Skip to content
Doctor licensed in Poland · PWZ 3211301 Prescription on the EU model Every day, 5am to 11pm (Irish time)
Log in Start

Privacy policy

1. Controller

MEDINOW Sp. z o.o., Aleja Marszałka Józefa Piłsudskiego 36/108, 10-450 Olsztyn, Poland
Email: info@medinow.app · Phone: +48 576 851 416

2. What we process

  • Identity data: first and last name, date of birth, address, email, phone number, identity document number.
  • Health data: your answers about symptoms, conditions and medicines and, if you upload them, test results. These are special categories under Article 9 GDPR.
  • Order data: order number, amount, payment status. We do not receive full card details.

3. Purposes and legal bases

  • Carrying out the medical assessment - Article 6(1)(b) and, for health data, Article 9(2)(h) GDPR, together with your explicit consent under Article 9(2)(a).
  • Keeping medical records and accounting retention - Article 6(1)(c).
  • Handling complaints and defending legal claims - Article 6(1)(f).

4. Recipients

  • Stripe Payments Europe, Ltd. - payment processing.
  • Resend, Inc. - sending emails to you.
  • Cloudflare, Inc. - hosting this website.
  • Railway Corp. - running the application and database.
  • PostHog Inc. - statistics on the use of this website, servers in the EU (details in section 10).

We do not sell your data and do not share it for advertising.

5. Transfers outside the EU

Some providers belong to groups established outside the European Economic Area. Where a transfer takes place it relies on the European Commission's standard contractual clauses or on an adequacy decision.

6. Retention

Medical records are kept for 20 years from the end of the calendar year of the last entry, as required by Polish law (Article 29 of the Polish Patients' Rights Act). Accounting records are kept for 5 years.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and you may withdraw consent at any time.

Limit on erasure: we may not delete medical records before the statutory period ends. Your user account, however, can be deleted at any time.

Write to info@medinow.app.

8. Complaint to a supervisory authority

You may complain to the President of the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland) or to the Data Protection Commission (DPC).

9. No automated decision-making

A human always reviews your request. We make no decisions based solely on automated processing and carry out no profiling within the meaning of Article 22 GDPR.

10. Cookies and analytics

Cookies and similar techniques that are necessary for the website to work (for example, remembering your choice from the cookie banner in your browser's storage) do not require consent. For statistics we use PostHog (PostHog Inc. as our processor; the data is stored on servers in the European Union). We do not use advertising cookies or marketing trackers.

Without your consent we count page views only: PostHog then runs solely in your browser's memory, stores nothing on your device, sets no cookies and records no sessions. We remove from page addresses any parameters that could contain health information. Technical data about the visit is transmitted (page address, browser type, approximate location derived from the IP address).

With your consent (the "Accept" button in the banner shown on your first visit) PostHog also uses analytics cookies, records clicks and records sessions to help us improve the website. Input fields are masked and the order form is not recorded. The legal basis is your consent (Article 6(1)(a) GDPR). You can change or withdraw it at any time via "Cookie settings" in the footer; withdrawal does not affect the lawfulness of processing carried out before it.

11. Mobile app

The services of Medscript can also be used in the mobile app of MEDINOW Sp. z o.o. (iOS and Android). If you use it, in addition to the data described above, we process:

  • Push notifications (Apple Push Notification service, Google Firebase Cloud Messaging) - only if you consent to them on your phone. In that case we store the device token (a technical identifier assigned by the phone's operating system) linked to your user account and pass it to the provider solely in order to deliver the notification. We delete the token when you sign out, when the account is deleted and when the provider reports that the device is inactive. The content of a notification never includes health data: only the order number and a prompt to open the app.
  • App updates (Capgo) - a technical device identifier, in order to deliver fixes to the app.
  • App analytics (PostHog, servers in the European Union, data processing agreement) - usage statistics and session recording in order to improve how the app works. The recording of the order form may include data that you enter in it (for example the name of a medicine or a description of your symptoms); the identity document number and the password are masked. The screens for the account, the order history and the "Medicine cabinet" feature are not recorded.
  • Medicine cabinet - the medicines, doses and reminders that you save in the "Medicine cabinet" feature remain in your phone's memory and are not sent to our server.

Apple and Google may process the device token outside the European Economic Area (in the United States) on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.