Privacy policy

• Patient records stay on your computer. MediTrak’s servers never receive patients, consultations, prescriptions or certificates, and we cannot read them.
• Our servers store what is needed to run your account: your Google email and name, your plan, and the computers you sign in on.
• The website stores what you send through its forms (newsletter, feedback, waitlist), and nothing else about your visit. There are no analytics, advertising or tracking cookies.
• Pro backups go to your own Google Drive, directly from your computer.
• Payments are handled by LemonSqueezy, our merchant of record. We never see your full card number.

MediTrak is made by Aymob Studio (“MediTrak”, “we”, “us”). We are responsible for the personal data described in this policy that our website and servers collect.

For any privacy question or request, write to [email protected].

The MediTrak desktop app saves patients, consultations, prescriptions, certificates, your professional profile and your document settings in a database file on your computer. This data is not sent to MediTrak’s servers, and we have no way to view, recover or delete it.

You decide what is recorded about your patients and remain responsible for it under the rules that apply to your practice, such as medical secrecy and health-data law in your country. MediTrak helps with a password lock that closes the app after a period without use, but the security of the computer itself is in your hands.

When you export your records to a .meditrak file, that file contains your patient data. Store and share it as carefully as the records themselves.

If you turn on cloud backup, the app on your computer connects to your own Google Drive and uploads backup files to a folder named “MediTrak Backups”. MediTrak asks Google only for the drive.file permission, which lets the app manage the files it created, and nothing else in your Drive.

The connection is made from your computer. The access key Google provides is stored on your computer, protected by operating system secure storage, and never sent to MediTrak’s servers.

You can encrypt cloud backups with a separate backup password. Without that password an encrypted backup cannot be opened by anyone. You can disconnect Google Drive at any time in the app.

Your account

When you sign in with Google, we receive and store your Google account ID, email address, name and profile picture URL. We never receive your Google password.

The computers you use

For each computer you sign in on, we store a random identifier created by the app, the computer’s name, operating system, MediTrak version, and when it was first and last seen.

Your plan and payments

From LemonSqueezy we receive order and subscription details: plan, status, renewal or end dates, and the brand and last four digits of your card.

Newsletter

If you subscribe, we store your email address and confirmation timestamp. Every email includes a one-click unsubscribe link.

Feedback

When you send feedback we store what you write, your rating, contact details if provided, and technical diagnostic details.

Waitlist

We store your email and platform choice (Mac or Linux) to notify you as soon as that build is available.

Abuse prevention

To prevent spam and brute-force attempts, our servers maintain an irreversible, salted fingerprint of your IP address in temporary rate-limiting counters.

The website sets no analytics, advertising or tracking cookies. The only cookies are strictly necessary:

• Sign-in protection: a cookie lasting at most 10 minutes links the Google sign-in to the desktop app request.
• Administrator session: set only for MediTrak staff managing the website.

Fonts are served from our own website. The demonstration video loads from YouTube (youtube-nocookie.com) only after you press play.

We share data only with the trusted providers necessary to deliver the service:

• LemonSqueezy (merchant of record): processes payments, handles tax, and delivers invoices.
• Google: authentication, and Drive backups if enabled.
• Hosting & database: Oracle Cloud Infrastructure, MongoDB Atlas.

We never sell personal data or share it for marketing purposes.

• Account and computer details: while your account exists; deleted upon request.
• Orders and subscription records: as long as tax and accounting law requires.
• Newsletter: until you unsubscribe.
• Feedback and waitlist: until resolved or the platform is released (max 12 months).
• Sign-in codes expire after 5 minutes; rate-limit counters within 24 hours.

You can ask to see the personal data we hold about you, correct it, receive an export, or have it deleted. Write to [email protected] from your registered account email; we reply within 30 days.

Deleting your account removes it from our servers. It does not touch the patient records on your computer or your Google Drive backups.

All connections to our website and servers are secured via modern TLS encryption. The desktop application authenticates with signed, expiring license tokens. Patient records never leave your local device.

MediTrak is a clinical tool for medical professionals. It is not intended for children, and we do not knowingly collect their data.

When this policy changes, we update the date at the top of this page. If a change affects how we use data you have already given us, we will notify you before it applies.

Questions about privacy: [email protected]. You can also read our terms of use.