1. Overview
Darman is a mobile app for tracking medication, the vaccination calendar, preventive check-ups and a health diary. By using the app you accept this privacy policy.
Darman does not make medical diagnoses and does not replace a doctor. The calculations in the app (vaccination calendar, check-up plan) are informational only.
2. Data we collect
- Account data: first and last name, phone number, e-mail address, password (stored as a one-way hash — the original password cannot be recovered from it).
- Profile data: for each profile — name, date of birth, sex, height and weight measurements. In addition to the account holder’s own profile, separate profiles can be created for their children under 18.
- Health data: medication records, vaccination and examination dates, diagnoses, lab results, medical documents you upload, diary entries (mood, symptoms, meals, activity), menstrual cycle and pregnancy data.
- Technical data: device type, operating system, app version, notification token, IP address and access logs.
- Location: approximate coordinates for the weather section. This is used only at the moment of the request and is not stored.
3. How we use the data
- To manage your account and profiles;
- to send medication, vaccination, examination and other reminders;
- to calculate the vaccination calendar and check-up plan by age and sex;
- to answer your support requests;
- to keep the service secure and prevent abuse.
We do not sell or rent your data to third parties for advertising.
4. Who can see health data
Health data belongs to a profile and by default is visible only to the account owner.
- Doctor: can see the medical records of your profiles only after you connect your account with their referral code. This access is read-only — a doctor cannot add, change or delete any record. You can disconnect at any time.
- Administrator: has access within technical support and system supervision. Such access is logged.
- Clinic and pharma company accounts have no access to patients’ medical data.
5. Third-party services
The app relies on the following services:
- Firebase Cloud Messaging (Google) — delivery of push notifications;
- OpenWeatherMap — weather forecast;
- Google reCAPTCHA — spam protection for website forms;
- e-mail (SMTP) provider — sending system messages.
Only the minimum data required for each function is passed to these services; your medical records are not sent to them.
6. Health Connect and Apple Health integration
You can enter activity and measurement figures in two ways: manually, or by reading them from the health app on your phone — Health Connect on Android, Apple Health on iOS. The choice is yours: the integration is optional and every other feature of the app works without it.
If you grant permission, only the following data types are read:
- step count, active minutes;
- sleep duration and sleep start and end times;
- weight and height measurements;
- blood pressure (systolic and diastolic) and heart rate;
- blood glucose;
- exercise sessions — type and duration.
The connection is read-only: Darman writes nothing to Health Connect or Apple Health and deletes nothing there. The figures that are read are shown only in the diary and charts of your own profile.
Every record keeps its source, so a sync updates only the rows it wrote itself — it never overwrites entries you made by hand.
Limits. Data obtained from Health Connect and Apple Health is not used for advertising, marketing or profiling, and is neither sold nor passed to third parties. You may withdraw the permission at any time in your phone’s Health Connect (or Apple Health) settings — no new data is read after that, and records already stored can be deleted from inside the app. If you delete your account, everything collected this way is deleted together with your other medical data.
7. Retention and deletion
Your data is kept while your account is active. You may delete your account from within the app or by contacting us — your profiles and the medical records attached to them are then deleted. Certain technical logs may be retained for a limited period where the law requires it.
Medical documents you upload, generated discharge-summary PDFs and files attached to support requests are stored on the server in encrypted form. They cannot be opened by a direct link: a file is decrypted only for a request that passes the authorisation check and is shown to you (or to a doctor you have authorised).
8. Security
Traffic is encrypted with HTTPS. Uploaded files are encrypted at rest with XChaCha20-Poly1305 (256-bit key); the key is kept separately from the files, outside the web folder, and every file is integrity-checked — a modified file will not open. Passwords are stored using a one-way hash, sessions are token based, and changing your password invalidates older sessions. Even so, no transmission over the internet can be guaranteed to be 100% secure.
9. Children’s data
A child profile may be created only by a parent or legal guardian, who remains responsible for all data in that profile.
10. Your rights
- View and correct your data inside the app;
- delete a profile or the entire account;
- turn individual notification types off;
- disconnect from a doctor;
- request information about how your data is processed.
11. Changes
This policy may be updated. The date of the last update is shown at the top of this page. We announce significant changes inside the app.
12. Contact
If you have a question about privacy, write to us through the contact page or the “Support, suggestions and complaints” section.