Privacy Policy

Effective date: not stated · Last updated: not stated

1. Who we are

Dawakara (the "App") and dawakara.com (the "Site") are provided by Zargham Labs LLC, a Montana limited liability company, 1001 S Main St, STE 600, Kalispell, MT 59901, USA ("we", "us"). We are the controller (or "data fiduciary") of the personal data described in this policy. Contact: [email protected].

2. The short version

• Without Family mode, the App stores your information only on your phone. We don't receive it.
• The App has no ads and no third-party advertising, analytics or tracking tools.
• We never sell your personal data and never share your health information for advertising.
• If you use Dawakara Family, your health information is end-to-end encrypted on your phone before it's sent. Our server relays and stores it in a form we cannot read.

3. Information stored only on your phone (all users)

When you use the App, you may enter medicine names, strengths, schedules, dose history (taken, skipped or missed, with times), quantities on hand, notes, photos of medicines, profile names, optional health measurements, and settings. This information is stored in an encrypted database on your device. We do not collect it: it isn't sent to us or anyone else unless you choose to export it or turn on Family mode. Uninstalling the App deletes it. If you create an export or backup file, you decide where it goes, and that file is protected with a passphrase you choose.

4. Information processed if you use Dawakara Family (optional subscription)

To link phones, send caregiver alerts, sync between devices and keep encrypted backups, we process:

• Encrypted family data. Medicine and dose information, alerts (e.g. "a dose was missed") and backups, encrypted on your device with keys we don't have. We store and forward this data but can't read it.
• Technical identifiers. A random device ID, a public encryption key, your family group ID, and a push notification token used to deliver alerts to your device.
• Subscription status. Whether your family group has an active subscription, its start and end dates, and an order reference provided by the app store. Payments are handled by the app store. We never receive your card or bank details.
• Service metadata. Timestamps, message sizes, the app version, and IP addresses in short-lived server logs (see Retention).

Purpose: only to provide the Family features you asked for, keep them secure, and prevent abuse.

5. Optional anonymous usage statistics (off by default)

If you turn on "Share anonymous statistics" in Settings, the App sends a limited set of events to our own self-hosted analytics server, such as whether onboarding was completed, whether reminder permissions were granted, the phone brand, the app version and language, and broad reminder-response ranges. These events never include medicine names, doses, conditions or other health details and aren't linked to your name or email. You can turn this off at any time.

6. Information we collect on the Site

• Test and waitlist signups. Email address, country, language, phone brand, the role you choose (taking medicines / helping someone), and your consent. We use this only to invite you to tests and send occasional product updates. Every email has an unsubscribe link.
• Server logs. Our web server records standard request details (IP address, time, page requested, browser type) for security and reliability.
• No cookies or trackers. The Site uses no cookies, analytics, advertising pixels or third-party embeds.
• Support emails. If you email us, we keep the message and your address to answer you.

7. How we use information, and our legal bases

We don't use your information for advertising, profiling, or automated decisions with legal or similarly significant effects.

8. Who we share information with

We share information only with service providers who help us run Dawakara, under contracts that require them to protect it, and never for advertising:

• Push notification service provided with your phone's operating system (Firebase Cloud Messaging by Google), which delivers encrypted alerts to your device. It can't read the encrypted content.
• The app store, which processes subscription payments under its own privacy policy.

We may disclose information if the law requires it, to protect people's safety, or as part of a merger or acquisition (in which case this policy will continue to apply to your information). We do not sell personal data and do not "share" it for cross-context behavioral advertising.

9. Retention

• On-device data: until you delete it or uninstall the App.
• Family data on our server: while your family group is active. It is deleted when you delete it in the App, or automatically after 12 months with no connected device activity. Encrypted alert messages are deleted after 30 days.
• Server logs: 14 days.
• Server backups: deleted data drops out of our backups within 30 days.
• Signup details: until you unsubscribe or ask us to delete them, or 24 months after the last contact.
• Subscription and order records: as long as tax and accounting law requires.

10. Security

We use encryption on your device, end-to-end encryption for Family data, encryption in transit (HTTPS/TLS), restricted server access, isolated infrastructure, and data minimization. No system is perfectly secure. See "If there is a breach" below.

11. If there is a breach

If a security breach affects your personal or health information, we will notify you and the relevant regulators as required by law. For users in the United States, that includes notifying you and the U.S. Federal Trade Commission under the FTC's Health Breach Notification Rule (16 CFR Part 318) without unreasonable delay, and no later than 60 calendar days after we discover it, where that rule applies. Notices will be sent by email or in-app message where possible.

12. Your choices and rights

Everyone, wherever you live, can:

• see and export the information stored on your phone, from inside the App;
• delete it by deleting entries, or by uninstalling;
• delete Family data from our server (Settings → Privacy → Delete my cloud data, or dawakara.com/delete);
• withdraw consent (turn off Family mode or statistics, or unsubscribe from emails);
• ask us what we hold about you at [email protected].

We'll respond within 30 days (or sooner if the law requires) and won't discriminate against you for using your rights. We may need to verify your request, for example by asking you to send it from the App or to give your Dawakara ID (shown in Settings → Privacy).

EU, EEA and UK users

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting earlier processing. You may complain to your local data protection authority (in the UK, the Information Commissioner's Office; in the EU, see the list of authorities). The law references are GDPR Art. 9 (health data) and Arts. 15–22 (rights).

United States users

Depending on your state, you may have rights to access, correct, delete and obtain a copy of your personal data, to opt out of sale, targeted advertising and profiling (we do none of these), and to appeal our decision by emailing [email protected] with "Appeal" in the subject. Washington, Nevada and Connecticut residents: see our Washington Consumer Health Data Privacy Policy, which also describes how we handle consumer health data for residents of other states with consumer health data laws.

India users

Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, you may access a summary of your personal data, correct or erase it, withdraw consent as easily as you gave it, nominate another person to exercise your rights, and raise a grievance. Grievance contact: [email protected]. If we don't resolve your grievance, you may approach the Data Protection Board of India.

13. International transfers

We are based in the United States. If you use Family mode or sign up on the Site from another country, your information will be transferred to us. Where the law requires it (for example from the EU or UK), we use appropriate safeguards such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum. Family health data is end-to-end encrypted before it leaves your phone.

14. Children

Dawakara isn't directed at children under 13 (or under 16 in the EU/UK), and we don't knowingly collect their personal data through the Site or Family mode. Parents and guardians may add profiles for children on their own phone. That information stays on the device, or is end-to-end encrypted if the parent uses Family mode, and the parent controls it. If you believe a child has given us personal data, contact us and we'll delete it.

15. Permissions the App asks for

• Notifications and alarms & reminders: to show your reminders on time.
• Run after restart: to restore your reminders after the phone restarts.
• Full-screen reminders (optional): to show a reminder screen when your phone is locked.
• Camera (optional): to photograph a medicine or scan a Family QR code. Photos stay on your phone.
• Biometrics (optional): for app lock, handled by your phone; we never receive your fingerprint or face data.

The App doesn't access your location, contacts or other apps' health data.

16. Changes

If we change this policy, we'll update the date above. If a change affects how we handle health information, we'll tell you in the App and ask for your consent where required, before the change takes effect.

17. Contact

Zargham Labs LLC, 1001 S Main St, STE 600, Kalispell, MT 59901, USA · [email protected]