PRIVACY
Most of it never leaves your phone
Doris is built so that as little as possible has to leave your phone. Your medicine list, your dose history and the photos you take of the boxes stay in the phone’s own memory, and we never see them. This page is the long version: what really does get sent, when that happens, who gets to see it, and how you get rid of it.
Last updated 2 September 2026
The short answer
No tracking
No analytics, no crash reporting, no advertising id, no location. None of that is built into the app, so there is nothing to switch off — and your iPhone will never ask you about tracking.
No account
You never type in a name, a personal ID number or an email address to use Doris. Your phone gets a random key the first time you open the app, and that is your whole account.
The free part manages without us
Schedules, reminders and checking off doses all work offline. None of it is sent anywhere.
Our server is in Sweden
The little we do hold sits on our own server in Sweden. There is one exception, further down this page: the photo of a medicine label.
ON THE PHONE
This never leaves your phone
Everything you put into Doris lands in a database in the phone’s own memory, alongside the app’s other files. We hold no copy of it, and we cannot look inside.
- The medicines, the doses, the times.
- Your dose history — what you checked off, skipped or undid, and when.
- The photos you take of the boxes.
- Snoozed reminders, and how insistent you asked Doris to be.
- Your settings: language, dark mode, the profiles in a family.
There is no analytics, no crash reporting, no advertising id, no location data and no tracking in the app. No such component is in there at all — this is not a setting that could quietly be turned on in an update.
SCANNING
When you photograph a medicine label
Scanning is the one thing in the app that needs us to work. The photo of the label goes to our server, and from there on to Anthropic, which reads the text and sends it back as plain data: medicine, strength, dosage, times.
The photo is never written down. It lives in memory while the request is running, and it is gone once the answer has gone back to your phone — not in a database, not in a folder, not in our logs. We build no archive of labels.
Anthropic is in the United States, and this is the one place where anything you put into Doris leaves the EU. The photo is sent there only so it can be read, and it is passed on nowhere else.
After that it is yours to decide. You see what Doris read, you can change any of it before anything is saved — and what is saved is saved on your phone.
LOOKING A MEDICINE UP
When you type a medicine in by hand
If you enter a medicine yourself instead of photographing it, the app looks the name up in the Swedish Medical Products Agency’s open register, which we host. What gets sent is the letters you have typed so far.
That request carries no login and says nothing about who is asking — it looks the same whoever sends it. We do not store it, and what you typed never reaches our logs.
TRUSTED CONTACT AND FAMILY
The only thing that shares anything is you switching it on
A trusted contact is off from the start. Switch it on and someone you choose gets a text message when an important dose has been missed for a long time — and that feature is the reason anything has to sit with us at all.
The reason is simple: a phone can be dead. Lying flat in a coat pocket, it cannot raise any alarm, so the server has to be able to count the hours itself. To do that, it has to know when the doses were due.
This much we get, and no more:
- Your first name, which you type in yourself. It is what makes the message make sense: “Hi Eva! Karin hasn’t taken her Metformin (12:00) despite the reminders. Do give her a ring. / Doris”
- The name and mobile number of the person you chose.
- The times for the medicines you marked as important — the name, the strength and the hours. Medicines you did not mark as important are never sent.
- One line each time a dose is checked off, skipped or undone, with the time it happened.
- Your phone’s time zone, so the hours mean the right thing.
This is the only place in all of Doris where a person’s name sits with us, and it sits there only while a trusted contact is switched on. Switch it off and the mobile number and your first name are deleted straight away, and the events queued up on the phone are dropped.
Family — several people in a household sharing one subscription — works through an invite code. Of that code we keep only a cryptographic fingerprint, never the code itself, and what it links together is two random keys. Family on its own sends no medicines anywhere. The trusted contact is the switch that does that.
Your address book is read on the phone
When you pick who your trusted contact should be, you can browse your phone’s contacts. That list is read on the phone and sent nowhere — we only get the one name and the one number you choose. And if you would rather type the number in by hand, the app never needs your contacts at all.
Purchases and receipts
If you pay for scans or for Doris+, the payment is handled by the App Store or Google Play, and we never see your card. The app passes the receipt on to us, and we ask Apple or Google whether it is genuine, so that the right phone gets what was paid for.
The check that the app is the real app
Every scan costs us money, so before we answer, the app asks the operating system for proof that it is the real Doris app on a real phone — App Attest on iPhone, Play Integrity on Android. That proof is written by Apple or Google, is about the phone, and says nothing about you.
BACKUPS
Your medicine list rides along in your phone’s ordinary backup
Your phone’s own backup takes the Doris database with it: the medicine list, the dose history, and the trusted contact you entered. On iPhone that means iCloud; on Android, Google’s backup.
That is on purpose. Change phones, or lose one, and the schedule comes back without you having to photograph every box again — and for someone on twelve medicines that is the difference between a quarter of an hour and an afternoon.
The backup is your own, held by Apple or Google under their terms, and we cannot reach into it. If you would rather Doris were not in there, switch backup off in your phone’s settings.
OUR SUPPLIERS
Who gets to see a piece of it
Each of them for one single job, and none of them for anything of their own:
AnthropicUnited States
Reads the text in the photo when you scan a medicine label.
46elksSweden
Sends the text message to your trusted contact.
Apple and GoogleUnited States
Take the payment, confirm receipts, and write the proof that the app is genuine.
Google Play does not count this as “sharing” your data, because each of them works to our instructions. We are listing them anyway. You should be able to follow the whole way.
THE WEBSITE
This site
We count visits with Rybbit, which we run ourselves on our own server. It sets no cookies, takes no fingerprint of your browser and sends nothing outside the EU — which is why there is no cookie box here to click away.
If you sign up to hear when Doris launches, we keep your email address and the language of the page you signed up on, and nothing else. We will write when the app is there to download, and now and then something small about the build. Say the word and we take you off the list.
The tag reader and the page for pharmacy staff count no visits whatsoever. Those pages promise that nothing leaves them, and the promise is built into the server that hands them out.
DELETION
How long we hold it, and how you get rid of it
- Photos of medicine labels are not stored at all.
- The mobile number and your first name are deleted the moment you switch the trusted contact off.
- What you type when looking a medicine up by hand is not stored.
- Your IP address is used to slow abuse down, and is neither written down nor logged.
- The rest — the random key, your purchase history, and whatever the trusted contact feature synced — stays as long as you use the app.
There is no account to close. The only “account” is the random key your phone was given the first time you opened the app.
If you want us to remove everything we hold about your phone, write to us. We delete the whole row in one go — the key, the purchase history, the synced schedule, the events, the trusted contact and any queued alerts — and the key stops working immediately. Uninstall the app and everything that was on the phone goes with it.
YOUR RIGHTS
What you may demand of us
You have the right to know what we hold about you, to have it corrected, to have it deleted, to object to how we use it, and to receive it in a readable format. Write to us and we will help you.
One thing is worth knowing in advance: because we do not know who you are, we cannot look you up by name — we have no name to look up. That is good for your privacy and slightly awkward right here. Get in touch anyway, and we will work it out together.
If you think we are handling your data wrongly, you may complain to the Swedish Authority for Privacy Protection, IMY.