Privacy Notice
Last updated September 22, 2026.
Who is the data controller
The data controller for CardioTrack is Dawood Togoo (sole operator), based in Doha, Qatar. Privacy questions, individuals' rights requests, and data breach reports should be sent to contact@cardiotrack.org (also the contact for the designated Privacy Officer, Dawood Togoo).
What data the app may store on this device
Profile information you enter (name, date of birth, automatically calculated age, sex, country, optional ethnicity), height, weight, blood pressure, heart rate, SpO₂, sleep, steps, medications and dose history, symptoms, documents you upload, lab results, source labels, risk-score inputs and snapshots, family-history entries, alerts, and a privacy audit log.
Health and special-category data
Health data and ethnicity are special-category personal data under Qatar Law No. 13 of 2016 (PDPPL Article 16) and equivalent provisions in GDPR Article 9. The app processes these only on the basis of your explicit consent, captured at onboarding and revocable in Settings → Privacy choices.
How data is used
Data is used to provide in-app tracking, charts with source labels, risk calculations, medication safety rules, user-requested exports, and the audit log. If you opt in, it may also be used for encrypted account backup or device-composed weekly and medication notifications. Research enrollment and research data contribution are disabled in this release, so the app does not collect or transmit user data for research. The app does not sell data, use it for advertising or marketing, train models on it, or perform automated decision-making with legal effect. Cardiovascular risk calculators are deterministic published equations presented for educational use only.
Where data is stored
By default every CardioTrack record stays on this device: browser localStorage on the web, or the app sandbox on iOS and Android. Optional account backup writes an encrypted, account-scoped copy to Supabase, and cloud OCR sends one chosen report for extraction. If you separately enable notifications, the device prepares the finished message and temporarily queues it in Supabase for delivery. Notification email is sent only to your verified account address. Notification content is removed after final delivery or failure, and pending content is deleted when you turn a channel off. Authentication tokens are never included in account backup.
Processors and any data sharing
CardioTrack does not sell your data or share it with advertisers or data brokers, and it has no analytics or advertising SDK. Processors may include Vercel for web hosting; Supabase for authentication, opted-in storage, and short-lived notification relay; Microsoft Azure for a report you explicitly send to cloud OCR; Resend for opted-in email summaries; Zoho Mail or Resend for support messages you choose to send; and Apple, Google, or a browser push service for opted-in push delivery. Local document recognition and Apple Health reading stay on the device. Remote notification delivery remains unavailable until the operator completes the stated processor and production checks.
Support reports
Preparing a support report stays on your device. When you choose Send to CardioTrack, Supabase passes the reviewed text, optional reply email, and any technical events you selected to the configured mail provider (Zoho Mail or Resend) for delivery to the operator's support mailbox. Stored health records, uploaded files, passwords, and account identifiers are not automatically attached. The technical log contains only allowlisted event names, timing and item counts. Do not include identifying health information in your message. The delivery database stores only a random reference, keyed hashes of the message and client address, delivery state and timestamps; it does not store report text, email addresses or raw IP addresses. Delivery metadata is removed by a daily cleanup once it is over seven days old. The message also exists in the email service and support mailbox while the operator handles your request; contact support to request deletion. Sending support mail can transfer the reviewed information outside Qatar. This feature is not monitored for medical emergencies.
Cross-border data transfers
If you keep optional online features off, no cross-border transfer of tracked health data occurs. Signing in sends account identity to Supabase. Account backup, cloud OCR, full-detail remote push, and email summaries can transfer the corresponding data outside Qatar, each behind a separate consent choice under PDPPL Articles 16 and 17. Minimal push contains no measurements or medication names but still transfers a device identifier and message metadata. Research data is not collected or transferred in this release.
Retention
On-device data is retained until you delete it. Account backup remains until you turn it off or delete the account. Notification content is blanked after final delivery or failure; sent queue rows are deleted after 24 hours, failed rows after seven days, and delivery logs keep only message type, channel, outcome, and time. Turning a notification channel off deletes pending content and push registrations. Encrypted cross-device transfers expire after 24 hours. Research enrollment is disabled. If an earlier test build created pseudonymous research records, its device-only withdrawal control remains available to request deletion of those legacy records.
Your rights
You can: (1) access - every record is visible in the app and exportable as JSON or CSV via Settings → Export my data; (2) rectify - edit medications and onboarding details directly; (3) erase - Settings → Delete all my data clears every entry, or use clearAll-equivalent per-entity controls; (4) object / withdraw consent - Settings → Privacy choices toggles each consent and offers a 'Withdraw all' action; (5) portability - the JSON / CSV export is machine-readable; (6) lodge a complaint with the Qatar National Data Privacy Office (NDPO).
Security
On iOS, app data is sandboxed and protected by the platform's Data Protection class when the device is locked. On Android, app data sits in the per-app sandbox protected by the operating system's own controls. On web, browser localStorage is not encrypted at rest - for highly sensitive use, prefer the iOS or Android app. The app uses HTTPS for all network requests. Account backup is encrypted on your device with AES-GCM under a key derived from your passphrase, so Supabase stores ciphertext rather than readable records; row-level security separately limits the row to your account. CardioTrack does not upload your backup passphrase, and research uploads are disabled in this release.
Children
CardioTrack is intended for adults 18 and over. Onboarding asks you to confirm you are 18+. The app does not knowingly process data from minors. If you become aware that a minor has used the app, contact the privacy officer to have data erased.
Changes to this notice
This notice is reviewed at least annually and on any material change to the app's data handling. The current version date is shown above. When the consent-statement version changes, you will be asked to re-confirm consent on next launch.
Legal review status
This notice is maintained by the operator and is kept in step with what the app actually does; it was last reconciled against the shipping build on the date shown above. It has not yet been reviewed by a Qatar-qualified privacy lawyer, and such a review remains outstanding for both this notice and the Terms of Service.