “child”) you assign to each profile you manage. If you invite someone to their own account access, we collect the invite code and, once claimed, a record linking their account to that profile. We do not require or collect government ID or other identity verification documents for this feature.
Device and notification information. If you enable push notifications, we collect a device or browser specific push subscription identifier so we can deliver reminders. This identifier does not by itself identify you personally, and we do not use it for advertising or tracking.
Payment information. If you subscribe to Premium, payment is processed by Stripe, Inc. We do not collect or store your full credit card number, CVV, or bank details; those go directly to Stripe. We retain only what’s necessary to manage your subscription: your Stripe customer ID, subscription status, and billing period dates.
Information we do not collect. We do not collect precise geolocation. We do not use advertising trackers, analytics pixels, or third party marketing cookies. We do not access your contacts, photos, or other apps on your device.
2. How We Use Your Information
We use the information above only to:
- Provide the core functionality of the Service – storing your medications, computing when doses are due, and delivering reminders
- Operate the escalating reminder system, including alerting a caregiver if a dose they’re responsible for goes unacknowledged
- Process your subscription and billing through Stripe
- Respond to support requests you send us
- Maintain the security and integrity of the Service (e.g., detecting abuse, enforcing our terms)
- Comply with legal obligations where applicable
We do not use your health or medication data for advertising, marketing profiling, or any purpose unrelated to providing the Service. We do not sell your personal information, and we never have.
3. How We Share Your Information
We share information only in these limited circumstances:
Service providers. We use third party infrastructure to operate RxCal, and they process data on our behalf, under contract, only for that purpose:
- Supabase – our database, authentication, and hosting provider. Your account and medication data is stored in a Supabase hosted database with row level security enforced, meaning the database itself restricts every query to the requesting account’s own data.
- Stripe – our payment processor for Premium subscriptions.
- Push notification delivery – reminders are delivered through your browser’s or device’s native push service (e.g., a web browser’s push provider, or Apple/Google’s push services on native apps), which by design only sees that a notification needs delivering, not its content in most configurations.
Caregivers and people you explicitly invite. If you use caregiver mode, the medication and dose information for a profile you manage is visible to you. If you invite someone to claim their own profile, they gain access to their own medication data, never to your other profiles or anyone else’s.
Legal requirements. We may disclose information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of RxCal, our users, or the public.
Business transfers. If Ogden Group LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
We do not sell your personal information to data brokers or third parties. We do not share your health data with advertisers.
4. Data Security
We take the sensitivity of health data seriously:
- Data is encrypted in transit (TLS) between your device and our servers.
- Data is encrypted at rest in our database provider’s infrastructure.
- Access to your data is enforced at the database level through row-level security policies, not just application logic – meaning even a bug in our application code cannot easily expose one account’s data to another.
- Administrative access to production data is limited and logged.
No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you as required by applicable law.
5. Data Retention and Deletion
We retain your information for as long as your account is active. You can permanently delete your account at any time from within the app (Account → Delete account). Deletion is immediate and cascades through our entire database – your profiles, medications, schedules, dose history, mood check ins, notification settings, and push subscriptions are all permanently removed. This action cannot be undone.
If you’d rather not delete your whole account but want a copy of your data first, Premium accounts can export adherence history as a CSV at any time before deleting.
We may retain minimal billing records (e.g., transaction history) as required by tax and accounting law even after account deletion, to the extent legally required.
6. Your Choices and Rights
- Access and correction. You can view and edit your medication, schedule, and profile information directly in the app at any time.
- Notifications. Push notifications are entirely optional. You can decline them at signup, or disable them at any time in Settings without losing access to any other feature.
- Export. Premium accounts can export their adherence history as a CSV.
- Deletion. You can delete your account and all associated data at any time, as described above.
- Marketing communications. We do not send marketing emails. Emails you receive from us are transactional only (e.g., signup confirmation, password reset).
California residents (CCPA/CPRA). If you’re a California resident, you have the right to know what personal information we collect, to request deletion of your personal information, to correct inaccurate information, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as defined by the CCPA/CPRA. Medication and health information you provide is “sensitive personal information” under California law, and we use it only to provide the Service, not for any secondary purpose. To exercise these rights, contact us using the information in Section 10.
Other state privacy laws. Residents of states with comprehensive privacy laws (including but not limited to Washington’s My Health My Data Act, which specifically covers consumer health data) have similar rights to access, delete, and control their information. We do not collect geofencing data, and we do not share consumer health data with third parties for advertising purposes, consistent with these laws’ requirements.
European users (GDPR). If you access RxCal from the European Economic Area, UK, or Switzerland, our legal basis for processing your information is: performance of a contract (providing the Service you signed up for), and legitimate interests (securing and improving the Service). You have the right to access, correct, delete, restrict, or port your data, and to object to processing, by contacting us using the information in Section 10.
7. Children’s Privacy
RxCal’s account holders must be adults (18 or older). While caregiver mode allows an adult to manage medications for a child in their care, the account itself – including the email address, login, and billing – belongs to the adult, not the child. We do not knowingly collect account registration information directly from children under 13. If we learn that a child has independently created an account in violation of this policy, we will delete it.
8. Cookies
We use only strictly necessary cookies required for you to stay logged in (session/authentication cookies). We do not use advertising cookies, third party analytics cookies, or cross-site tracking cookies.
9. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through an in app notice before the changes take effect. The “Effective date” at the top of this page reflects the last update.
10. Contact Us
If you have questions about this Privacy Policy or want to exercise any of the rights described above, contact us at:
Ogden Group LLC Email: [email protected] Mailing address: 1120 E NASA Pkwy #108, Houston, TX 77058
11. Medical Disclaimer
RxCal is a medication reminder and organization tool. It is not a medical device and is not intended to diagnose, treat, cure, or prevent any disease. It is not a substitute for professional medical advice, diagnosis, or treatment, and does not guarantee delivery of any reminder or notification. Always follow the instructions of your prescriber or pharmacist. RxCal does not calculate, recommend, or verify medication dosages.
Two placeholders you need to fill in before publishing: the contact email and mailing address in Section 10. Once you have a real domain, also swap the generic “RxCal” references to match your actual URL if you want to be extra precise, though that’s optional. Want me to also build the actual /privacy page in the Next.js app (already flagged as needed for App Store/Play submission), wire this text into it?