Privacy Policy
In short: FolioMed stores what you and your ward team write so you can share it with each other — and nothing more. No ads, no tracking, no selling data. Only members of a ward can read that ward’s patients and notes. You can delete your account at any time.
1. Who we are
FolioMed is a clinical-communication app for hospital ward teams, built and run as an independent project by Kashyap Anand. It is available on the web at foliomed.app; iPhone and Android apps are in preparation. In this policy “we” means FolioMed and “you” means anyone who uses it.
FolioMed is a communication tool. It is not a medical device and does not replace your hospital’s record system or clinical judgement.
2. What we collect
When you sign in
- From Google or Apple: your name, email address and, where provided, profile picture. FolioMed has no passwords — sign-in is handled by Google or Apple through our authentication provider, Supabase Auth. With Sign in with Apple you can choose to hide your email.
- Your role: doctor or nurse, which you choose after your first sign-in. Admin access is granted only by an existing admin.
What you create
- Wards you create or join, and their join codes.
- Patient details your team enters: name, age, gender, bed number, diagnosis, blood group and, optionally, a hospital ID and, for newborns, birth details: date and time of birth, gestational age, birth weight, size for dates, mode of delivery, APGAR scores, whether resuscitation was needed and the mother’s blood group. Each patient also gets a FolioMed patient ID.
- Newborn investigation results your team enters (blood counts, TSH, blood groups, bilirubin, kidney function and electrolytes, hearing screen), with gestational age, who entered them and when.
- Reminders your team sets on a patient (for example, 48-hour investigations), with who marked them done and when. Reminder alerts are scheduled on your own device.
- Newborn tracking: bilirubin readings, phototherapy start and stop times, daily weights, and the mother’s name, age and gravida/para.
- Units (teams) a ward is divided into, and which unit each patient belongs to.
- Admission history: transfers between wards and discharges, with who did them, when, and any summary written.
- Notes, replies and acknowledgements, with who wrote them and when.
- Optional profile details: specialty and avatar emoji.
Scanning text from photos
If you use Scan text when writing a note, or Scan lab report when entering results, the photo you take or choose is read on your device to extract its text. The photo is not uploaded or stored by FolioMed — only the text or values you choose to keep.
Automatically
- Account creation and last sign-in times, shown to you in Profile.
- A notification token for each phone you sign in on, so alerts reach you when FolioMed is closed. It is deleted when you sign out.
- Anonymous counters (for example “number of notes posted”) shown on our website. They contain no names or clinical content.
What we don’t collect
- Location, contacts or calendar. Your photo library is opened only when you choose a photo to scan.
- Advertising identifiers, usage analytics or tracking cookies.
3. How we use it
- To sign you in and show you the wards you belong to.
- To show your ward team the patients, notes and acknowledgements in that ward, live.
- To alert you — in the app and as phone notifications — when a teammate posts a note in your ward or a reminder falls due.
- To show clinical decision support you can see (for example, bilirubin compared with published thresholds). It never makes decisions on its own.
- To answer feedback and bug reports you send us.
We never use your data for advertising, profiling, training AI models, or sale to anyone.
4. Who can see it
Your ward: patients, notes, replies, reminders, results and tracking data are visible only to members of the same ward. This is enforced by row-level security in the database, so it holds even if the app had a bug.
Other signed-in users can see your name, role and profile picture — for example, as the author of a note.
Service providers: data is stored and processed by Supabase (authentication, database and file storage), phone notifications are delivered through Google Firebase Cloud Messaging and Apple Push Notification service (the notification shows the patient’s name and a short summary), and sign-in passes through Google or Apple. They process data only to run the service. The website is hosted on GitHub Pages.
We do not sell, rent or trade personal data.
5. Where it’s stored
FolioMed data is hosted by Supabase in the region chosen for the FolioMed project, and may be processed in other countries by our providers. By using FolioMed you agree to this.
6. How long we keep it
- Your account is kept until you delete it (Profile → Danger zone → Delete account). Deletion is immediate and permanent.
- Wards and everything inside them are kept until the ward’s owner deletes the ward, which permanently erases its patients, notes and replies. Discharged patients stay in the ward’s Discharged list until then. Deleting your account also deletes wards you own.
- Activity counters on the website are anonymous and kept indefinitely.
7. Patient data and who is responsible
Patient information is entered by the clinicians and hospital using FolioMed, who decide what to record and are responsible for having a lawful basis (such as the patient’s or parent’s consent, or medical treatment) under India’s Digital Personal Data Protection Act, 2023 and other laws that apply to them. FolioMed processes that information only to provide the service to the ward team.
Notes may be shared outside FolioMed only when a team member chooses to (for example, sharing a handover summary). Anyone sharing must follow their hospital’s rules on patient confidentiality.
8. Your rights
You can see most of your data in the app, change your name, role and profile in Profile, and delete your account there at any time. To get a copy of your data, email us and we’ll reply within 30 days. If data-protection laws such as the GDPR, UK GDPR or India’s DPDP Act apply to you, you have the rights they give you, and you can contact us to use them.
Patients (or parents of newborns) who want their information seen, corrected or removed should ask the ward team caring for them, or contact us. You may withdraw consent for your own account at any time by deleting it.
Grievances: contact our grievance officer, Kashyap Anand, at kashyap2k007@gmail.com. We acknowledge complaints within 7 days and aim to resolve them within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.
9. Security
- All traffic is encrypted in transit (TLS); Supabase encrypts data at rest.
- There are no FolioMed passwords to steal — sign-in is through Google or Apple.
- Ward access is enforced in the database, not just in the app.
No system is perfectly secure. If you find a vulnerability, please email us — we respond to and credit responsible disclosures.
10. Children
FolioMed is for healthcare professionals and is not directed at children. We don’t knowingly create accounts for anyone under 18.
11. Changes to this policy
If we change this policy meaningfully we’ll update the date above, and where a change reduces your rights we’ll tell you in the app first.
12. Contact
Kashyap Anand · kashyap2k007@gmail.com