1. Introduction

Epilog ("we," "our," or "the App") is a seizure, medication, and diary tracking application designed to help individuals with epilepsy organise and record their health information. The App is available on iOS (including an Apple Watch companion where offered) and Android. The client is built with React Native so both platforms share the same privacy design described below. This Privacy Policy explains how Leandro Barreto / LND Tech ("the Developer") handles your information when you use the App.

By using Epilog, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

2. Information We Collect

2.1 Data You Provide (Stored Locally)

When using Epilog, you may enter the following types of information, which is stored exclusively on your device in an encrypted local database (iOS Data Protection / Android Keystore-backed encryption as applicable). The logical record shapes are the same on both platforms:

• Seizure records (date, time, duration, type, severity, triggers, location context, recovery time, optional attached video filename)
• Medication information (names, dosages, frequencies, side effects, prescriber information, stock levels)
• Emergency protocol details (medications, triggers, doctor and hospital information)
• Diary entries (mood, stress levels, anxiety, energy, sleep quality, personal notes, weather, tags)
• Automatic weather diary entries created when you save a seizure (condition label plus a locked weather text snapshot with temperature, humidity, and pressure — stored locally; notes remain editable)
• Location context for seizures and diary entries (general location type such as "home" or "work" — not GPS coordinates)
• Patient profiles (names, relationships, notes, colour preferences) when using the multi-patient feature
• Doctor-only patient source labels (custom names and categories such as hospital, clinic, or personal) — stored locally on the doctor's device and never synced to the patient vault
• Seizure notification contacts (names and email addresses you add for Epilog Pro email alerts)
• Optional seizure videos you choose to record during an event (stored locally in the App and optionally copied to your Photo Library)

2.2 Data We Do NOT Automatically Collect

Epilog does not automatically collect or transmit:

• Your name, email, phone number, or postal address (unless you voluntarily provide them for a specific feature such as seizure email alerts)
• GPS location data or precise geolocation stored in your health records (unless you choose to capture GPS on a seizure when that option is enabled). When you record a seizure, Epilog may briefly use your current location on-device to request local weather from a weather provider; coordinates are not saved on the weather diary entry and are not sent to AI Insights
• Device identifiers in anonymous research payloads (IDFA, IDFV, account IDs, etc.)
• Behavioural analytics beyond standard ad network practices when ads are shown (see Section 9)
• Your address book or contacts list (you manually enter notification contacts)
• Camera or microphone content — except when you explicitly start a seizure video recording. Videos stay on your device (and optionally your Photo Library) and are not uploaded to our servers

2.3 Anonymous App Account (Firebase)

On launch, Epilog may sign you in anonymously with Google Firebase Authentication. This creates a random user identifier (UID) that is not linked to your name, email, or phone number in the App. We use it only to:

• Fetch a read-only public catalog of in-app tips/messages (JSON on lndtech.eu; legacy Firestore path may still exist)
• Enforce fair-use limits for free-tier AI Insights (once per week)
• Maintain a lightweight app registry (language, app version, Pro status, last seen — no health records)

This UID is stored in Firebase (users/{uid}) and is separate from your local health database.

2.4 Sign in with Apple & doctor sharing (optional, Epilog Pro)

If you choose the healthcare provider role or use Share with doctor, Epilog uses Sign in with Apple linked to Firebase Authentication. The patient creates a QR code from Cloud Sync. The doctor scans it and requests access. The patient must approve before any records are shared.

What is shared: the same encrypted Cloud Sync vault. The owner can invite one caregiver with write access and doctors with read-only access. Sync requires Epilog Pro on at least one of those accounts. Photos and videos stay on the patient's device. The doctor's private source labels stay on the doctor's device. Either party can revoke the link. The vault key travels with the invite so members do not need the patient's PIN. The PIN is never sent to our servers.

3. Data Storage

This means:

• Your data is protected by your device's security features (Face ID, Touch ID, passcode)
• We cannot remotely access, view, or retrieve your local health records
• There is no automatic cloud backup unless you opt in under Settings and enable Cloud Sync. Sync requires Epilog Pro on at least one sharing party (patient, caregiver, or doctor)
• Optional Cloud Sync stores encrypted copies of clinical records in Google Firebase Firestore. Records are encrypted on the device (AES-GCM) before upload. A PIN you choose (4–8 digits) wraps the vault key and is never sent to our servers. We cannot read the contents. Videos and photos stay on the device. If you forget the PIN, synced data cannot be recovered; data on the device is unaffected. Account sign-in and Pro status are stored on LND Tech servers (lndtech.eu) only — not your health records
• From that vault you may invite one caregiver (write access) and doctors (read-only), only after a QR approval. You can revoke access. The doctor's private source labels stay on the doctor's device
• Optional Device Sync (Epilog Pro) is separate from Cloud Sync. Linking two phones notifies the other phone when a seizure starts, and again when it is saved. The saved alert includes the person's name and how long the seizure lasted so it can be shown on that phone. The notification text is not stored on our server. The phone that receives it may save the seizure on that device. Any encrypted envelope used to deliver records is deleted after delivery or expiry
• If you delete the App, local data stored by Epilog is removed from your device (subject to device backup settings)
• The App supports optional biometric lock (Face ID/Touch ID) for an additional layer of privacy
• Apple Watch data syncs between your iPhone and paired Watch over Apple's local Watch Connectivity — not through our servers

4. Anonymous Research Data Sharing

4.1 Purpose

When you enable this feature, Epilog sends anonymised snapshots of your medication, seizure, mood, and demographic data to a secure research database hosted on Google Firebase Firestore. Snapshots are sent when you save a diary entry, at most once per calendar day while the feature remains enabled. The data is aggregated for statistical and clinical research purposes only — not for advertising or marketing.

4.2 What Is Transmitted

When this feature is enabled, the App uploads a snapshot (schema version 9) containing only the following anonymised fields:

Demographics (per patient profile, no names or IDs):

• Relationship category from predefined options (e.g. Self, Child, Parent)
• Age band derived from birthdate (e.g. 0-12, 13-17, 18-29, 30-49, 50-64, 65+, or unknown) — exact birthdates are never sent
• Whether a birthdate was recorded (hasBirthdate)
• Rare syndrome, when one is recorded: a predefined category code (for example dravet or christianson), or the short condition name typed under Other (at most 20 characters). Profile names are never used for this field

Medications (per entry):

• Medication name (as you entered it in the App)
• Frequency (predefined categories only)
• Medication category (predefined categories only, if recorded)
• Whether currently taking
• Dose unit (if recorded)
• Total daily dose (if recorded)
• Reported side effects from predefined categories only (free-text or "Other" side effects are excluded)
• Approximate duration on medication in months (rounded; exact start dates are not sent)
• Relationship, age band, and rare syndrome copied from the linked patient profile (syndrome only when one is recorded)

Seizures (per entry):

• Month and year only (e.g. 2026-06) — exact date and time are never sent
• Time-of-day bucket derived locally (Early Morning, Afternoon, Evening, or Night) — not the exact clock time
• Seizure type (from predefined categories)
• Severity rating (1–5 scale)
• Duration in seconds
• Whether rescue medication was taken
• Whether the seizure was recorded via Apple Watch
• Predefined triggers only (free-text or "Other" triggers are excluded)
• General location category from predefined options (e.g. "Home", "Work") — custom location text is never sent
• Broad anonymised region derived from coarsened GPS (city, municipality, or administrative area) — raw coordinates are never sent
• Whether GPS coordinates were present on the seizure (hasCoordinates) — a yes/no flag only; coordinates themselves are never sent
• Region resolution status (regionStatus): no_coordinates (no GPS on the record), geocode_failed (coordinates existed but could not be turned into a region), or geocoded
• Post-ictal recovery duration and rescue medication timing (if recorded)
• Relationship, age band, and rare syndrome copied from the linked patient profile (syndrome only when one is recorded)

Mood / diary entries (per entry):

• Month and year only — exact date and time are never sent
• Time-of-day bucket (Early Morning, Afternoon, Evening, or Night)
• Star rating (1–5, if recorded)
• Mood tags from predefined categories only (e.g. Anxious, Calm, Tired)
• Stress, anxiety, energy, and sleep quality ratings (1–5 scales)
• Mood category from predefined options
• Whether the entry signals elevated risk based on mood data
• Relationship, age band, and rare syndrome copied from the linked patient profile (syndrome only when one is recorded)

Snapshot metadata:

• Schema version (schemaVersion)
• Submission month and year (submittedMonthYear) — no exact upload timestamp is included in the payload

4.3 What Is NEVER Transmitted

The anonymous research upload explicitly excludes:

• Your name, email address, phone number, or any contact information
• User IDs, patient profile names, photos, or device identifiers (IDFV, IDFA, etc.)
• Exact birthdates or age in years — only broad age bands are sent
• Free-text fields: notes, prescriber names, product descriptions, diary notes, custom locations, or custom triggers
• Exact dates, times, or timestamps of seizures, mood entries, or medication events
• Emergency protocol details, doctor or hospital names
• GPS coordinates or precise geolocation data
• Weather, doctor flags, keto/glucose levels, and stock-tracking details

4.4 When Uploads Occur

While the feature is enabled, an anonymised upload is sent when you save a diary entry (mood, medicine, or sick log), at most once per calendar day. The first upload may also happen when you continue past the welcome screen with sharing enabled, or when you turn the feature on in Settings → Research & Privacy. Disabling the toggle immediately stops any future uploads.

4.5 How Data Is Stored

Anonymous snapshots are stored in Google Firebase Firestore in a collection called anonymous_research_snapshots. Each upload receives a randomly generated document ID from Firebase that is not linked to your account or device in the App. Data is transmitted over HTTPS (encrypted in transit). Server-side rules restrict the App to creating new documents only — it cannot read, modify, or delete existing research records.

4.6 Legal Basis and Your Control

• Anonymous research sharing is enabled when you first use the App unless you turn it off on the welcome screen or later in Settings → Research & Privacy. Continuing with sharing enabled constitutes your consent to this optional processing (GDPR Art. 6(1)(a))
• You may opt out at any time by disabling "Share anonymous research data" on the welcome screen or in Settings → Research & Privacy
• Disabling the feature does not delete snapshots already submitted, as they cannot be linked to your identity. To request deletion of research data that may correspond to your contribution, contact support@lndtech.eu — we generally cannot identify which document belongs to you due to the anonymisation design

4.7 Data Recipients

Anonymous research data is processed and stored by Google Firebase (Firestore) on behalf of the Developer, in accordance with Google's Firebase Privacy Policy and Google Cloud Data Processing Terms. Aggregated datasets may be analysed by the Developer and shared with healthcare research partners in anonymised, non-identifiable form only.

4.8 Multi-Patient Profiles and Research

If you manage multiple patient profiles (Epilog Pro), anonymous research snapshots include data from all active profiles on the device in a single submission. Each profile's entries carry only a relationship category, age band, and rare syndrome when one is recorded — never a name or profile identifier. There is no cross-linking identifier between profiles within the snapshot or across submissions. An outside observer cannot determine how many profiles belong to the same device or user.

5. Seizure Email Notifications (Epilog Pro, Optional)

If you are an Epilog Pro subscriber and enable seizure email notifications, the App may send email alerts through the Developer's secure backend at lndtech.eu when a qualifying seizure is recorded. This feature is disabled by default and only runs when you configure it.

When you use this feature, the following data is transmitted to our email service:

• Patient display name (as configured in the App)
• Recipient names and email addresses you added as notification contacts
• Seizure details: date and time, type, duration, severity, triggers, rescue medication usage, location context, post-ictal duration, and any notes you attached to that seizure record
• Your active Pro subscription product identifier (to verify eligibility)

This data is linked to the information you provide (names and emails) and is used solely to deliver the notification emails you requested. It is not used for advertising, sold to third parties, or added to anonymous research datasets. Emails are sent only when your configured notification rules are met.

5.2 Pharmacy Quick-Order Email (Optional)

Epilog lets you email a medication refill request directly to your pharmacy. This feature is disabled until you set it up and requires your explicit confirmation before the first email is sent.

When you use this feature:

• The email is composed and sent through your device's native email app (e.g. Apple Mail or Gmail) — it does not pass through Epilog's servers
• The email may include: medication names, dosages, prescriber details, and refill quantities you selected
• Your pharmacy's contact information (name, email address) is stored locally on your device only
• Once the email leaves your device, its retention is governed by your email provider's policies and your pharmacy's data practices — not by Epilog

Epilog does not store copies of sent emails, does not have access to your email account, and does not transmit pharmacy order data to any third party.

6. App Feedback (Optional)

If you choose to send feedback through Settings, the App transmits the following to Firebase Firestore (user_feedbacks):

• Your star rating (1–5)
• One or more features you selected as most useful
• Any suggestions you type in the open feedback field (up to 2,000 characters)
• Your App language/locale setting
• A server timestamp of submission

Feedback is voluntary and is not linked to your account or device identifiers in the payload. Please do not include personal or medical identifying information in free-text suggestions.

7. Doctor Reports, Exports, and Daily Messages

7.1 Doctor Reports (Local Only)

Epilog Pro includes a Doctor Report feature that builds a clinical summary from your local data for neurologist visits. Report generation happens entirely on your device — no health data is sent to external AI services. You may export the report as PDF and share it yourself.

7.2 Exports

You can voluntarily export medication reports, emergency protocols, doctor reports, and diary entries (JSON/CSV) for backup or sharing with healthcare providers. These actions are entirely user-initiated.

7.3 In-App Tips & Messages

The App may display short educational or motivational tips on the Diary and Care (Medications) screens. Messages are downloaded from a public JSON catalog hosted on lndtech.eu (a legacy Firestore promo_messages path may still exist). Selection happens on your device using your app language, optional country, and optional Community / Clinics / Doctors opt-ins — no health records are sent for this. Country and message preferences are stored only in on-device settings and are not uploaded to our servers. General tips (no audience tags) may still appear when opt-ins are off. Messages may include an optional "Learn more" link to pages on lndtech.eu.

7.4 AI Insights (Optional — Google Gemini via lndtech.eu)

If you enable AI Insights in the App (explicit consent required), Epilog sends a summary of your recent health data to our secure backend at lndtech.eu, which calls Google Gemini to generate supportive wellness text. This is not medical advice.

• Free plan: At most one automatic insight per 7 days, based on a limited summary (e.g. seizure counts and recent activity — not full diary notes)
• Epilog Pro: Up to one insight per day per patient when your data changes, using a richer summary (seizures, diary entries including weather summaries when present, medications from the last 90 days)

Data is sent only after you tap to enable AI Insights and accept the consent prompt. You can disable this at any time in the Insights screen. Epilog uses a paid Gemini API tier — your data is not used to train Google's models. Free-tier requests include a Firebase ID token for rate limiting; Pro requests include subscription verification via Apple. Raw GPS coordinates are never included in AI Insights payloads.

7.5 PDF and Data Export Details

When you export data from Epilog, the content depends on the export type. All exports are user-initiated and shared through the device share sheet (iOS) or system share / Storage Access Framework (Android) — Epilog does not upload them automatically.

• Medication Report (PDF): Includes medication names, dosages, frequencies, side effects, prescriber information, stock levels, and (optionally) the emergency protocol. Does not include seizure history, diary entries, or mood data.
• Emergency Protocol (PDF): Includes rescue medications with dosages and timing, emergency triggers, prescribing doctor information, and hospital details. Does not include historical seizure statistics or diary content.
• Doctor Report (PDF, Pro): Includes seizure statistics, medication adherence data, trigger analysis, and AI-generated clinical summary (if enabled). Does not include personal diary notes, location labels, or mood free-text.
• Diary Export (JSON/CSV): Includes all diary entry fields (mood, metrics, notes, tags, weather). Does not include device identifiers, analytics data, or Firebase UIDs.

No export file contains your device IDFV/IDFA, Firebase UID, or anonymous research data. You control who receives exported files.

8. Data Sharing Summary

We do not sell or rent your data. Data may leave your device only in these circumstances:

• Anonymous Research: Only when you opt in under Settings → Research & Privacy; when you save a diary entry, at most once per calendar day while enabled (see Section 4)
• Seizure email alerts: When you enable Epilog Pro notifications (see Section 5)
• In-app tips / messages: When the App downloads the public catalog (see Section 7.3) — no health data; country/audience prefs stay on device
• AI Insights: When you enable consent (see Section 7.4) — free: weekly limited summary; Pro: daily richer summary via lndtech.eu and Gemini
• App feedback: When you voluntarily submit the feedback form (see Section 6)
• Weather lookup: When you save a seizure, Epilog sends a city-level latitude/longitude (rounded, not your precise GPS position) to Open-Meteo solely to retrieve current weather conditions. Neither Epilog nor Open-Meteo stores precise coordinates after the request completes. The weather result (temperature, humidity, pressure, condition label) is saved locally in a diary entry. Location labels you choose (such as "home" or "work") remain on your device only and are never sent to Open-Meteo
• Exports and PDF sharing: When you explicitly export or share files
• Device backups: If you back up your device via iCloud or iTunes, App data may be included according to Apple's policies

9. Advertising

Some versions of Epilog display advertisements served by Google AdMob. When ads are shown, Google AdMob may collect certain device information and use advertising identifiers in accordance with Google's Privacy Policy.

You can remove advertisements by subscribing to Epilog Pro (monthly or yearly auto-renewable subscription) through the App Store. Ads stay removed only while the subscription remains active; when it ends, advertisements may appear again. The Developer does not receive your health data through AdMob.

10. Third-Party Services

Epilog integrates with the following third-party services:

• Google Firebase (Auth & Firestore): For anonymous sign-in, optional user registry (users/{uid}), anonymous research snapshots (diary-triggered when enabled, at most once per day), voluntary app feedback, a legacy promo_messages path if still present, and optional Cloud Sync (encrypted clinical records in a private vault when you enable it, including caregiver and read-only doctor sharing), subject to Firebase Privacy Policy
• LND Tech (lndtech.eu): For optional Profile account sign-in (email, Google, or Apple), Pro subscription entitlement, and the public in-app tips/messages catalog — no clinical record contents and no country/message preferences are stored in the LND Tech MySQL database from the app profile
• Google AdMob: For displaying advertisements on the free tier, subject to Google's privacy policies. Removed while an Epilog Pro subscription is active
• Apple StoreKit: For processing Epilog Pro subscriptions on iOS, subject to Apple's privacy policies
• Google Play Billing: For processing Epilog Pro subscriptions and tips on Android, subject to Google's privacy policies
• lndtech.eu backend: For seizure email notifications (Pro), AI Insights (free and Pro tiers via Google Gemini), when those features are used
• Google Gemini: For generating optional AI Insights text when you enable consent, subject to Gemini API Terms
• Open-Meteo: For fetching current weather conditions when a seizure is recorded. Only city-level (rounded) coordinates are sent; precise GPS is never transmitted or stored. Weather results are saved locally on your device. Subject to Open-Meteo Terms

Firebase and our hosting provider may process standard request metadata (such as IP address) as part of network infrastructure. The Developer does not integrate separate behavioural analytics or crash-reporting SDKs beyond those listed above.

11. Children's Privacy

Epilog can be used by individuals of all ages, including children under parental supervision. The multi-patient feature allows parents and caregivers to track seizure data for dependants.

• Parents should supervise children's use of the App
• Anonymous research sharing is enabled on first launch unless opted out; parents or guardians should review the welcome screen and Settings → Research & Privacy before continuing on behalf of users under 18
• We comply with applicable children's privacy laws including COPPA where they apply

12. Data Security

Your data is protected by:

• Platform app sandboxing (iOS / watchOS App Sandbox; Android application sandbox)
• Device-level encryption and OS file protection
• Optional biometric authentication within the App (Face ID / Touch ID on iOS; BiometricPrompt on Android)
• HTTPS encryption when optional research, feedback, or notification data is transmitted
• Optional encrypted cloud vault using on-device AES-GCM with a PIN you choose (PIN is never stored on our servers)

12.1 Encrypted Backups (Coming Soon)

Epilog is developing an optional encrypted backup feature that is separate from standard iOS device backups. When available, it will work as follows:

• You choose a passphrase that only you know — Epilog and LND Tech cannot access or recover it
• Your health data is encrypted on-device using AES-GCM (a widely trusted encryption standard) before it leaves the App
• The encrypted file is saved to your personal iCloud Drive folder — accessible only to your Apple ID
• Without your passphrase, the backup file is unreadable — by Epilog, by Apple, and by anyone else
• Standard iOS backups (iCloud Backup or Finder/iTunes) continue to follow Apple's own encryption policies independently of this feature

This section will be updated with final details before the feature launches. The feature is currently disabled.

13. Your Rights

You have control over your data:

• Access and modification: All local records are visible and editable within the App
• Deletion: You can delete individual records, patient profiles, or uninstall the App to remove local data
• Export: You can export medication data as PDF and diary data as JSON/CSV
• Opt-out: You can disable anonymous research sharing at any time in Settings → Research & Privacy, and disable AI Insights consent in the Insights screen

If you are located in the European Economic Area (EEA), you may have additional rights under GDPR, including the right to object to processing and the right to lodge a complaint with a supervisory authority. For anonymous research data, the right to erasure may be limited because submitted snapshots cannot be linked to your identity — contact us if you have concerns.

14. App Store and Play Store Privacy Labels

Apple's App Privacy nutrition labels and Google Play Data safety disclosures for Epilog reflect the data types collected when optional features apply — including Health data in anonymised research snapshots when sharing is enabled (not linked to you when no account or device identifiers are included), Contact Info and linked Health data when you use seizure email notifications, and Other User Content when you voluntarily submit feedback. Local health data that never leaves your device is not "collected" in the store sense. See Apple's App Privacy Details and Google Play Data safety for definitions.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected in the "Last Updated" date at the top of this page. Continued use of the App after changes constitutes acceptance of the revised policy where permitted by law.

16. Health Disclaimer