Privacy policy · Development version
Your data.
Your context.
This policy describes the implemented local design and the clinical connection being prepared. PediaInfo is not yet publicly distributed, and clinical access is not enabled for public use. We will update this notice before a release if the data flows change.
Who is responsible?
Forja Labs LLC, Florida, USA. Privacy requests: privacy@forjalabs.dev. General support: support@forjalabs.dev.
What the app processes
Profiles, dates of birth, photos you select, care entries, measurements, appointments, questions and notes that you enter. Personal summaries derive from those entries. The planned clinical connection reads authorized identity, observations, immunizations, medication records, conditions, allergies, encounters, procedures, diagnostic reports and document metadata. Document attachments are not downloaded.
Sources and purposes
You provide family entries. A supported healthcare provider supplies clinical records only after authorization. PediaInfo uses these sources to display records, organize checkups, calculate personal care summaries and answer questions with source references. It does not write to the provider's record or infer a diagnosis or treatment.
Local storage and retention
Care and clinical files use iOS file protection and are excluded from device backups by the app. There is no PediaInfo server storing those records, automatic caregiver sync or iCloud health-data sync. Deleting a local profile removes its local care data and clinical links. Records remain on your device until deleted; imported clinical copies may remain stored but become inaccessible when authorization expires or is restricted.
Your own exported files and copies held by another app are controlled in those destinations. Backup exclusion does not erase backups made with an earlier build; manage any existing copies through the operating system or destination provider. Local deletion cannot erase the healthcare provider's original records.
Assistant
Search and summaries run on the device. When available, Apple's on-device Foundation Models system selects references from limited source excerpts; it does not create clinical facts. PediaInfo does not send records to a third-party AI service or use them to train models. Conversation references stay in memory and clear when you close, clear the conversation or change profile.
Permissions and visible surfaces
Photos use the system picker. Calendar export uses the system event editor. Notifications require system permission. Family data in widgets and timers on the Lock Screen are optional and disabled by default for new settings; you may enable them in Settings. Names, appointments and care summaries can then be visible to people who see your screen. Clinical records are not automatically sent to widgets or notifications.
Clinical authorization
Sign-in happens with the provider, not in a PediaInfo password form. Access uses a public OAuth client with PKCE and pediatric proxy permissions granted by the provider. Access tokens are kept in session memory; no client secret, refresh token or patient password is stored by PediaInfo. Closing or disconnecting the clinical session ends local access. You can also revoke access through the provider.
Sharing and export
A family backup excludes clinical records. Clinical JSON export is separate and limited to currently authorized records; clinical sections in a PDF are off until selected. Export is not a complete copy of the EHR or of inaccessible retained copies. Sharing through the system may send a file to a recipient or app you select, whose terms and privacy practices then apply.
No advertising, sale or research
PediaInfo does not sell consumer health data, use it for targeted advertising, run health research, or share patient records with Forja Labs for analytics or AI training. We do not use geofencing to identify visits to health facilities.
Adults and children's information
The app is intended for parents and legal guardians, not for children to create accounts or consent for themselves. Only manage records you are authorized to access. Clinical proxy access can vary by age, jurisdiction, category and provider decision; permission is not inferred solely from a family profile.
This website and support
The informational website has no patient-upload form, advertising tracker or app analytics integration. Cloudflare, its hosting provider, processes technical request information such as IP address, browser and requested URL to deliver and protect the site. The OAuth fallback page does not exchange or display codes, uses no external scripts and clears query parameters from the visible URL when its script runs. Technical hosting processing is distinct from the local patient store.
If you email us, we receive what you send and use it to respond, resolve the issue and meet applicable obligations. Do not send medical records, passwords, tokens or authorization codes. Support correspondence is retained only as needed for those purposes and applicable legal obligations.
Your choices and requests
Use Settings to manage permissions and visible surfaces, export permitted records, disconnect a clinical session or delete a profile. To ask about access, correction, deletion or withdrawal under applicable law, contact privacy@forjalabs.dev. We use proportionate verification and do not need your medical record to identify an ordinary support issue. Because device records are not held on our server, we cannot retrieve or erase them remotely. Read the separate consumer health data notice.