Privacy Policy

Last Updated: February 22, 2026  ·  Version 2.0

Welcome to Buzz Biotech ("we," "us," or "our"). We are committed to protecting your privacy and the security of your health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and web service (collectively, the "App"). Please read this policy carefully. By using the App, you agree to the practices described below.

1. Information We Collect

Information You Provide Directly

• Account Information: Name, email address, phone number, and password when you register.
• Profile Information: Display name and optional profile picture.
• Health & Medication Data: Medicine names, dosages, schedules, intake history, notes, and adherence records you enter into the App.
• Caregiver Relationships: If you use the caregiver feature, we store relationship data, permissions, and access logs.
• Feedback: Messages you submit through the in-app feedback form.

Information Collected Automatically

• Device Information: Device type, operating system, and unique device identifiers.
• Push Notification Tokens: If you enable reminders, we store a secure token to deliver them.
• Usage Analytics: Anonymized app usage events collected via Google Firebase Analytics to improve the App.
• Audit Logs: Records of security-relevant events such as caregiver permission changes, stored per-account for your protection.

2. How We Use Your Information

• To deliver core App functionality: medication tracking, reminders, and adherence history
• To enable and secure the caregiver access feature
• To sync your data securely across your devices
• To send medication reminders and push notifications (only if enabled)
• To respond to support requests and feedback
• To detect and prevent fraud, abuse, or unauthorized access
• To improve App features and fix bugs using anonymized analytics
• To comply with applicable laws and legal obligations

3. Data Storage and Security

Your data is stored on Google Firebase infrastructure (Firestore, Firebase Storage, Firebase Authentication), hosted in the United States. We implement the following security measures:

• Encryption in transit: All data is transmitted over TLS/HTTPS.
• Encryption at rest: Firebase encrypts all data at rest using AES-256.
• Access controls: Firestore Security Rules ensure each user can only access their own data. Caregiver access is explicitly permissioned by the patient.
• Authentication: Multi-factor and session-based authentication. Only verified users can access protected data.
• BAA with Google Cloud: We have a signed Business Associate Agreement with Google Cloud, covering the use of Firebase for health-related data.
• Admin access: Administrative functions are restricted to a single verified administrator via server-side verification in Firebase Cloud Functions.

While we implement strong safeguards, no system is 100% secure. In the event of a data breach that may affect your rights, we will notify you as required by applicable law within 72 hours of discovery.

4. Data Sharing and Disclosure

We do NOT sell, rent, or trade your personal information or health data to any third party — ever.

We may share your information only in the following limited circumstances:

• With Your Consent: When you explicitly authorize sharing, such as granting a caregiver access to your medication data.
• Service Providers: With Google / Firebase, who provide cloud infrastructure. They are bound by our BAA and their own privacy commitments. No other third-party processors have access to your health data.
• Legal Requirements: If required by a valid court order, subpoena, or applicable law.
• Safety: To protect the safety of a user or the public where disclosure is necessary.
• Business Transfer: In the event of a merger or acquisition, with prior notice to users and subject to the same privacy protections.

5. Your Rights and Choices

• Access: You can view your data at any time within the App.
• Correction: Update your name, email, or profile picture from the Edit Profile screen.
• Deletion: Delete your account and all associated data permanently from the Edit Profile screen. Data is deleted within 30 days.
• Portability: Contact us to request a copy of your data in a portable format.
• Caregiver Access: You can revoke caregiver access at any time from the Caregivers screen.
• Notifications: Disable push notifications at any time in your device settings or within the App.
• Withdraw Consent: You may withdraw consent at any time by deleting your account, though this will terminate your ability to use the App.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, all personal and health data is permanently deleted from our systems within 30 days, except where retention is required by law or to resolve active disputes.

Anonymous usage data (analytics) may be retained in aggregated, non-identifiable form for up to 2 years for product improvement purposes.

7. Children's Privacy

The App is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with their information, please contact us immediately and we will delete it.

8. California Privacy Rights (CCPA)

If you are a California resident, you have the right to know what personal information we collect, the right to request deletion, and the right to non-discrimination for exercising your rights. As stated above, we do not sell personal information. To exercise your rights, contact us at the email below.

9. European Users (GDPR)

If you are in the European Economic Area, you have rights under GDPR including the right to access, rectify, erase, restrict processing, data portability, and object to processing. Our lawful basis for processing is your explicit consent (given at account creation) and the performance of our service contract with you. Contact us to exercise any GDPR rights.

10. Third-Party Services

• Google Firebase: Authentication, database (Firestore), file storage, cloud functions, and hosting. Covered by BAA. Firebase Privacy Policy
• Google Analytics for Firebase: Anonymized app usage analytics. Google Privacy Policy
• Google Cloud (Cloud Run / Cloud Functions): Serverless backend functions for push notifications, data processing. Covered by BAA.

We do not use advertising networks, data brokers, or any analytics service that has access to your health data.

11. Limitation of Liability for Privacy Incidents

TO THE MAXIMUM EXTENT PERMITTED BY LAW, BUZZ BIOTECH'S TOTAL LIABILITY FOR ANY CLAIMS ARISING FROM OR RELATED TO THIS PRIVACY POLICY OR OUR HANDLING OF YOUR DATA — INCLUDING DATA BREACHES, UNAUTHORIZED ACCESS, OR DATA LOSS — SHALL NOT EXCEED TEN DOLLARS ($10.00 USD). WE ARE NOT LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, PUNITIVE, OR SPECIAL DAMAGES ARISING FROM ANY PRIVACY INCIDENT, DATA BREACH, OR UNAUTHORIZED ACCESS TO YOUR INFORMATION, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

We do not guarantee the accuracy, completeness, or security of any data you store in the App. You are responsible for maintaining your own backup of any critical health information. Data loss, corruption, or unavailability may occur due to technical failures, and Buzz Biotech is not liable for any resulting harm.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you via an in-app notice and update the "Last Updated" date above. Your continued use of the App after the effective date of changes constitutes your acceptance. If you do not agree, you may delete your account at any time.

13. Contact Us

If you have questions, concerns, or wish to exercise any of your data rights, please contact us:

📧 Email: BuzzBiotech@gmail.com
🌐 Website: buzz-app-real.web.app
🏢 Company: Buzz Biotech LLC

We will respond to all data rights requests within 30 days.