MEDALITE APP PRIVACY POLICY

Last Updated: October 20, 2025

Medalite, Inc. (“we,” “us,” or “our”) respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how the Medalite mobile application (the “App”) collects, uses, and safeguards data when you use our products and services.

1. Data Controller

For users in the European Economic Area (EEA), the data controller responsible for your personal data is:

Medalite, Inc.
1209 Orange Street, Wilmington, DE 19801, USA
📧 contact@medalite.io

2. Information We Collect

We collect only what’s necessary to make Medalite work, stay secure, and improve over time.
We do not collect health data, biometric data, contacts, or precise location information.

2.1 Information You Provide

• Account Information: Email and password (or Apple/Google login) used to create and manage your account.
  
  

• Preferences & Saved Sessions: Brightness, color, and sequence settings to sync your experience across devices.
  
  

• AI Inputs: When you use AI-powered features (such as generating light sequences), your text input is securely sent to OpenAI’s API — or other future GDPR-compliant AI providers — for real-time processing.
  OpenAI processes user prompts solely to generate responses and does not retain or use this data for model training per our API agreement.
  
  

• Payments: Purchases are processed by Stripe, Apple, or Google Play. Medalite does not store card details.
  
  

2.2 Automatically Collected Information

• Device & App Data: Device model, OS version, app version, and basic diagnostics to ensure Bluetooth compatibility and fix bugs.
  
  

• Bluetooth Device Logs: Mask identifier, firmware version, and session connection data for reliable pairing and performance.
  
  

• Analytics: Firebase and Google Analytics collect anonymous, aggregated usage data to improve features and stability.
  
  

• Crash Reports: Firebase Crashlytics sends anonymized diagnostic data if the app crashes, helping us resolve issues quickly.
  
  

• Cloud Storage: Firebase Cloud Storage securely saves session data, preferences, and user-generated light sequences with end-to-end encryption.
  
  

• Local Storage & Cookies: Small data files may be stored locally to speed up loading and support offline functionality.
  No advertising or tracking cookies are used, and no personal information is stored locally.
  
  

3. How We Use Information

We use your information to:

• Enable Bluetooth and AI-driven app functionality
  
  

• Personalize light journeys and saved sessions
  
  

• Improve performance, reliability, and user experience
  
  

• Process purchases and provide customer support
  
  

• Ensure compliance with legal and store requirements
  
  

We never sell your data and do not use it for targeted advertising.

4. How Information Is Shared

We share limited data only with trusted third parties essential to operate Medalite services:

Third Party

Purpose

Data Type

OpenAI (or equivalent)

AI sequence generation

Text prompts only

Stripe / Apple / Google

Payment processing

Purchase metadata

Firebase (Google)

Analytics, crash reporting, cloud storage

App diagnostics, usage data, preferences

All partners comply with GDPR and CCPA standards and use TLS 1.2+ encrypted communication.

5. Data Retention & Deletion

• Account and session data are retained while your account is active.
  
  

• Aggregated analytics data may be stored for app performance monitoring.
  
  

• Upon account deletion, all associated data (sessions, preferences, and stored sequences) will be permanently erased within 30 days.
  
  

• You can request deletion anytime by emailing contact@medalite.io.
  
  

• You may also delete your account directly in the app (Settings → Account → Delete Account, coming in future versions).
  
  

6. Security

• Firebase Authentication and encrypted database storage protect user accounts.
  
  

• All network communications use SSL/TLS encryption.
  
  

• Access to user data is strictly limited to authorized personnel.
  
  

• Bluetooth communication occurs locally and is encrypted via ESP32 protocols.
  
  

7. Your Rights

Depending on your location (e.g., GDPR/CCPA jurisdictions), you have the right to:

• Access or download your personal data
  
  

• Correct inaccurate information
  
  

• Delete your account and data
  
  

• Opt out of analytics and data collection (via Settings)
  
  

To exercise these rights, email contact@medalite.io.

8. Children’s Privacy

Medalite is not intended for children under 13, and we do not knowingly collect data from minors.
If you believe a child has provided us information, please contact us so we can delete it immediately.

9. Changes to This Policy

We may update this Privacy Policy periodically.
Any changes will be posted in-app and at medalite.io/privacy.
The “Last Updated” date reflects the latest revision.

10. Contact Us

Medalite, Inc.
1209 Orange Street
Wilmington, DE 19801 USA
📧 contact@medalite.io

This policy is governed by the laws of the United States and the State of Utah.

⚙️ App Store & Google Play Privacy Summary

Category

Data Collected

Purpose

Shared With

Account Data

Email, Password

Account creation

Firebase Auth

Device Data

BLE ID, Session Logs

Mask connection

Local only

AI Inputs

Text prompts

AI features

OpenAI (or equivalent)

Payments

Purchase metadata

Payment processing

Stripe, Apple, Google

Analytics & Crashes

Anonymous usage, diagnostics

App improvement

Firebase

Not Collected: Location, health/biometric data, contacts, camera, or microphone.

Data Sharing: Only with core service providers — never sold or used for ads.

User Controls: Delete or request data anytime via email or in-app settings (coming soon).