Privacy Policy — Kartomed

Last updated: October 27, 2026 (the section "Clinics from the Website" added)

This Privacy Notice of Foleks Apps Studio (Oleksandr Fedorko, "we," "us," or "our") describes how the mobile application Kartomed — Health Records ("the App") handles your information. Kartomed is a personal and family health record: doctor visits, lab results, examinations, vaccinations, medications, reminders and documents.

If you do not agree with this policy, please do not use the App. Questions — kartomed@foleks.com.

Kartomed is not a medical device. It does not diagnose, treat, cure, or prevent any medical condition, and it does not prescribe or replace treatment. Consult a healthcare professional for medical advice, diagnosis, or treatment.

Summary of Key Points

Do we receive your data? No. All records, documents and settings are stored on your device only. We have no server that receives data from the App.

When does data leave the device? Only when you act, and only to the place you chose:

1. a photo or PDF of a document — and, when you ask for an explanation, the lab values — goes to the AI provider you chose, on your own key and after your consent;
2. an encrypted backup goes to your own cloud storage (Google Drive, Dropbox or your WebDAV server), if you switch that on;
3. the name of a clinic and its city go to the Google address lookup service on the phone, if you tap "Find the address";
4. if a clinic has a website, the App downloads that website's icon — a plain request, as a browser makes; none of your data is sent there (can be switched off in the settings);
5. if you recorded a payment in another currency, the App asks the bank that publishes the official rate (National Bank of Ukraine, National Bank of Poland, European Central Bank, Central Bank of Russia) for the official rate of the day of the service — only the codes of two currencies and the date are sent (can be switched off in the settings);
6. if you tap "Package leaflet" next to a medicine, the browser opens a search for its name on a medicines reference site — the site receives only the name of the medicine;
7. files you shared or printed yourself (the PDF for the doctor, documents, an archive export);
8. if you shared a profile with someone close, the exchange file with that profile goes encrypted wherever you sent it yourself (a messenger, mail), or straight to that person's phone next to you over Bluetooth and Wi-Fi, and opens only in Kartomed on that person's phone (see "Shared Profile" below).

What does the App download by itself? Only fresh versions of its dictionaries (diagnoses, medicines, symptoms and others) — once every 30 days and when you tap "Check for dictionary updates" — and, if you added clinics from the website, their addresses and opening hours, also once every 30 days. It is an ordinary download of files that are the same for everyone, from the developer's site; nothing about you or your records is sent (see "Dictionary Updates" and "Clinics from the Website" below).

Analytics, advertising, crash reports? No. The App contains no such tools.

An account? No. There is no registration. You may connect a Google or Dropbox account, if you wish, and only for backups.

Sensitive information? Yes — the health information you enter yourself. It is processed on your device; it leaves the device only in the cases listed above.

1. What Information Does the App Process

Information You Enter

Profiles (name, date of birth, sex, blood type, height, weight, allergies, chronic conditions, an emergency contact), visits, diagnoses, symptoms, prescriptions, lab tests and their values, examinations, vaccinations, home measurements, medication courses and doses, the home medicine cabinet, doctors, clinics, the cost of visits, photos of profiles and doctors, clinic icons, documents (photos and PDF) and the text recognised from them.

All of this is written to a database and a folder inside the App's private storage on your device. We have no access to it.

Device Capabilities

Each one is optional; the App works without any of them.

• Document scanner. The Google document scanner (ML Kit) from Google Play services on the device finds the edges of the page and straightens the shot. The App does not need the camera permission for this. The scans are saved in the App's private storage.
• Camera (CAMERA) — only for the business cards of doctors and clinics: scanning a QR code and photographing a card. The code and the text are recognised on the device; the image is not saved in the health record and is not sent anywhere.
• Reading a business card without AI — on the device, with no internet connection (Google ML Kit and Tesseract).
• Photos and files — through the system picker of photos, files and folders (including a folder of CT and MRI images from a disc or a flash drive): the App receives only what you selected and does not browse your gallery. No permission to access the phone's storage is requested.
• Phone contacts — are not read. The "Add to phone contacts" button opens the system screen of a new contact filled with the details of a doctor or a clinic; you save it yourself. No contacts permission is requested.
• Nearby devices (BLUETOOTH_SCAN, BLUETOOTH_ADVERTISE, BLUETOOTH_CONNECT, NEARBY_WIFI_DEVICES) — only for "Sync nearby" in a shared profile: Bluetooth lets the phones find each other, Wi-Fi moves the exchange file quickly. The permission is asked when you tap that button, after an explanation. These signals are not used to determine your location. On Android 12 the system allows the Wi-Fi search only together with the location permission (ACCESS_FINE_LOCATION, Android 12 only): the App asks for it there with the same explanation, but does not read the location and sends it nowhere.
• Notifications and exact alarms (POST_NOTIFICATIONS, SCHEDULE_EXACT_ALARM, RECEIVE_BOOT_COMPLETED) — reminders to take medicines, of visits and expiry dates, the result of a backup. Notifications are created on the device, with no push service. Reminders are an aid; do not rely on them alone.
• A notification on the lock screen — if you switch on showing emergency information; anyone who picks up the phone will see it, so it contains only the fields you chose.
• PIN and biometric sign-in (USE_BIOMETRIC) — if you wish, the App asks for a 4-digit PIN on launch and after the chosen time in the background, and can be opened with a fingerprint or a face. The PIN is stored only as a hash (an irreversible fingerprint of it) in the Android secure storage; the digits themselves are not saved anywhere and never go into backups. Biometric data is processed by Android; the App never receives it. A forgotten PIN cannot be recovered; it can be reset by confirming yourself with the phone's screen lock — this only switches the PIN off, no records are deleted.
• Network (INTERNET, ACCESS_NETWORK_STATE) — only for AI recognition and explanations, cloud backups, clinic icons, exchange rates and dictionary updates (sections below), and to check whether Wi-Fi is available for a backup.
• Technical permissions with no access to your data: VIBRATE — vibration of notifications; WAKE_LOCK — the Android system job scheduler keeps the phone awake while a backup or an update of reminders is running.

Recognition and Explanations With AI (optional)

What you set up. You choose a provider (Anthropic, OpenAI, Google Gemini, OpenRouter, Alibaba Qwen, DeepSeek or an address of your own), obtain a key from that provider yourself and enter it into the App. The account, the payment and the terms are between you and the provider; we are not a party to them.

What is sent. For recognition — the images or the PDF of the pages of the chosen document and an instruction saying what kind of document it is and which language to translate into. A document may show your name, date of birth, diagnoses, test results and other details — the provider receives everything visible in the image. For an explanation of lab results — only the names of the tests, the values, the units and the reference ranges; sex and age only if you switch that on separately. Your name and photo are never sent for an explanation.

When. Only after your consent in a separate window (it appears before the first sending to each provider) and only when you act. By default the App shows exactly what will be sent before each sending.

Where. Directly from the device to the provider's servers over HTTPS, with no server of ours in between. The provider's servers may be in another country. What the provider does with the data afterwards (whether it keeps it, for how long, whether it trains on it) is governed by its policy and the terms of your account with it. Free models are often free because the provider keeps the data.

What we receive. Nothing: not the documents, not the key, not even the fact that you use the feature.

The key. It is stored in the Android secure storage and is not written into the database. A key goes into a backup only in encrypted form — inside a backup protected by your password — so that you do not have to enter it again after a restore; this can be switched off in the backup settings ("AI keys in the backup"). A backup without a password never contains keys.

The result. What AI recognises may contain mistakes; you check and confirm every field before it is saved. AI explanations are reference information, not a diagnosis. You can report a problem with an AI answer with the button next to it — it opens an e-mail to us with the text of the answer; you decide what to send in it.

How to stop. Delete the key or withdraw your consent in Settings → AI recognition. Data already sent stays with the provider — ask the provider to delete it if you need that.

Backups (optional)

A backup is the App's database and all your documents. Where it can be kept: a folder on the phone, your Google Drive, Dropbox or your WebDAV server.

• Cloud backups are always encrypted with your password (AES-256-GCM) on the device before they are sent. Neither the cloud service nor we can read them. A backup cannot be restored without the password; the password is stored in the secure storage of your phone, and you can view it in the backup settings after confirming with the phone's screen lock (or with the App's PIN if the phone has no screen lock).
• Google Drive: only the drive.file permission is requested — access only to the files and the folder the App itself creates. Dropbox: access only to the App's own folder. WebDAV: the address, user name and password of your server; the password is kept in the secure storage.
• The e-mail address of the connected Google or Dropbox account is shown in the backup settings and stored on the phone only.
• Kartomed's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: the Drive access is used only to store and retrieve your backups, it is never transferred to anyone, never used for advertising, and nobody reads it.
• A backup to a folder on the phone and an archive export (.zip) may be unencrypted — these are ordinary files under your control; treat them as medical documents.
• Switching a cloud off in the App forgets the account and revokes the access. Backups already in the cloud stay there until you delete them.

Shared Profile (optional)

A profile can be shared with someone close who also has Kartomed: to view only, or with full access when you keep the medical card together. There is no server of ours for this — the phones exchange files directly.

• What is sent: the whole profile — records, lab results, medicines, documents and scans, and the doctors, clinics and own dictionary entries those records refer to; then every change. The medicine cabinet, reminders and settings stay on your phone.
• How: you send the .kartomed file yourself through the system "Share" menu (a messenger, mail) or show the invitation QR code to a phone next to you. When the phones are side by side they can be synced with "Sync nearby": the same file goes straight from phone to phone over Bluetooth and Wi-Fi (Google Nearby Connections of Google Play services on the phone), with no internet and no servers of ours; other phones nearby see only the name "Kartomed", not your name or profile data. The file is encrypted (AES-256-GCM) with a random key only you and that member have; the key is kept in the phone's secure storage. An invitation file is also locked with a password you tell separately. The messenger or mail service carrying the file cannot read it, and we never receive it.
• Who receives it: only the person you sent the file to or showed the QR code. Before the first invitation the App shows exactly what will be sent.
• Revoking: you can revoke a member's access — the exchange with them stops. But the copy of the profile already on their phone cannot be deleted from your phone. A member can "Disconnect" and keep the copy or delete it.

Looking Up a Clinic's Address (optional)

When you tap "Find the address", the name of the clinic and its city are passed to the address lookup service built into Android (Google Play services on your phone), which asks Google and returns the address and the coordinates. Nothing else is sent. It is processed under Google's privacy policy. The "Route" button opens the maps app installed on the phone.

Clinic Icons (optional)

If a clinic has a website, the App downloads its icon from that website: it opens the site's home page and the icon itself — the same way a browser does. The clinic's site sees only an ordinary request from the internet; your records and other data are not sent there. No third-party icon services are used. The download can be switched off in the settings ("Load clinic icons from their sites"), and an icon can be removed or replaced with your own photo.

Exchange Rates (optional)

If you recorded a payment in a currency other than the main one, the App converts it at the official rate of the day of the service. For that it asks the bank that publishes it for the rate — the National Bank of Ukraine (bank.gov.ua), the National Bank of Poland (nbp.pl), the European Central Bank (ecb.europa.eu) or the Central Bank of Russia (cbr.ru). The request carries only the codes of two currencies and the date; neither the amount nor your records nor any other data are sent. The download can be switched off in the settings ("Load exchange rates"), and you can enter the amount in the main currency yourself.

Dictionary Updates

The dictionaries (diagnoses, medicines, symptoms, doctor specialties, vaccines, allergens) are built into the App and work offline. To keep them from ageing between releases, once every 30 days after a start, and when you tap "Check for dictionary updates" in the Dictionary, the App checks their publication on the developer's site (kartomed.foleks.com, or its copy alxpanther.github.io/kartomed_packages when it is unavailable) and downloads only the files that changed. It is an anonymous download of files that are the same for every user: no account, no device identifier, none of your records or settings. The files are served by Cloudflare and GitHub Pages; as with opening any web page, they see the IP address of the request and handle it under their own policies; we receive no information from them about who downloaded the files. A file is accepted only when its checksum (SHA-256) matches; otherwise the previous dictionaries stay.

Clinics from the Website

In "Clinics" you can choose a country and a city and add clinic and laboratory networks with their addresses, phones, opening hours and icons. The developer takes this information once a month from the networks' own public contact pages and publishes it next to the dictionaries (kartomed.foleks.com/packages, copy: alxpanther.github.io/kartomed_packages/packages). The App downloads the common list and the files of the networks you choose, and once every 30 days after a start, updates of only the networks you added. It is the same anonymous download of files that are the same for everyone: the chosen country and city, your clinics and your records are not sent anywhere. Addresses where you have records are never changed or removed without your consent.

Medicine Leaflets

The "Package leaflet" button next to a medicine opens a search for its trade name on a medicines reference site in the browser: Tabletki.ua and Compendium (compendium.com.ua), or Vidal.ru and Rlsnet.ru if the family's country is Russia. The site receives only the name of the medicine — just as if you had typed it into its search yourself; the dose, the course, the profile and any other records are not passed on. The App itself downloads nothing from these sites; the page opens in your browser and is handled under that site's rules.

Storage and Security

All data is kept in the App's private storage on the device. Access can be protected with a PIN and a fingerprint; the App's content can be hidden in the list of recent apps (this also blocks screenshots). The automatic Android cloud backup is switched off for the App's data — your health data does not go into the system backup without your knowledge. Moving to a new phone with Android's own transfer (by cable or Wi-Fi while setting up the phone) moves the records and documents, but not the contents of the secure storage: AI keys, the backup password and the PIN have to be entered again on the new phone, and a shared profile has to be invited again.

2. How We Process Your Information

We do not process it — the App processes it on the device to show records, charts and reminders and to create PDF files. Data leaves the device only in the cases of Section 1, each of which you switch on yourself.

3. With Whom We Share Information

We do not share your information with anyone and do not sell it. Data leaves the device only when you act: to the AI provider you chose, to your cloud storage (encrypted), to the Google address lookup service (the name and the city), to the banks that publish the rates (only the currency codes and the date for a rate), to a medicines reference site (only the name of the medicine, in your browser), to the person you shared a profile with (as an encrypted file), or to wherever you sent a file yourself.

We may transfer the rights to the App in a merger, sale or reorganisation of the business; this gives the new owner no access to the data on your device.

4. How Long Information Is Kept

As long as the App is installed. When the App is uninstalled, Android deletes all its data. Individual records, documents and profiles can be deleted in the App at any time. The copy of a shared profile on another member's phone stays with them until they delete it. Backups stay where you saved them until you delete them; in the cloud the App itself deletes old backups beyond the number you set.

5. Children

The App is intended for adults (18+). An adult may keep in it the health record of their child or of a person in their care — that data is likewise stored only on the adult's device. We do not knowingly collect children's data. If you believe this has happened, write to kartomed@foleks.com.

6. Your Rights

Everything is under your control on the device: view, correct and delete records, export them to PDF or an archive. Consents are withdrawn in the App (AI, cloud backups) and in the Android settings (permissions). Withdrawing does not affect what was already sent before it. For data held by an AI provider or a cloud service, contact that provider. Questions — kartomed@foleks.com.

7. Do-Not-Track

The App does not track your activity, so Do-Not-Track signals do not apply to it.

8. Changes to This Policy

We will update this policy when the App or the law changes; the date of the update is shown at the top. We will announce material changes in the App ("What's new").

9. Contact Us

kartomed@foleks.com