Privacy Policy

NOTICE — This document is an autopilot-generated draft. It must be reviewed by qualified counsel before publication. The Japanese version of this policy is authoritative; the English version is provided for reference only. In the event of any discrepancy, the Japanese version controls.

Service: ShohoNote (処方メモ) Provider: tmedilab — a sole proprietorship operated by Takumi Hirose (hereafter "we", "us", or "our") First published: 2026-06-15 (draft) Last revised: 2026-06-15 (draft)

1. Scope

This Privacy Policy ("Policy") applies to the iOS application "ShohoNote" ("App") and any pages on our website that link to this Policy (collectively, "Service"). By downloading, installing, or using the App, you agree to this Policy.

2. Information We Collect

2.1 Information you provide

• Email address — for account registration and login authentication.
• Nickname — as a display name in community features. You are not required to enter your real name.
• Password — stored hashed in the Supabase authentication backend; the plaintext is never accessible to us.
• Community content — review text, ratings (4 axes), tags, and other content you submit through community features. This content is publicly viewable to other users of the Service.
• Medication history data — the medication log you enter for yourself and your registered family members (drug name, date/time, dosage, notes). This data is not public and is used only by you and your registered family members.
• Family member information — display names for the family members you register. We recommend a non-real-name string.

2.2 Information collected automatically

• User ID — an internal identifier issued by Supabase; used only within the Service for account identification.
• File Timestamp — Apple Required-Reason-API category C617.1; used by SwiftData and FileManager internals.
• System Boot Time — Apple Required-Reason-API category 35F9.1; used by MetricKit for performance telemetry and cache freshness arithmetic.
• UserDefaults — Apple Required-Reason-API category CA92.1; used for app state preservation.

Note (added per Phase 216 audit): among the items above, "nickname", "medication history", and "family member display names" are declared under Apple's App Privacy category NSPrivacyCollectedDataTypeOtherUserContent (user-generated content) in PrivacyInfo.xcprivacy. Because ShohoNote does not integrate with HealthKit, medication history is classified as User Content rather than Health and Fitness data.

2.3 Information we do not collect

• Advertising identifier (IDFA) — no ad SDK is integrated (NSPrivacyTracking = false).
• Location data — the App does not use any location APIs.
• HealthKit data — the App does not integrate with HealthKit.
• Contacts / Photos / Camera / Microphone — none of these are accessed.
• Third-party analytics or tracking SDKs (Google Analytics, Firebase, Sentry, Crashlytics, etc.) — none are integrated.

3. Purpose of Use

We use collected information solely for the following purposes:

1. Account management and authentication — email, password, user ID.
2. Service functionality — recording medication history and sharing it among the family members you register (history data, family member info).
3. Community features — review posting and viewing (nickname, posted content).
4. Service quality improvement and failure analysis — anonymized performance telemetry via MetricKit.
5. Compliance with legal obligations — responses to law enforcement or other government requests when required by law.

4. Third-Party Disclosure

We will not disclose personal information to third parties without your consent, except:

1. when required by law;
2. when necessary to protect a person's life, body, or property and obtaining consent is difficult; or
3. when transferring data to processors strictly to provide the Service, as described in Section 5.

5. Processors and Third-Party Services

The Service uses the following third-party services. Each provider's handling of personal information is governed by that provider's own privacy policy.

When you post content via the community features, that content is stored in Supabase-managed databases and is viewable by other users of the Service.

6. Cookies and Tracking

The App does not use cookies or similar tracking technologies. The App does not perform "tracking" as defined by Apple's App Tracking Transparency framework (NSPrivacyTracking = false).

7. Health Information

The App treats medication-history entries that you enter as user content, not as protected health information. The App does not integrate with Apple HealthKit and does not send any data to the Apple Health app.

The medication history feature is intended as a personal record you may share with your healthcare professional. We do not use App data for medical or clinical purposes.

8. Retention

• Account data and all related records we hold are deleted from our Supabase environment within 30 days of you initiating account deletion.
• Cache data stored on-device (SwiftData) is removed when you uninstall the App.
• Information we are required by law to retain will be kept for the legally required period.

9. Your Rights

You have the following rights regarding personal information we hold about you:

1. Right to access — request disclosure of the personal information we hold.
2. Right to rectification — request correction of inaccurate information.
3. Right to erasure — request deletion or cessation of use of your personal information.
4. Right to withdraw consent — withdraw consent to this Policy with future effect (after which the Service can no longer be used).

You may exercise these rights via the My Page → Account Deletion flow inside the App, or by contacting tmedilab.support@gmail.com. We will respond promptly after verifying your identity.

10. Children's Privacy

The App is rated 4+ on the App Store but is not specifically directed at children. If you are under 13, please use the App only with parental consent. We do not knowingly collect personal information from anyone under 13 without parental consent.

11. International Transfers

Supabase stores data in data centers located in the United States and Asia-Pacific regions (including Japan). By using the Service, you consent to your personal information being transferred internationally.

12. Changes to This Policy

We may revise this Policy from time to time. Material changes will be announced via in-app notification or our website at least 30 days in advance. The revised Policy will become effective on the date we specify.

13. Contact

Questions about this Policy:

• Email: tmedilab.support@gmail.com
• In-app: "My Page → Contact" form

Appendix

• Initial publication: 2026-06-15 (draft)
• Effective date: _____ (to be confirmed at publication)
• Version: v1.0