Privacy & Consumer Health Data Policy

1. Scope

This Policy applies to personal information processed by Gylt.me through Gylt.me-operated websites and the Your Meds Today and BackNSync applications and related support channels. It does not govern a third-party website, app store, operating system, payment system, or service that processes information under its own privacy policy.

2. Information We Collect

3. Sources of Information

We obtain information from the following categories of sources:

directly from you when you create an account, enter data, upload content, change settings, contact support, or otherwise use a Service;

from another user when that user lawfully invites you, shares information with you, designates you as a caregiver or care recipient, or adds you to an organization;

automatically from your device or browser when necessary to operate, secure, diagnose, or improve the Services;

from Apple App Store or Google Play for subscription, entitlement, purchase, and marketplace-account information needed to provide paid features; and

from service providers acting on our behalf, such as hosting, database, authentication, email, notification, security, and infrastructure providers.

4. How We Use Information

We use personal information for the following purposes:

provide, operate, synchronize, and maintain the Services and requested features;

authenticate users, administer individual and organization accounts, and maintain permissions and sharing relationships;

store and display user-entered records, including health records in Your Meds Today;

generate requested medication schedules, reminders, inventory calculations, histories, charts, alerts, caregiver notifications, and related user-facing functions;

provide tasks, notes, reminders, shared records, attachments, organization features, and other BackNSync functionality;

process app-store entitlement and subscription status;

respond to support, feedback, privacy, security, and legal requests;

detect, prevent, investigate, and address fraud, abuse, security incidents, errors, and violations of our terms;

maintain, troubleshoot, test, and improve reliability, accessibility, usability, and performance; and

comply with law and enforce or defend legal rights.

Gylt.me does not sell personal or sensitive user data. Gylt.me does not use Your Meds Today health data for targeted advertising, behavioral advertising, data-broker activity, or advertising profiles. We do not authorize service providers to use health data for their own advertising purposes.

5. Your Meds Today - Consumer Health Data

5.1 Categories of Consumer Health Data

Depending on what you choose to enter or connect, Your Meds Today may process health information that identifies or can reasonably be linked to you, including medication use or purchase, dosage and treatment schedules, dose history, adherence information, blood pressure, weight, physical activity, symptoms, measurements, goals, health-related notes, and information indicating that you are seeking or using medication-management or other health-related services.

5.2 Sources of Consumer Health Data

Consumer health data is obtained primarily from you. It may also be provided by a caregiver or other user whom you authorize, generated from your use of Your Meds Today (for example, a dose history created when you mark a scheduled dose), or received from a connected feature or data source that you affirmatively choose to enable in the future. If Gylt.me adds a new category or source of consumer health data, this Policy and any required in-app consent will be updated before that use where required by law.

5.3 Purposes for Collecting and Using Consumer Health Data

We collect and use consumer health data only to provide the health-management functions you request; maintain medication schedules and inventory; record and display history; generate charts or summaries; provide reminders and alerts; enable caregiver or care-recipient features you choose; provide support; maintain security and reliability; comply with law; and carry out other purposes disclosed to you with any consent required by law.

5.4 Sharing of Consumer Health Data

Gylt.me may disclose consumer health data only as described in this Policy, including:

to another user, caregiver, care recipient, or recipient when you intentionally enable a sharing feature or direct us to make information available to that person;

to service providers that process data on Gylt.me’s behalf to host, store, secure, transmit, back up, or support the Service, subject to contractual and legal restrictions;

when required by valid legal process or applicable law, or when reasonably necessary to protect rights, safety, security, or the integrity of the Services; and

as part of a merger, acquisition, financing, bankruptcy, reorganization, or sale of assets, subject to applicable consumer-health-data consent, notice, and authorization requirements.

We do not sell consumer health data. We will not share consumer health data for a new purpose requiring separate consent without first obtaining that consent where applicable law requires it.

6. Service Providers and Other Recipients

Gylt.me uses vendors and infrastructure providers to operate the Services. Current or expected categories of recipients include cloud hosting and database providers, authentication providers, infrastructure and deployment providers, email and notification providers, security and diagnostic providers, and Apple and Google for marketplace purchases and app distribution. Providers are permitted to process personal information only for authorized services or as otherwise allowed by law and their applicable agreements.

Gylt.me’s current software architecture may use services provided by Supabase for application database, storage, and authentication functions and Vercel for web application hosting and deployment. Apple and Google process app-store purchases and related marketplace information. The exact service-provider list may change as infrastructure changes; material changes affecting how personal or health information is handled will be reflected in this Policy or associated disclosures as required.

7. No Sale of Personal or Sensitive Data

Gylt.me does not sell personal information, sensitive personal information, or consumer health data for monetary consideration. We also do not exchange consumer health data for valuable consideration in a manner treated as a sale under applicable consumer-health-data law without the separate authorization required by that law.

8. Advertising and Analytics

Gylt.me does not use Your Meds Today health data for targeted or behavioral advertising. If Gylt.me uses analytics or diagnostic tools, they must be configured and used consistently with this Policy, applicable app-store policies, and applicable law. Sensitive health information should not be intentionally sent to advertising networks or used to create advertising profiles.

9. Permissions and Device Access

A Service may request device permissions only when needed for a user-facing feature, such as notifications, camera or file selection for an attachment, calendar access, or another feature you choose to use. Where required, the app will provide an in-app disclosure and request permission before accessing personal or sensitive device data. You can revoke operating-system permissions through your device settings, although some features may stop working.

10. How We Share Personal Information

Outside the consumer-health-data disclosures above, we may disclose personal information:

at your direction or with your consent;

to authorized users of an organization account according to account roles and permissions;

to vendors and service providers acting for Gylt.me;

to Apple or Google as necessary for app distribution, subscription validation, and marketplace support;

to comply with law, legal process, or enforceable government requests;

to investigate or prevent fraud, abuse, security incidents, or threats to users or the Services; or

in connection with a corporate transaction, subject to applicable law and appropriate notice or consent requirements.

11. Organization Accounts

If you use an organization account, the organization may control information submitted to that account and may designate administrators who can manage users, permissions, and organization records. Gylt.me processes organization-account information according to the organization’s instructions, applicable product settings, our agreements, and applicable law. Do not place personal information into an organization account if the organization is not authorized to receive or control it.

12. Caregiver and Care-Recipient Privacy

Your Meds Today may allow users to invite or authorize another person to view or help manage selected information. The app will use the permissions and relationship settings selected by the applicable users. Before sharing another person’s health or personal information, you must have authority to do so. Users should review caregiver access periodically and remove access that is no longer appropriate.

13. Data Retention

We retain account information and user content for as long as reasonably necessary to provide the account and Services, maintain security and continuity, comply with legal obligations, resolve disputes, and enforce agreements. When you delete content or an account, we remove or deidentify it from active systems according to our deletion processes, subject to technical backup cycles and information we must retain for security, fraud prevention, legal compliance, transaction records, or dispute resolution. Backup copies may remain for a limited period until overwritten or securely deleted in the ordinary backup cycle.

We seek to avoid retaining personal information longer than reasonably necessary for the disclosed purpose. Different categories may have different retention periods based on account status, feature requirements, security needs, and legal obligations.

14. Account and Data Deletion

You may request account deletion through an available in-app account-deletion feature or by contacting support@gylt.me. We may verify your identity before completing a deletion request. Deleting an account does not automatically cancel an Apple App Store or Google Play subscription; marketplace subscriptions must be canceled through the applicable marketplace controls.

If information is jointly controlled or separately retained by another user or organization because you previously shared or exported it, deleting your Gylt.me account may not delete the independently held copy. We will explain material limitations when responding to a verified request where required by law.

15. Your Privacy Rights

Depending on where you live and the law that applies, you may have rights to request access to personal information, confirm whether it is being processed, correct inaccurate information, delete information, obtain a portable copy, withdraw consent, or opt out of certain processing. Gylt.me will not unlawfully discriminate against you for exercising an applicable privacy right.

To submit a privacy request, use an available in-app privacy/account tool or email legal@gylt.me. You may also mail a request to Gylt.me LLC, 1904 East University Ave, Gainesville, FL 32641. We may take reasonable steps to verify your identity and authority before acting on a request. An authorized agent may submit a request where applicable law allows it, subject to verification requirements.

16. Consumer Health Data Rights

Where consumer-health-data law applies, you may have rights to confirm whether Gylt.me collects, shares, or sells consumer health data; access that data; obtain a list of third parties or affiliates with whom it has been shared or sold where required; withdraw consent; and request deletion of consumer health data, including deletion requests transmitted to applicable processors or other recipients when the law requires. Gylt.me does not sell consumer health data.

To exercise consumer-health-data rights, email legal@gylt.me with the subject “Consumer Health Data Request” or use an available in-app privacy request mechanism. If we deny a request, we will provide any appeal process required by applicable law.

17. California and Other State Privacy Rights

Some U.S. state privacy laws apply only after a business meets specified thresholds or engages in specified activities. Even where a particular statute does not currently apply to Gylt.me, we may choose to honor reasonable access, correction, deletion, and portability requests when technically feasible and consistent with security, legal obligations, and the rights of others. Nothing in this Policy waives rights that applicable law makes non-waivable.

18. Children and Teen Users

The Services are not directed to children under 13, and users under 13 may not create an account. If we learn that we collected personal information from a child under 13 in a manner requiring parental consent that we did not obtain, we will take appropriate steps to delete the information. Users ages 13 through 17 should use the Services with parent or legal-guardian permission where required by law.

Because Your Meds Today involves medication and health information, parents and guardians should consider whether the app is appropriate for a minor and should supervise use when appropriate. Gylt.me may adopt stricter age requirements for particular health features or jurisdictions.

19. Security

Gylt.me uses reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. These may include access controls, authentication, encrypted transport, restricted administrative access, logging, backups, and security review appropriate to the Service. No method of storage or transmission can be guaranteed to be completely secure.

20. Health Data Breach Notification

If Gylt.me experiences a breach involving health information or other personal information, we will investigate and provide notices to affected individuals, regulators, or others when required by applicable law. For qualifying non-HIPAA personal health records, the federal Health Breach Notification Rule may require notices to affected users and the Federal Trade Commission and, in certain cases, additional notice.

21. Data Location and U.S. Service

Gylt.me currently offers its consumer Services for the United States. Information may be processed or stored in the United States and in other locations used by our service providers, subject to their infrastructure and our contractual and legal requirements. If Gylt.me expands availability outside the United States, this Policy may be updated to address additional international requirements before or as required for that expansion.

22. Changes to This Policy

We may update this Policy to reflect changes in our Services, vendors, data practices, security practices, or legal obligations. We will post the updated Policy with a revised effective date. If a change materially expands collection, use, or sharing of sensitive or consumer health data, we will provide additional notice and obtain consent where required before applying that new practice.

23. Contact Us

Gylt.me LLC 1904 East University Ave, Gainesville, FL 32641 Telephone: (352) 448-6256 Privacy and legal requests: legal@gylt.me Support: support@gylt.me Website: gylt.me