Privacy policy
How The Dose Club handles personal data on this website and in the app, in plain language. The short version: tracking data stays on your phone unless you turn on sync, we never sell data, and there is no advertising or tracking software anywhere.
1. Who we are
The Dose Club is published by Rivoro Studio Ltd, company number 17226090, registered in England and Wales, at Unit A, 82 James Carter Road, Bury St Edmunds, IP28 7DE. We are the data controller for the personal data described in this policy.
ICO registration number: [ICO registration number]. Data protection impact assessment completed: [DPIA date]. Data protection contact: [named contact or Data Protection Officer, if appointed].
Privacy questions and requests go to hello@thedoseclub.com, or by post to the address above.
2. What this policy covers
This policy covers the website at thedoseclub.com, including the community, and the Dose Club app for iPhone and Android. One account works across both, so where the two share data this policy says so.
Pharmacies linked from the price tables, and Apple, Google and the other services named below, have their own privacy policies for what they collect on their own sites and systems.
3. What we collect on the website
You can read prices, news and the community without an account, and we collect only server logs when you do.
Account data
When you create an account we hold your email address, your display name, an avatar if you upload one, which sign-in method you use (Sign in with Apple, Google or an email link), the date you confirmed you are 18 or over, your role, your reputation points and whether you have chosen the self-declared "on treatment" badge.
Community content
Posts, comments, images you attach, reactions, ratings you give providers, the reports you make about other content, and the accounts you block. Public posts are visible to anyone, including people without an account, and appear in the app as well as on the website.
Price reports
When you report a wrong price or an out of stock dose we record the provider, the dose, what you reported, the time and your account, so the report can be verified and reputation awarded.
Contact messages
When you use the contact form we hold your name, email address, the topic you chose and your message, together with your account id if you were signed in.
Server logs
Our servers record the IP address, browser type, pages requested and time of each request. We use these to keep the site running, to find faults and to limit abuse, such as repeated form submissions from one connection.
4. What the app collects and where it stays
Tracking data stays on your device
The doses, weight, measurements, symptoms, injection sites and notes you enter are stored in an encrypted database on your phone. The database is excluded from iCloud device backup. You can use the tracker without an account and without a network connection, and in that case none of this data leaves your device.
Cloud backup and sync (Dose Club Plus)
If you turn on backup and sync, the same tracking records are sent to our backend and stored encrypted at rest in the London region, so they can be restored on another device signed in to your account. Sync is off until you turn it on. You can turn it off and delete the synced copy at any time in the app's settings.
Subscriptions
Purchases of Dose Club Plus go through the App Store or Google Play. Our subscription service receives an anonymous app user id, the product bought, and the purchase status and dates, so Plus can be unlocked and restored. It never receives health data.
Crash reports
If the app crashes, a report containing the error, the app version, the device model and the operating system version is sent to our crash reporting service. Crash reports are configured not to include the contents of your tracking records.
Updates and notifications
The app checks our update service for new versions of its code, sending the app and platform version. Dose reminders are local notifications created on your device and are not sent through any server. If you opt in to notifications for replies and news, the app registers a push token with the push service; we never send prices or promotions by notification.
Apple Health and Health Connect (Dose Club Plus)
With your permission the app can share the weight entries you have typed in with Apple Health or Health Connect. Estimated medicine levels are never written to either. Data from Apple Health or Health Connect is never used for advertising and never sold.
News and community in the app
Reading news and the community in the app fetches content from our backend in the same way as the website. Posting uses your account exactly as described above.
5. Health data and your consent
Information about your medicine, doses, weight and symptoms is health data, which UK GDPR treats as special category data. We process it only with your explicit consent, and only in the two situations where it leaves your device: when you turn on backup and sync, and when you give the app permission to share weight with Apple Health or Health Connect.
You can withdraw consent at any time by turning sync off and deleting the synced copy, by withdrawing the Health permission in your phone's settings, or by deleting your account. Withdrawing consent does not affect the tracker on your device, which keeps working without it.
Community posts can also reveal health information, for example when you say which medicine you take. You choose what to post. The self-declared "on treatment" badge is optional and can be removed in your profile at any time.
6. Lawful bases
- Performing our contract with you: running your account, the community, Dose Club Plus and backup and sync.
- Your consent: processing synced health data, sharing weight with Apple Health or Health Connect, and sending opt-in notifications. You can withdraw consent as described above.
- Our legitimate interests: keeping the service secure, limiting abuse, moderating the community, verifying price reports, answering your messages and understanding how the service is used through first-party measurements that are not used to track you across other sites or apps.
- Legal obligations: duties under the Online Safety Act 2023 for user-to-user services, tax and accounting records, and responding to lawful requests from authorities.
7. Who processes data for us
We use a small number of service providers. Each processes data only on our instructions, under a written contract.
- Supabase, in the London region: database, authentication, file storage and realtime updates for accounts, the community, prices and synced records.
- RevenueCat: subscription status for Dose Club Plus.
- Sentry: crash reports for the app.
- Expo: app updates (EAS Update) and opt-in push notifications (Expo Push).
- Apple: Sign in with Apple, App Store purchases, and Apple Health on your device.
- Google: Google sign-in, Google Play purchases, and Health Connect on your device.
- [moderation provider, to be named before launch]: automated screening of community posts before they are published, in addition to our own pattern filters.
Apple and Google act as independent controllers for your App Store, Google Play and sign-in accounts. We receive from them only what is needed to sign you in and to confirm a purchase.
8. No advertising, tracking or sale of data
The app and the website contain no advertising, attribution or third-party analytics software. We do not track you across other apps or websites, which is why the app does not show Apple's App Tracking Transparency prompt. We do not sell personal data, and we do not share it with pharmacies, manufacturers or data brokers.
Trustpilot scores, where shown, come through Trustpilot's official widget, which is subject to Trustpilot's own privacy policy.
9. How long we keep data
- Account data: for as long as your account is open, then deleted within [account deletion period] of your deletion request.
- Community posts and comments: when you delete your account they are anonymised rather than deleted, so that the conversations other members took part in still make sense. You can delete individual posts yourself at any time.
- Price reports: kept as part of the price history, anonymised when your account is deleted.
- Synced tracking records: until you turn off sync and delete the synced copy, or delete your account, whichever comes first.
- Contact messages: [contact message retention period] after our last reply.
- Server logs: [log retention period].
- Backups of our database: rotated within [backup retention period], after which deleted data no longer appears in any backup.
10. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- receive the data you provided in a portable format;
- object to processing based on our legitimate interests;
- restrict processing in certain circumstances;
- withdraw consent at any time, where consent is the basis.
To exercise any of these, email hello@thedoseclub.com. We respond within one month, as the law requires, and may ask you to confirm your identity first.
You can also complain to the Information Commissioner's Office at ico.org.uk. We would welcome the chance to address your concern first.
11. Deleting your account and data
In the app, Settings includes a CSV export of your records and an option to delete your account and data. Deletion removes your account, your synced records and your personal details from our systems; your community posts are anonymised as described above. The tracking database on your device is yours to keep or remove when you delete the app.
On the website, the same deletion is available from your account page, or by emailing hello@thedoseclub.com from the address on your account.
12. Children
The Dose Club is for adults. You must be 18 or over to create an account, and the community is rated 18+ in both app stores. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, email community@thedoseclub.com and we will remove it.
14. International transfers
Our database and synced records are stored in the United Kingdom. Some of the providers named above are based in the United States and may process limited data there, such as a crash report or a subscription record. Where that happens we rely on the UK International Data Transfer Agreement or Addendum, or on a UK adequacy decision, so that the data has protection equivalent to UK law.
15. Security
Tracking records on your device are encrypted. Synced records are encrypted in transit and at rest. Access to our systems is limited to the people who need it, every database table is protected by row level security, and the website is served over HTTPS only. No system is perfectly secure; if a breach affects your data we will tell you and the ICO as the law requires.
16. Changes to this policy
We will post any change on this page with a new date. If a change affects how we use health data or adds a new processor, we will tell you in the app or by email before it takes effect, and ask for consent again where the law requires it.
17. Contact
Email hello@thedoseclub.com, use the contact form, or write to Rivoro Studio Ltd, Unit A, 82 James Carter Road, Bury St Edmunds, IP28 7DE.