Privacy Policy

INFORMATION NOTICE ON THE PROTECTION OF PERSONAL DATA AND CONFIDENTIALITY OF INFORMATION

Effective Date: April 28, 2026
Version: 2.1
Data Controller: CYBERZENITH DYNAMICS S.R.L.
Applicable Law: EU General Data Protection Regulation (GDPR)

1. Data Controller

1.1

CYBERZENITH DYNAMICS S.R.L., through the website www.remedio-app.com and the REMEDIO mobile application, acts as the operator and Data Controller of your personal data. We are fully committed to respecting your privacy and protecting your personal information.

1.2

We take the protection of our customers’ personal data seriously by complying with all applicable and updated data protection and privacy legislation.

1.3

The security and confidentiality of your personal data is our top priority.

This document explains how we collect, use, transfer, and protect your personal data when you interact with us through our products and services, including our website and mobile applications available on PCs, smartphones, and tablets.

2. Who We Are and How to Contact Us

2.1

CYBERZENITH DYNAMICS S.R.L. (hereinafter referred to as “REMEDIO”, “we”, “our”, or “us”) is a limited liability company headquartered in Timișoara, Str. Vasile Alecsandri, No. 3, Floor 2, Apartment 8, Timiș County, Romania, registered with the Trade Register under number J2024001088357, VAT n. RO49775719.

2.2

Under the EU General Data Protection Regulation (GDPR), we are the Data Controller — the entity determining the purposes and means of processing personal data — when we process your personal information as a data subject for the purposes described below.

2.3

If you have questions, concerns, or need further information about how we process your data, you can contact REMEDIO’s Data Protection Officer (DPO) at:

📧 Email: dpo@remedio-app.com
📬 Mail: CYBERZENITH DYNAMICS S.R.L., Attn: Data Protection Officer, Str. Vasile Alecsandri 3, Floor 2, Apartment 8, 300078, Timișoara, Romania

These are the only official channels for any data protection inquiries.

3. What Personal Data We Collect and Process

3.1

Personal data means any information relating to an identified or identifiable natural person — such as a name, identification number, location data, or other factors specific to one’s physical, physiological, genetic, mental, economic, cultural, or social identity.

3.2

We usually collect your data directly from you, allowing you full control over the information provided. The categories of personal data we process include:

Registration data: name, surname, email, encrypted password, city, IP address
Product data: medication or product names, categories, quantities, expiry dates, photos
Usage data: app interaction and behavior (to improve services)
Subscription data: information on purchases and active plans
Voluntary data: feedback, preferences, or information you choose to provide

3.3

When you access our website or use the REMEDIO app, our servers automatically log information such as your IP address, access count, and browser type.

3.4

We may also collect behavioral data during your visit for purposes such as:

Personalizing your online experience
Detecting fraud, payment failures, or abusive activities

See Section 4 for processing purposes.

3.5

We may store and collect information through cookies and similar technologies, in accordance with our Cookie Policy available on our website and in the REMEDIO app.

3.6

We do not collect or process sensitive data nor do we intentionally collect data from minors under 16 years old.

3.7

Refusal to provide certain data may make it impossible for us to deliver the requested products or services or to respond to your inquiries.

4. Purposes, Legal Basis, and Retention Period

4.1

We process personal data securely and only for the specific purposes outlined below.

4.2

The legal bases for processing under Article 6 of the GDPR include:

Consent (Art. 6(1)(a)) – when you have explicitly agreed
Contractual necessity (Art. 6(1)(b)) – to perform a contract or pre-contractual steps
Legal obligation (Art. 6(1)(c)) – where required by law
Legitimate interest (Art. 6(1)(f)) – to protect and manage our business operations

4.3

Purposes of processing:

To provide and manage the REMEDIO service
To send notifications and expiry reminders
To manage your account and subscriptions
To improve product quality and develop new features
To provide technical support and customer service

4.4

Data retention:
We retain personal data as long as your account is active. Upon account deletion or inactivity (≥2 years), data is erased in accordance with legal retention limits.

You may request deletion or cessation of processing at any time.

4.4.1 Preserved Data During Subscription Downgrade

When a Premium subscription expires, data linked to Premium features (family management, linked products, reminders, etc.) remains stored in a “frozen” state.
These data are inaccessible until a Premium plan is reactivated, ensuring full restoration when upgrading again.

4.4.2 Inaccessibility Guarantee

Frozen data are completely inaccessible to:

REMEDIO staff or contractors
Developers and system administrators
Support or hosting providers
Only the verified account owner can access them after reactivating a Premium plan.

4.5

Users can delete their own account data at any time within the app.

4.6–4.8

We may process or disclose data:

To protect our services from cyberattacks
To prevent and detect fraud
To comply with tax, legal, or regulatory obligations

All processing is conducted under legitimate interest with appropriate safeguards and DPO oversight.

5. Who Has Access to Your Data

5.1

All data collected and stored by us are confidential.
We do not sell or share personal data with third parties for marketing purposes.

Data may be shared only with:

Technical service providers (e.g., database hosting, infrastructure)
Public authorities, when required by law

5.2

In certain lawful cases, we may disclose personal data to:

Tax authorities
Consumer protection agencies
Law enforcement or judicial authorities

6. Data Transfers

6.1

Your personal data may be transferred within or outside the European Economic Area (EEA). Some destinations may not have the same level of data protection as the EU.

6.2

We always implement safeguards for international transfers, such as Standard Contractual Clauses (SCCs), to protect your rights and privacy.

6.3

You may contact us at any time for more information about data transfer locations and applicable safeguards.

7. Security Measures

7.1

We apply appropriate technical and organizational measures to prevent accidental or unlawful destruction, loss, alteration, disclosure, or unauthorized access to personal data.

7.2

Data transmission uses modern encryption algorithms, and we store information on secure servers with redundancy.
Passwords are hashed with scrypt, and payments are processed exclusively via Apple In-App Purchases and Google Play Billing using TLS-secured HTTPS.

7.3–7.5

We regularly review and update our security controls, apply risk-based protections, and ensure that profiling or automated analyses are accurate, objective, and lawful.
However, data transmission over the Internet is never 100% secure; we cannot be held responsible for vulnerabilities outside our control.

7.6 End-to-End Encryption for Sensitive Health Data

For health-related data processed under the Gold Tier plan (Health Tracker, Medical Diary), REMEDIO implements a Zero-Knowledge End-to-End Encryption (E2E) model to ensure the highest level of privacy and data protection.

Zero-Knowledge Architecture: All encryption and decryption operations occur exclusively on the user’s device using a 256-bit master key that is never transmitted in plaintext to REMEDIO servers.
AES-256-GCM Standard: Each encrypted record uses a unique initialization vector (IV), providing robust protection against cryptographic attacks.
Secure Key Derivation: Encryption keys are derived using PBKDF2-HMAC-SHA-256 with 600,000 iterations and a unique salt, ensuring strong defense against brute-force attempts.
24-Word Recovery Kit: A secure, offline recovery system composed of 24 encoded words allows users to restore access to encrypted data if their password is lost, without compromising data confidentiality.
Secure Family Sharing: Encrypted data sharing between authorized family members is facilitated via ECDH P-256 elliptic curve cryptography, ensuring secure key exchange without exposing private keys.
Verifiable Integrity: Every encrypted record includes cryptographic metadata (version, checksum, and integrity tags) to detect potential tampering or corruption.

⚠️ Non-Encrypted Operational Data:
Certain non-sensitive fields, such as product name and expiration date, are intentionally stored in plaintext.
This is essential to enable core application functionality — including push notifications, reminders, and expiry alerts — without requiring server-side decryption, which would otherwise violate the zero-knowledge principle for sensitive health data.

➡️ Only you — and explicitly authorized family members via Magic Link — can access decrypted data.
Neither REMEDIO nor third parties can decrypt your health records.

8. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

Right to Information – to know how and why your data are processed.
Right to Withdraw Consent – at any time, without affecting prior lawful processing.
Right of Access – to request a copy of your data and details on processing.
Right to Rectification – to correct inaccurate or incomplete data.
Right to Erasure (“Right to be Forgotten”) – when data are no longer needed, consent withdrawn, or unlawfully processed.
Right to Restrict Processing – under certain lawful grounds (accuracy contested, objection pending, etc.).
Right to Data Portability – to obtain or transfer your data in machine-readable format.
Right to Object – to processing based on legitimate interest.
Right Not to Be Subject to Automated Decisions – including profiling, where such decisions significantly affect you.
Right to Lodge a Complaint – with a supervisory authority (see below).

8.10 Supervisory Authority

If you believe your data have been mishandled, you may contact the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):
📍 Bd. G-ral. Gheorghe Magheru 28-30, Sector 1, 010336, Bucharest, Romania
☎️ +40 318 059 211 / +40 318 059 212
📧 anspdcp@dataprotection.ro

Before contacting the authority, we invite you to reach out to us first — we will do our utmost to resolve your concerns amicably.

8.11 Contacting REMEDIO’s Data Protection Officer

You may contact our DPO at any time by:

📧 Email: dpo@remedio-app.com
(Include your name, email, phone, and request purpose)
📬 Mail: CYBERZENITH DYNAMICS S.R.L., Attn: DPO, Str. Vasile Alecsandri 3, Floor 2, Apt. 8, Timișoara, Romania

8.12 Exercising Your Rights

Identity verification: We process only requests made from the email linked to your REMEDIO account. We may ask for additional verification if necessary.
Fees: Requests are free unless excessive, repetitive, or unfounded.
Response time: We respond within one calendar month, extendable by two additional months for complex cases.
Third-party rights: We may refuse requests infringing others’ rights or freedoms.

9. Updates to This Notice

We may periodically update this Privacy Policy.
When significant changes occur, you will be notified appropriately — via email or in-app notification.
Please check this page regularly for the latest version.