What happens to your health data
This page describes how the app actually behaves. For the formal document, see the Privacy Policy; to remove data, see deleting your data.
- The short version
- Where data lives
- What can leave your phone
- What the app doesn’t do
- Permissions
- Third-party services
- Access control
- The honest trade-off
The short version
Your records live encrypted on your own phone. Mediara operates no server that receives them, so we cannot read, recover, correct or hand over your health data — not as a policy, but because the route does not exist. There is no analytics and no tracking of any kind, and your health records are never used to select or target anything shown to you.
Where your data lives, and how it is protected
The database
Every record you create sits in a SQLite database that is encrypted as a whole file (SQLite3MultipleCiphers), with additional per-field encryption on sensitive columns. There is no plaintext copy on disk at any point.
Documents and photos
Every prescription photo, report scan and wound photo is encrypted with AES-256-GCM in a file vault inside the app’s private sandbox. Other apps cannot read it, and it is never written to shared storage.
The keys
The encryption key never leaves your device’s hardware-backed keystore. Locking the app drops decrypted health data from memory, and the temporary image used for text recognition is shredded as soon as the text is read.
Two consequences worth stating plainly. Android’s own cloud backup and device-to-device transfer are switched off for this app, so your records never ride an OS channel the app does not control. And “Hide app contents” is on by default, which blocks screenshots and blanks the app in the recent-apps switcher — so if a screen capture of the app comes out black, that is the feature working.
The complete list of what can leave your phone
Not a summary — the whole list. Every row is something you start.
| What | When | Where it goes |
|---|---|---|
| An encrypted backup archive | Only when you back up | The private app folder of your own Google Drive |
A “Share with Doctor” PDF, a shared document, or a .mediara file | Only when you tap Share or Save | Wherever you send it, through Android’s share sheet |
| A Google sign-in token exchange | Only if you connect a Google account | Google’s authentication servers |
| A crash report | Only if you turned the setting on and then chose to send one yourself | Wherever you send it. The app never transmits it |
| Voice dictation audio | Never | On-device recognition is required, not merely preferred — see below |
There is no telemetry, no analytics and no developer server for anything to go to. A small amount of unencrypted metadata does accompany each backup file in your Drive so the restore screen can list backups before decrypting them: the date, the format version, and a count of profiles. The profile names themselves are encrypted.
What the app does not do
- No analytics or telemetry. No analytics SDK is linked into the build.
- No crash-reporting service. There is no crash SDK and no endpoint. The optional Crash reports setting (in Settings → Privacy, off unless you turn it on) writes a short technical note to the phone only: the time, the app and Android versions, the error type and message, and up to 20 stack frames. The record has no field for a name, note, title or file, so nothing of yours can land in it, and the error text is reduced before it is stored. You read it, send it yourself if you want to, or delete it — turning the setting off deletes whatever was saved. At most five are kept, and a companion screen shows the exact field list before you decide.
- No advertising identifier, no cross-app tracking, no profiling of you or your health data.
- No advertising component ships in the app today. Independently of that, the Privacy Policy binds the limits in advance: health records are never used to select or target anything, no advertising identifier is collected, and nothing is sold or shared with an advertising network. Any change of that kind is a material change that requires your fresh consent before it takes effect.
- No selling or sharing of personal data with third parties.
- No developer-operated server that receives your health data.
These are checked against the shipping build, not just the source: the release bundle is scanned for the permissions it actually declares after every dependency has merged its own, and for the presence of common analytics, crash and advertising libraries by class path. The check includes deliberate positive controls — Google Play Billing and Google Sign-In are found — so a clean result cannot come from a search that was looking in the wrong place.
Permissions, and why each one exists
| Permission | Used for | Data sent anywhere? |
|---|---|---|
| Camera | Photographing prescriptions, reports, wound photos and profile pictures | No — images go straight into the encrypted vault |
| Microphone | Voice dictation into notes fields, only while you are dictating | No — see the note below |
| Notifications | Medication, appointment, vaccination and measurement reminders | No |
| Alarms & reminders (exact alarms) | Firing reminders on time rather than whenever the system feels like it | No |
| Run at startup | Re-arming your reminders after the phone restarts | No |
| Health Connect (read only) | Importing vitals you already track on a watch, ring, band or scale | No — read locally; write access is never requested |
| Internet | Google sign-in and Google Drive backup and restore. Nothing else | Only the two destinations above |
| Biometric | Unlocking the app, and turning caregiver mode back off | No |
The app requests no location, no contacts, no SMS, and no advertising-ID permission, and it does not ask for broad storage access — gallery selection goes through Android’s own photo picker, which hands back only the one file you chose.
Every speech session is opened with on-device recognition required, which the platform defines as failing rather than quietly falling back to a network recognizer. So there is no “it depends on your phone”: either your device recognises speech locally, or the microphone is disabled with an explanation and nothing is captured. If dictation is unavailable, installing your language’s offline speech pack in Android’s settings enables it.
Third-party services
Each one activates only when you use the feature that needs it. None of them receives your medical records from us — we have none to give.
| Service | When it runs | What it handles |
|---|---|---|
| Google Sign-In | Only if you set up Drive backups | Standard Google account authentication. No health data |
| Google Drive (app-data folder) | Only when you back up or restore | Your already-encrypted archive, plus the minimal listing metadata described above |
| Android Health Connect | Only if you connect it | Read-only import of the vitals you authorise. Processing stays on your device |
| Google ML Kit text recognition | Only when text is read from a document | Converts your image to text on the device. The model runs locally; images are not uploaded |
| Your device’s speech recognizer | Only while you dictate | Audio to text, in on-device mode only. The app stores no audio and runs no audio service |
| Android photo picker, camera, file picker | Only when you attach something | Returns the single item you chose. The app holds no gallery or storage permission |
| System dialer | Only when you tap an emergency contact | Opens the dial screen with the number. The app does not place calls itself |
| Google Play Billing | Only if you buy Mediara Plus | Google handles the purchase under its own terms. Mediara never receives your payment details, and no health data is involved in or linked to a purchase |
To help you set up Health Connect, the app checks locally whether specific companion apps are installed — Samsung Health, Fitbit, Garmin Connect and so on — using narrowly declared package visibility. That check happens on the device; no list of your installed apps is collected or transmitted.
Full third-party and open-source notices
Who can get at your records
Realistically, three parties, and you can narrow all three:
- Anyone holding your unlocked phone. Close that with the app’s biometric unlock and a short lock timeout — immediate, 5, 15, 30 or 60 minutes, or never for the session. Device PIN or pattern always works as the fallback; the app has no password of its own.
- Anyone you hand a PDF or a document to. Once shared, it is outside the app’s protection and where it goes next is up to you.
- Someone with full control of your Google account — but only for account-protected backups. A recovery-code backup is end-to-end encrypted and cannot be opened by Google, by an attacker with your account, or by us.
Other controls worth knowing about:
- Discreet notifications hide medicine names in the notification shade and on the lock screen.
- Caregiver mode makes a profile read-only app-wide, and turning it off requires authentication.
- An audit log records every create, edit, delete and restore in a hash-chained, tamper-evident history you can read from Settings, bounded to 180 days or 50,000 entries. Pruned history is sealed behind a checkpoint carrying the rolling hash, so pruning cannot be used to hide a changed entry.
- The Emergency Card exposure is opt-in. If you turn it on, a limited set of fields can be read from the app’s own lock screen without your fingerprint. It does not put anything on the phone’s lock screen, and nothing else in the app is reachable that way.
The honest trade-off
Privacy this strong has a cost, and it is worth understanding before you rely on the app.
We cannot recover your data. Because we never receive it, we cannot view it, correct it, restore it after a lost phone, decrypt a code-protected backup for you, or reset a recovery code. If your phone is lost or reset and you have no backup, the records are gone permanently — and that is the same property that stops anyone else from reading them.
So set up a backup on day one. How backup and restore work.
One claim the app deliberately does not make
Mediara Vault makes no “HIPAA compliant” claim. HIPAA governs healthcare providers and their processors; Mediara Vault is a personal tool under your control that stores data on your device and in your own Drive. The protections here are real — encryption at rest, an end-to-end encrypted backup option, no third-party access — but “HIPAA compliant” would be the wrong label, and a misleading one.
Read it in full, or delete it all.
The formal policy sets out every commitment; the deletion page shows every control, including how to remove your Drive backups.
Mediara Vault is a personal record-keeping app. It does not diagnose, treat or give medical advice, and it is not a substitute for talking to a healthcare professional. In an emergency, call your local emergency number. Read the full medical disclaimer.