This Privacy Policy ("Policy") applies to the Pharmachameleon mobile application ("Application") available on iOS and Android, and any related services we operate. Pharmachameleon is a personal medication management application ("we," "us," or "our").
This Policy explains what information we collect, how we use it, with whom we share it, and your rights regarding your personal data. By creating an account and using the Application, you agree to the practices described in this Policy.
If you do not agree to this Policy, please do not use the Application.
When you create an account, we collect:
Pharmachameleon is a personal medication management tool. When you add and manage medications, we collect:
rxcui and tty) — may be stored with a medication entry for drug matching; not visible to you and carry no additional personal information beyond what the medication name already identifiesWhen you use the Application, we automatically collect limited technical information required to deliver the service:
We do not collect or store your IP address, track the pages or screens you visit, measure time spent in the Application, or use behavioral analytics or advertising SDKs of any kind.
To personalize your medication schedule experience, we store the following preferences you configure within the Application:
These preferences are stored in your account and restored automatically across sessions and devices.
The Application includes an optional feature allowing you to photograph a prescription label or select an existing image from your device's photo library to automatically extract medication information. When you use this feature:
Use of this feature requires camera permission and/or photo library access on your device, depending on whether you photograph or select an existing image. Both permissions are entirely optional — all core features of the Application remain fully available without them.
To improve performance and allow access to your data within the Application, we store certain information locally on your device using on-device storage mechanisms (SQLite database and device preference storage). This includes your account settings, medication data, and session information cached for use within the Application. This locally cached data:
We use the information we collect to:
We may use anonymized, aggregated data — which cannot identify any individual user — for internal research and product improvement purposes.
We do not:
The Application uses Firebase Cloud Messaging (FCM) by Google to deliver medication reminders and refill alerts to your device. To enable this, we store a device-specific push notification token associated with your account in our database.
You can disable push notifications at any time through your device's system settings:
Disabling notifications will prevent delivery of medication reminders but will not affect your account, stored data, or any other app functionality.
The Application uses an AI-powered Optical Character Recognition (OCR) system powered by Tesseract.js (an open-source neural network-based OCR engine) to read and interpret prescription label photographs.
Important disclosures:
We work with the following third-party service providers and public reference databases as necessary to deliver the Application's features. Our service providers act as data processors on our behalf and are contractually obligated to protect your data and use it only as directed by us. Where noted, certain entries are publicly available government drug reference databases — your personal information is never transmitted to those services; only non-identifying drug reference codes are used.
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Supabase | Database, user authentication, and backend API infrastructure | supabase.com/privacy |
| Google Firebase — Cloud Messaging (FCM) | Delivering push notifications (medication reminders, refill alerts) | firebase.google.com/support/privacy |
| Google Firebase — Performance Monitoring | Monitoring application performance and stability | firebase.google.com/support/privacy |
| Google Play Services | Core Android infrastructure required for Firebase to function | policies.google.com/privacy |
| U.S. Food & Drug Administration (OpenFDA) | Retrieving publicly available FDA-approved drug labeling information (such as warnings, dosage, drug interactions, adverse reactions, and other label sections) for display within the Application. No personal data is transmitted — queries use only medication names and drug reference identifiers. | fda.gov/about-fda/about-website/website-policies |
| U.S. National Library of Medicine (RxNorm / RxNav) | Retrieving publicly available drug reference data (such as dose forms, strengths, condition classifications, and other drug information) for medications when you add or edit a medication. No personal data is transmitted — queries use only drug reference identifiers (rxcui). | nlm.nih.gov/privacy.html |
Our internal medication name search database is pre-populated from RxNorm data — a standardized drug nomenclature maintained by the U.S. National Library of Medicine. When you add or edit a medication with a recognized drug identifier, the Application also makes live requests to the National Library of Medicine's publicly available RxNav API to retrieve drug reference data (such as dose forms, strengths, condition classifications, and other publicly available drug information) specific to that medication. In all cases, only drug reference identifiers are transmitted — no personal data is shared with these government services.
The data stored in our internal reference tables (such as medication names, forms, strengths, and conditions) may be sourced from publicly available third-party drug databases and medical nomenclature systems. These are reference datasets used to power search suggestions and data entry assistance within the Application — your personal information is never transmitted to any source from which this data originates.
From time to time, the Application may retrieve publicly available drug reference information from additional U.S. government health databases. In all such cases, only non-personal drug reference data is transmitted — your personal information is never shared with these services.
We do not sell your personal information. We may share your information only in the following limited circumstances:
You can delete your account and all associated data directly within the Application at any time:
Deletion is immediate and permanent. All your data is removed from our servers at the moment of deletion and cannot be recovered.
Alternatively, you may request account deletion by contacting us at ab36@uab.edu. We will process your request and confirm deletion promptly.
We implement the following security measures to protect your information:
No method of electronic transmission or storage is 100% secure. While we implement commercially reasonable safeguards, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account password.
In the event of a data breach that affects your personal data, we will notify you as required by applicable law — including the Alabama Data Breach Notification Act (Ala. Code § 8-38-1 et seq.) and any other applicable state or federal laws. We will provide timely notice describing the nature of the breach, the categories of data affected, and the steps we are taking to address it.
Your data is stored and processed on servers operated by Supabase and Google (Firebase), which may be located in the United States or other countries. If you are located outside the United States, including within the European Economic Area (EEA), your data will be transferred to and processed in the United States or other jurisdictions whose data protection laws may differ from those in your country.
Where required by applicable law (including GDPR), we ensure appropriate safeguards are in place for such transfers, including:
By using the Application, you acknowledge and, where required, consent to the transfer and processing of your data in the United States and other countries as described in this Policy.
Regardless of your location, you have the right to:
If you are located in the European Union or European Economic Area, you additionally have the right to:
Legal bases for processing under GDPR:
| Processing Activity | Legal Basis |
|---|---|
| Account creation and authentication | Performance of a contract (Art. 6(1)(b)) |
| Delivering medication reminders | Performance of a contract (Art. 6(1)(b)) |
| Storing health and medication data | Consent (Art. 6(1)(a); Art. 9(2)(a)) |
| OCR prescription image processing | Consent (Art. 6(1)(a)) |
| Application security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Anonymized research and analytics | Legitimate interests (Art. 6(1)(f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
You may withdraw consent for health data processing at any time. Please note that withdrawing consent for the processing of health data will affect your ability to use the Application's core features, as such processing is fundamental to the service.
If you are a California resident, you have the right to:
Categories of personal information collected in the preceding 12 months:
Source: Directly from you when you use the Application.
Business purpose: To provide the Application's medication management features.
Third parties receiving data: Service providers listed in Section 6 only.
To exercise your California privacy rights, contact us at ab36@uab.edu.
You can stop all data collection from your device by uninstalling the Application. Uninstalling will prevent the Application from collecting or transmitting new data from your device but will not automatically delete data already stored on our servers. To delete your stored data, see Section 9.
You can disable push notifications at any time through your device settings without uninstalling the Application, as described in Section 4.
The Application is intended exclusively for users 18 years of age and older. We do not knowingly collect, use, or disclose personal information from any person under the age of 18. The Application is not directed to, marketed to, or designed for use by minors.
If you are a parent or guardian and believe that your child under 18 has provided us with personal information, please contact us immediately at ab36@uab.edu. We will promptly investigate and delete such information from our systems upon verification.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
We encourage you to review this Policy periodically. Previous versions of this Privacy Policy are available upon request by contacting us at ab36@uab.edu.
Your continued use of the Application after the effective date of any changes constitutes your acceptance of the updated Policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:
Pharmachameleon
University of Alabama at Birmingham
1720 University Blvd, Birmingham, AL 35294, United States
Email: ab36@uab.edu
We will respond to privacy-related inquiries within a reasonable timeframe, and within any timeframes required by applicable law for formal rights requests.
© 2026 Pharmachameleon. Effective August 3, 2026.