1. Introduction

Epilog ("we," "our," or "the App") is a seizure, medication, and diary tracking application designed to help individuals with epilepsy organise and record their health information. This Privacy Policy explains how Leandro Barreto / LND Tech ("the Developer") handles your information when you use the App.

By using Epilog, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

2. Information We Collect

2.1 Data You Provide (Stored Locally)

When using Epilog, you may enter the following types of information, which is stored exclusively on your device using Apple's SwiftData framework:

• Seizure records (date, time, duration, type, severity, triggers, location context, recovery time, optional attached video filename)
• Medication information (names, dosages, frequencies, side effects, prescriber information, stock levels)
• Emergency protocol details (medications, triggers, doctor and hospital information)
• Diary entries (mood, stress levels, anxiety, energy, sleep quality, personal notes, weather, tags)
• Automatic weather diary entries created when you save a seizure (condition label plus a locked weather text snapshot with temperature, humidity, and pressure — stored locally; notes remain editable)
• Location context for seizures and diary entries (general location type such as "home" or "work" — not GPS coordinates)
• Patient profiles (names, relationships, notes, colour preferences) when using the multi-patient feature
• Seizure notification contacts (names and email addresses you add for Epilog Pro email alerts)
• Optional seizure videos you choose to record during an event (stored locally in the App and optionally copied to your Photo Library)

2.2 Data We Do NOT Automatically Collect

Epilog does not automatically collect or transmit:

• Your name, email, phone number, or postal address (unless you voluntarily provide them for a specific feature such as seizure email alerts)
• GPS location data or precise geolocation stored in your health records (unless you choose to capture GPS on a seizure when that option is enabled). When you record a seizure, Epilog may briefly use your current location on-device to request local weather from a weather provider; coordinates are not saved on the weather diary entry and are not sent to AI Insights
• Device identifiers in anonymous research payloads (IDFA, IDFV, account IDs, etc.)
• Behavioural analytics beyond standard ad network practices when ads are shown (see Section 9)
• Your address book or contacts list (you manually enter notification contacts)
• Camera or microphone content — except when you explicitly start a seizure video recording. Videos stay on your device (and optionally your Photo Library) and are not uploaded to our servers

2.3 Anonymous App Account (Firebase)

On launch, Epilog may sign you in anonymously with Google Firebase Authentication. This creates a random user identifier (UID) that is not linked to your name, email, or phone number in the App. We use it only to:

• Fetch read-only promo tips from Firestore
• Enforce fair-use limits for free-tier AI Insights (once per week)
• Maintain a lightweight app registry (language, app version, Pro status, last seen — no health records)

This UID is stored in Firebase (users/{uid}) and is separate from your local health database.

2.4 Sign in with Apple & doctor sharing (optional, Epilog Pro)

If you choose the healthcare provider role or use Share with doctor, Epilog uses Sign in with Apple linked to Firebase Authentication so your device can connect securely with a doctor's device. Patients generate a time-limited QR code; doctors scan it to request access. The patient must confirm before any data is shared.

What is shared: read-only summaries only — seizure counts and trends, medication adherence percentages, active medication count, seizure type breakdown, and counts of items flagged for doctor discussion. Not shared: diary text, seizure notes, photos, videos, full names, dates of birth, emergency protocol details, or pharmacy information.

Summaries are stored in Firebase Firestore (connections, patient_summaries) while a link is active. Either party can revoke access at any time; revocation deletes the summary document for that connection. Pairing tokens expire after five minutes and are single-use.

3. Data Storage

This means:

• Your data is protected by your device's security features (Face ID, Touch ID, passcode)
• We cannot remotely access, view, or retrieve your local health records
• There is no automatic cloud backup of your full personal health database. Optional Share with doctor (Pro) uploads read-only summaries only while you keep a doctor link active
• If you delete the App, local data stored by Epilog is removed from your device (subject to device backup settings)
• The App supports optional biometric lock (Face ID/Touch ID) for an additional layer of privacy
• Apple Watch data syncs between your iPhone and paired Watch over Apple's local Watch Connectivity — not through our servers

4. Anonymous Research Data Sharing

4.1 Purpose

When you enable this feature, Epilog sends anonymised snapshots of your medication, seizure, mood, and demographic data to a secure research database hosted on Google Firebase Firestore. Snapshots are sent at most once every seven days while the feature remains enabled. The data is aggregated for statistical and clinical research purposes only — not for advertising or marketing.

4.2 What Is Transmitted

When this feature is enabled, the App uploads a snapshot (schema version 2) containing only the following anonymised fields:

Demographics (per patient profile, no names or IDs):

• Relationship category from predefined options (e.g. Self, Child, Parent)
• Age band derived from birthdate (e.g. 0-12, 13-17, 18-29, 30-49, 50-64, 65+, or unknown) — exact birthdates are never sent
• Whether a birthdate was recorded (hasBirthdate)

Medications (per entry):

• Medication name (as you entered it in the App)
• Frequency (predefined categories only)
• Medication category (predefined categories only, if recorded)
• Whether currently taking
• Dose unit (if recorded)
• Total daily dose (if recorded)
• Reported side effects from predefined categories only (free-text or "Other" side effects are excluded)
• Approximate duration on medication in months (rounded; exact start dates are not sent)
• Relationship and age band copied from the linked patient profile (if applicable)

Seizures (per entry):

• Month and year only (e.g. 2026-06) — exact date and time are never sent
• Time-of-day bucket derived locally (Early Morning, Afternoon, Evening, or Night) — not the exact clock time
• Seizure type (from predefined categories)
• Severity rating (1–5 scale)
• Duration in seconds
• Whether rescue medication was taken
• Whether the seizure was recorded via Apple Watch
• Predefined triggers only (free-text or "Other" triggers are excluded)
• General location category from predefined options (e.g. "Home", "Work") — custom location text is never sent
• Broad anonymised region derived from coarsened GPS (city, municipality, or administrative area) — raw coordinates are never sent
• Post-ictal recovery duration and rescue medication timing (if recorded)
• Relationship and age band copied from the linked patient profile (if applicable)

Mood / diary entries (per entry):

• Month and year only — exact date and time are never sent
• Time-of-day bucket (Early Morning, Afternoon, Evening, or Night)
• Star rating (1–5, if recorded)
• Mood tags from predefined categories only (e.g. Anxious, Calm, Tired)
• Stress, anxiety, energy, and sleep quality ratings (1–5 scales)
• Mood category from predefined options
• Whether the entry signals elevated risk based on mood data
• Relationship and age band copied from the linked patient profile (if applicable)

Snapshot metadata:

• Schema version (schemaVersion)
• Submission month and year (submittedMonthYear) — no exact upload timestamp is included in the payload

4.3 What Is NEVER Transmitted

The anonymous research upload explicitly excludes:

• Your name, email address, phone number, or any contact information
• User IDs, patient profile names, photos, or device identifiers (IDFV, IDFA, etc.)
• Exact birthdates or age in years — only broad age bands are sent
• Free-text fields: notes, prescriber names, product descriptions, diary notes, custom locations, or custom triggers
• Exact dates, times, or timestamps of seizures, mood entries, or medication events
• Emergency protocol details, doctor or hospital names
• GPS coordinates or precise geolocation data
• Weather, doctor flags, keto/glucose levels, and stock-tracking details

4.4 When Uploads Occur

While the feature is enabled, an anonymised upload is sent at most once per week (every seven days). The first upload happens when you continue past the welcome screen with sharing enabled, or when you turn the feature on in Settings → Research & Privacy; subsequent uploads occur when you open the App again after at least seven days have passed since the last successful upload. Disabling the toggle immediately stops any future uploads.

4.5 How Data Is Stored

Anonymous snapshots are stored in Google Firebase Firestore in a collection called anonymous_research_snapshots. Each upload receives a randomly generated document ID from Firebase that is not linked to your account or device in the App. Data is transmitted over HTTPS (encrypted in transit). Server-side rules restrict the App to creating new documents only — it cannot read, modify, or delete existing research records.

4.6 Legal Basis and Your Control

• Anonymous research sharing is enabled when you first use the App unless you turn it off on the welcome screen or later in Settings → Research & Privacy. Continuing with sharing enabled constitutes your consent to this optional processing (GDPR Art. 6(1)(a))
• You may opt out at any time by disabling "Share anonymous research data" on the welcome screen or in Settings → Research & Privacy
• Disabling the feature does not delete snapshots already submitted, as they cannot be linked to your identity. To request deletion of research data that may correspond to your contribution, contact support@lndtech.eu — we generally cannot identify which document belongs to you due to the anonymisation design

4.7 Data Recipients

Anonymous research data is processed and stored by Google Firebase (Firestore) on behalf of the Developer, in accordance with Google's Firebase Privacy Policy and Google Cloud Data Processing Terms. Aggregated datasets may be analysed by the Developer and shared with healthcare research partners in anonymised, non-identifiable form only.

4.8 Multi-Patient Profiles and Research

If you manage multiple patient profiles (Epilog Pro), anonymous research snapshots include data from all active profiles on the device in a single submission. Each profile's entries carry only a relationship category and age band — never a name or profile identifier. There is no cross-linking identifier between profiles within the snapshot or across submissions. An outside observer cannot determine how many profiles belong to the same device or user.

5. Seizure Email Notifications (Epilog Pro, Optional)

If you are an Epilog Pro subscriber and enable seizure email notifications, the App may send email alerts through the Developer's secure backend at lndtech.eu when a qualifying seizure is recorded. This feature is disabled by default and only runs when you configure it.

When you use this feature, the following data is transmitted to our email service:

• Patient display name (as configured in the App)
• Recipient names and email addresses you added as notification contacts
• Seizure details: date and time, type, duration, severity, triggers, rescue medication usage, location context, post-ictal duration, and any notes you attached to that seizure record
• Your active Pro subscription product identifier (to verify eligibility)

This data is linked to the information you provide (names and emails) and is used solely to deliver the notification emails you requested. It is not used for advertising, sold to third parties, or added to anonymous research datasets. Emails are sent only when your configured notification rules are met.

5.2 Pharmacy Quick-Order Email (Optional)

Epilog lets you email a medication refill request directly to your pharmacy. This feature is disabled until you set it up and requires your explicit confirmation before the first email is sent.

When you use this feature:

• The email is composed and sent through your device's native email app (e.g. Apple Mail or Gmail) — it does not pass through Epilog's servers
• The email may include: medication names, dosages, prescriber details, and refill quantities you selected
• Your pharmacy's contact information (name, email address) is stored locally on your device only
• Once the email leaves your device, its retention is governed by your email provider's policies and your pharmacy's data practices — not by Epilog

Epilog does not store copies of sent emails, does not have access to your email account, and does not transmit pharmacy order data to any third party.

6. App Feedback (Optional)

If you choose to send feedback through Settings, the App transmits the following to Firebase Firestore (user_feedbacks):

• Your star rating (1–5)
• One or more features you selected as most useful
• Any suggestions you type in the open feedback field (up to 2,000 characters)
• Your App language/locale setting
• A server timestamp of submission

Feedback is voluntary and is not linked to your account or device identifiers in the payload. Please do not include personal or medical identifying information in free-text suggestions.

7. Doctor Reports, Exports, and Daily Messages

7.1 Doctor Reports (Local Only)

Epilog Pro includes a Doctor Report feature that builds a clinical summary from your local data for neurologist visits. Report generation happens entirely on your device — no health data is sent to external AI services. You may export the report as PDF and share it yourself.

7.2 Exports

You can voluntarily export medication reports, emergency protocols, doctor reports, and diary entries (JSON/CSV) for backup or sharing with healthcare providers. These actions are entirely user-initiated.

7.3 Promo Messages (Firestore)

The App may display short educational or motivational tips on the Diary and Medications screens. Messages are fetched from Google Firebase Firestore (promo_messages) after anonymous sign-in. Only your App language is used to select content — no health records are sent in this request. Messages may include an optional "Learn more" link to pages on lndtech.eu.

7.4 AI Insights (Optional — Google Gemini via lndtech.eu)

If you enable AI Insights in the App (explicit consent required), Epilog sends a summary of your recent health data to our secure backend at lndtech.eu, which calls Google Gemini to generate supportive wellness text. This is not medical advice.

• Free plan: At most one automatic insight per 7 days, based on a limited summary (e.g. seizure counts and recent activity — not full diary notes)
• Epilog Pro: Up to one insight per day per patient when your data changes, using a richer summary (seizures, diary entries including weather summaries when present, medications from the last 90 days)

Data is sent only after you tap to enable AI Insights and accept the consent prompt. You can disable this at any time in the Insights screen. Epilog uses a paid Gemini API tier — your data is not used to train Google's models. Free-tier requests include a Firebase ID token for rate limiting; Pro requests include subscription verification via Apple. Raw GPS coordinates are never included in AI Insights payloads.

7.5 PDF and Data Export Details

When you export data from Epilog, the content depends on the export type. All exports are user-initiated and shared through iOS share sheets — Epilog does not upload them automatically.

• Medication Report (PDF): Includes medication names, dosages, frequencies, side effects, prescriber information, stock levels, and (optionally) the emergency protocol. Does not include seizure history, diary entries, or mood data.
• Emergency Protocol (PDF): Includes rescue medications with dosages and timing, emergency triggers, prescribing doctor information, and hospital details. Does not include historical seizure statistics or diary content.
• Doctor Report (PDF, Pro): Includes seizure statistics, medication adherence data, trigger analysis, and AI-generated clinical summary (if enabled). Does not include personal diary notes, location labels, or mood free-text.
• Diary Export (JSON/CSV): Includes all diary entry fields (mood, metrics, notes, tags, weather). Does not include device identifiers, analytics data, or Firebase UIDs.

No export file contains your device IDFV/IDFA, Firebase UID, or anonymous research data. You control who receives exported files.

8. Data Sharing Summary

We do not sell or rent your data. Data may leave your device only in these circumstances:

• Anonymous Research: Only when you opt in under Settings → Research & Privacy; at most once per week while enabled (see Section 4)
• Seizure email alerts: When you enable Epilog Pro notifications (see Section 5)
• Promo messages: When the App fetches tips from Firestore (see Section 7.3) — no health data
• AI Insights: When you enable consent (see Section 7.4) — free: weekly limited summary; Pro: daily richer summary via lndtech.eu and Gemini
• App feedback: When you voluntarily submit the feedback form (see Section 6)
• Weather lookup: When you save a seizure, Epilog sends a city-level latitude/longitude (rounded, not your precise GPS position) to Open-Meteo solely to retrieve current weather conditions. Neither Epilog nor Open-Meteo stores precise coordinates after the request completes. The weather result (temperature, humidity, pressure, condition label) is saved locally in a diary entry. Location labels you choose (such as "home" or "work") remain on your device only and are never sent to Open-Meteo
• Exports and PDF sharing: When you explicitly export or share files
• Device backups: If you back up your device via iCloud or iTunes, App data may be included according to Apple's policies

9. Advertising

Some versions of Epilog display advertisements served by Google AdMob. When ads are shown, Google AdMob may collect certain device information and use advertising identifiers in accordance with Google's Privacy Policy.

You can remove advertisements by subscribing to Epilog Pro through the App Store. The Developer does not receive your health data through AdMob.

10. Third-Party Services

Epilog integrates with the following third-party services:

• Google Firebase (Auth & Firestore): For anonymous sign-in, Sign in with Apple (doctor sharing), promo messages, optional user registry (users/{uid}), doctor connection and summary sync (connections, patient_summaries, pairing_tokens), anonymous research snapshots (weekly when enabled), and voluntary app feedback, subject to Firebase Privacy Policy
• Google AdMob: For displaying advertisements in supported versions, subject to Google's privacy policies
• Apple StoreKit: For processing Epilog Pro subscriptions, subject to Apple's privacy policies
• lndtech.eu backend: For seizure email notifications (Pro), AI Insights (free and Pro tiers via Google Gemini), when those features are used
• Google Gemini: For generating optional AI Insights text when you enable consent, subject to Gemini API Terms
• Open-Meteo: For fetching current weather conditions when a seizure is recorded. Only city-level (rounded) coordinates are sent; precise GPS is never transmitted or stored. Weather results are saved locally on your device. Subject to Open-Meteo Terms

Firebase and our hosting provider may process standard request metadata (such as IP address) as part of network infrastructure. The Developer does not integrate separate behavioural analytics or crash-reporting SDKs beyond those listed above.

11. Children's Privacy

Epilog can be used by individuals of all ages, including children under parental supervision. The multi-patient feature allows parents and caregivers to track seizure data for dependants.

• Parents should supervise children's use of the App
• Anonymous research sharing is enabled on first launch unless opted out; parents or guardians should review the welcome screen and Settings → Research & Privacy before continuing on behalf of users under 18
• We comply with applicable children's privacy laws including COPPA where they apply

12. Data Security

Your data is protected by:

• Apple's iOS and watchOS security architecture and App sandboxing
• Device-level encryption
• Optional biometric authentication within the App (Face ID / Touch ID)
• HTTPS encryption when optional research, feedback, or notification data is transmitted

12.1 Encrypted Backups (Coming Soon)

Epilog is developing an optional encrypted backup feature that is separate from standard iOS device backups. When available, it will work as follows:

• You choose a passphrase that only you know — Epilog and LND Tech cannot access or recover it
• Your health data is encrypted on-device using AES-GCM (a widely trusted encryption standard) before it leaves the App
• The encrypted file is saved to your personal iCloud Drive folder — accessible only to your Apple ID
• Without your passphrase, the backup file is unreadable — by Epilog, by Apple, and by anyone else
• Standard iOS backups (iCloud Backup or Finder/iTunes) continue to follow Apple's own encryption policies independently of this feature

This section will be updated with final details before the feature launches. The feature is currently disabled.

13. Your Rights

You have control over your data:

• Access and modification: All local records are visible and editable within the App
• Deletion: You can delete individual records, patient profiles, or uninstall the App to remove local data
• Export: You can export medication data as PDF and diary data as JSON/CSV
• Opt-out: You can disable anonymous research sharing at any time in Settings → Research & Privacy, and disable AI Insights consent in the Insights screen

If you are located in the European Economic Area (EEA), you may have additional rights under GDPR, including the right to object to processing and the right to lodge a complaint with a supervisory authority. For anonymous research data, the right to erasure may be limited because submitted snapshots cannot be linked to your identity — contact us if you have concerns.

14. App Store Privacy Labels

Apple's App Privacy nutrition labels for Epilog reflect the data types collected when optional features apply — including Health data in anonymised research snapshots when sharing is enabled (not linked to you when no account or device identifiers are included), Contact Info and linked Health data when you use seizure email notifications, and Other User Content when you voluntarily submit feedback. Local health data that never leaves your device is not "collected" in the App Store sense. See Apple's App Privacy Details for definitions.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected in the "Last Updated" date at the top of this page. Continued use of the App after changes constitutes acceptance of the revised policy where permitted by law.

16. Health Disclaimer