Privacy Policy

You can use the app without an account (your data then stays on your device). If you choose to create an account to back up and sync your medications, you can sign in with Sign in with Apple or an email and password. Authentication is handled by Supabase. We store your user ID, your email address, and, if you provide it, your name. Passwords are never stored by us in readable form; with Sign in with Apple we never see your Apple credentials. If you sign in with Apple, we also keep the token Apple gives the app at sign-in. It is used for one thing: disconnecting the app from your Apple ID when you delete your account. It is stored on our server where the app and other users cannot read it, and it is deleted with your account. Our sign-in service also records your IP address and basic app and device information (the user agent) with each sign-in session, to keep accounts secure.

When you create an account or reset a password, we send you an email with a one-time link. These emails are sent for us by our email provider, Resend, which receives your email address and the message so it can deliver it. We don't use your email address for marketing.

Your medication list — names, strengths, directions, quantities, refill counts, and any notes you add — is information you enter yourself. It is stored on your device. If you are signed in, it is also synced to your private account so it is available across your devices. Each account's data is isolated by row-level security, so only your signed-in account can read or change it. If you use the app signed out, your list never leaves your device — with one note: the file the app keeps on your iPhone is part of your iPhone’s own backups (iCloud Backup or a backup to your computer) if you have those turned on. Those backups are made and held by Apple or on your computer, not by us, and your date of birth is not included in them.

On iOS, if you grant permission, Rx Manager reads recent vitals from Apple Health — heart rate, blood pressure, weight, and blood glucose — to display them next to your medications. This data is read on-device and shown to you only. It is never uploaded, synced, or shared. You can revoke this access any time in the iOS Settings > Privacy & Security > Health.

Importing medications. On iOS 26 and later, when you add a medication you can choose “Import from Apple Health”. Health asks you which of the (non-archived) medications in its Medications list Rx Manager may see, and Rx Manager reads only the name, form, and standard drug code of each one you choose, and adds them to your list marked “needs review” (the codes are sent to the U.S. National Library of Medicine’s RxNorm service to look up the product). Imported medications are part of your medication list like any other, so they sync to your account if you are signed in. Nothing else from Health is uploaded, and none of it is used for advertising or sold. You can change which medications Rx Manager can see in the Health app under Sharing.

Rx Manager can ask for your name and your date of birth. Your name is used to greet you and, if you sign in, is saved with your account so it follows you to your other devices. Your date of birth stays on your iPhone and is never uploaded; it is used only to work out your age. Accounts, syncing and text reminders are for people 13 and older, so the app asks for a date of birth before an account can be created and does not offer accounts to anyone it knows is under 13. If you sign in, the app tells our server only that you confirmed you are 13 or older (a yes, and the time you confirmed it — never your date of birth), and the server will not store medications or send text reminders for an account without that confirmation. People under 18 are reminded to involve a parent or guardian in decisions about their medications. You can remove these details from your iPhone at any time in Settings → Profile.

If you pick a pharmacy for a medication, or paste a link to its website, that link is saved with your medication list (and syncs to your account if you are signed in). If you have turned on text reminders, a reminder can end with that link so you can reach your pharmacy quickly. Rx Manager only opens the link; it never signs in to, or sends your information to, a pharmacy.

If you scan a prescription label, the camera image is processed entirely on your device — the iOS app uses Apple's on-device text recognition, and the website uses in-browser recognition. The photo is not uploaded or stored by us. Only the text fields you review and choose to save (for example the medication name and quantity) are added to your medication list.

In the iOS app, when you search for a medication by name, the text you type is sent to the U.S. National Library of Medicine's public RxNorm service to return matching medications, strengths, and forms. These lookups contain only the search term — no account information, and nothing that identifies you.

The iOS app can show a medicine’s FDA boxed warning, whether it is on the U.S. government’s (NIOSH) list of hazardous drugs, and a short note on how it works. This comes from a reference file built into the app, and the lookup happens on your iPhone: the medicines on your list are never sent anywhere to produce it. About once a week the app downloads a newer copy of that same public file from rxmanager.us. Everyone downloads the identical file, and the request contains no account, medication, or other information about you. The file is digitally signed, and the app uses a downloaded copy only if the signature checks out. If you tap a “Learn more” link, it opens in Safari on MedlinePlus or DailyMed (U.S. National Library of Medicine) with the medicine’s name in the address; that is your choice, and those sites’ own privacy policies apply from then on.

Text reminders are optional and off by default. If you turn them on, we collect the mobile number you provide and first text it a one-time 6-digit verification code, so we know the number is yours — reminders stay off until you enter the code. A number you enter to request a code is stored for up to two days so we can limit how many codes can be requested, including when the code is never entered. We then record your consent (the exact wording you agreed to, its version, the time, and your account), save your time zone so reminders follow your local date, and send a confirmation message. We then text you only when one of your medications is running low. Reminder texts say that a medication is due to reorder but never name the medication, so nothing about your medications appears on your lock screen or in message logs; open the app to see which one. Messages are delivered through our messaging provider, Twilio, solely to transmit the reminders you asked to receive. We do not sell or rent your phone number; it is shared only with Twilio to deliver those texts, and no mobile information is shared with third parties for their marketing. Reply STOP to any text to unsubscribe, or HELP for help.

• Supabase — account authentication and the private database where synced medications and reminder settings are stored.
• Twilio — delivery of the text-message reminders you opt into.
• Resend — delivery of account emails (confirmation and password reset).
• Apple — Sign in with Apple, and Apple Health (read on your device; see above for what is kept).
• U.S. National Library of Medicine (RxNorm) — medication name lookups.

These providers process data only to deliver the features above.

On the website, Export Backup and Export Spreadsheet save a file of your medication list to your own device from your browser. We never receive these files. They contain your medication list, so store them somewhere private.

• Account, medication list, settings, and reminder preferences — until you delete your account.
• Sign in with Apple token — until you delete your account, when it is used to disconnect the app from your Apple ID and then removed.
• Text-message consent record (phone number, time, and the wording you agreed to) — kept after account deletion for as long as messaging rules require us to be able to show your consent.
• Recovery copy on your iPhone — if the app has to replace unsynced local data, it keeps one copy on your device for up to 7 days and removes it when you sign out. The exception: if signing out leaves changes that hadn't synced yet (for example your session expired while offline), those changes and the copy stay on your device until you sign back in, or the copy expires after 7 days.
• Website data — stays in your browser until you clear it.

Synced data is protected per-account by row-level security, so each account can access only its own data. On iOS, your sign-in session is stored in the device Keychain.

• Use the app signed out to keep your medication data on your device (and in your own device backups, if you use them) and never on our servers.
• Turn Apple Health access on or off in iOS Settings at any time.
• Reply STOP to unsubscribe from text reminders.
• Delete your account and the data synced to it any time in the iOS app (Account → Delete account), or email the contact below. Deleting removes your synced medication list, settings, and reminder preferences. We keep the record of your text-message consent (phone number, time, and the wording you agreed to) as messaging rules require.

Rx Manager is not directed to children under 13 and we do not knowingly collect their information.

If this policy changes, we will update the date above.

support@rxmanager.us