Privacy Policy

1. Controller and contact

PepWay is provided by 55.424.095 ADRIANO KELVIO DA ROCHA DANTAS - ME · CNPJ 55.424.095/0001-62 · Brasil. For privacy questions or to exercise your rights, contact sales@pepway.app. This policy covers the app and pepway.app.

2. Data you provide

The app can store your name, language, preferences, onboarding answers, protocols, medication names, amounts, schedules, dose sites and history, water, weight, manual steps, nutrition, sleep, workouts, symptoms, notes and photos. You choose what to record. Health information is sensitive data. Demo mode uses fictional examples.

3. Optional account and sync

You can use local records without an account. When you create an account, Supabase processes your email, identifier and authentication information. Google or Apple shares the identifiers, email and name you authorize; PepWay does not receive your password from those providers. Technical information such as IP, date and authentication events may be processed for operation and security.

Signing in does not enable sync. Separate explicit consent authorizes uploading manual health records to your account. The Supabase database is configured in São Paulo, Brazil. Photos and data imported from health platforms stay on the device and are excluded from that upload. Signing out removes that account’s area from the interface but retains its local copy for the next authorized sign-in.

4. Permissions and health-platform data

Connecting Apple Health or a compatible platform is optional. The screen explains requested data such as steps, weight and sleep. PepWay reads only types permitted by the system; missing data does not mean zero. The imported copy supports your local tracking. You can disconnect in the app and revoke permissions in system settings without deleting source records.

Notifications are optional and can display reminders on the lock screen according to your choices. Camera and photo selection are used when you request adding an image. We do not use health data for advertising, ad targeting, data sales or tracking across apps.

5. Purposes and legal bases

We use records to perform the functions you request. Processing sensitive health data relies on your explicit consent as applicable under LGPD and GDPR. Account services rely on performing the service relationship; security may rely on proportionate legitimate interests and legal obligations where applicable. Withdrawing consent stops the corresponding future processing without invalidating prior lawful processing.

6. Providers and transfers

Supabase provides authentication and database services. Apple and Google process sign-in when selected, and stores process available purchases. When subscriptions are enabled, RevenueCat processes account or anonymous identifiers, purchase history and status to validate access, restore subscriptions and analyze subscription performance. We do not send health records, photos, names or email addresses to RevenueCat. The website host may process technical data needed for delivery and security. These services may involve processing in countries beyond the database region. International transfers must follow applicable safeguards, including required contractual instruments. We may share data when subject to a valid legal obligation.

7. Retention, deletion and security

Local records remain until you erase them, clear browser data or uninstall the app. Synced records remain linked to your account until removed or the account is deleted. Disabling sync stops new uploads but does not erase previously uploaded data. Confirmed deletion removes the account and its active records; provider-held technical data and backups follow contractual retention periods and applicable obligations and are not used to restore an account deleted at the user’s request.

We use account-based access controls and protected transport provided by the services. We do not promise absolute security or end-to-end encryption. Protect your device and account. Files you export are under your control and cannot be remotely erased by PepWay.

8. Your rights

Depending on applicable law, you may request confirmation of processing, access, correction, portability, erasure, restriction, objection and withdrawal of consent. Use Profile → Privacy and data or contact sales@pepway.app. We may request only proportionate verification needed to protect your account. You may also complain to Brazil’s ANPD, the competent EU data protection authority or another applicable authority. US state privacy rights apply where their requirements are met.

9. Age and changes

The personal-record service is intended for adults. We do not knowingly collect children’s data. Contact us if you identify misuse so we can review and remove it. Material changes to purposes or permissions will be communicated; new processing requiring consent depends on a new choice. The document version and date appear on this page.