Privacy Policy
Iasora is an app for families to keep their children's health record — birth, growth, vaccines, prescriptions, doses, appointments and documents — and to share it with a clinician when they decide to. This policy explains what data we process, why, with whom, for how long, and what your rights are.
Who is responsible
Afonso Zefanias Mathombe Júnior, an individual developer based in Maputo, Mozambique. For any privacy question: contact@iasora.app.
What data we process
| Category | Examples | Why |
|---|---|---|
| Account | Name, email, phone (optional), language, time zone | To create the account, sign you in with a code sent by email, and contact you |
| Child's health | Name, date of birth, sex, blood group, growth, vaccines, allergies, conditions, prescriptions and doses, symptoms, appointments, hospital stays, tests | This is the product: keeping the record, showing it to you, reminding you of doses and appointments |
| Documents and photos | Vaccination card, prescriptions, test results, the child's photo | Keeping them in the record's vault. Location data is removed from photos before they are stored |
| Device | Notification token, device name and system | Sending reminders and showing you which devices are signed in |
| Sharing | Who opened the record, when, and which sections they saw | Showing you who looked at your child's record |
| Purchases | Subscription identifier and status, sent by the App Store or Google Play | Knowing whether the account has Pro. We never see or store card details |
| Usage and crashes | Which screens you open (by screen name, never your child’s), actions such as “child added” or “share code created”, device model and system, approximate country, app crash reports | Knowing which parts of the app are used and fixing errors. Never includes health content, names or anything you type |
We do not show ads in the app, we do not collect your device’s advertising identifier and we do not use your data for personalised ads. To measure usage and crashes we use Google Analytics for Firebase and Firebase Crashlytics, without health content and without your name or your child’s. On the blog and public pages, Google Analytics uses cookies to count visits. Your data is not sold or used for profiling.
HealthAI (artificial intelligence)
HealthAI answers questions about your child's record and helps read documents. It only works after you give explicit consent, per child, and you can withdraw it at any time. Before the record goes to the AI provider, the child's name is replaced with "the patient" and yours with "the guardian"; phone numbers, emails, the date of birth and the health card number never leave — the age goes instead of the date. Photos of documents you ask it to read go as they are. HealthAI is not a medical device and does not diagnose.
Who we share with
- A clinician, only when you decide. You create a code that expires in 15 minutes and choose which sections they see. You can end the share earlier.
- Other guardians you invite to the same child.
- Providers that make the service work, only for that purpose: the provider hosting the server; Google Cloud Storage (documents); Firebase Cloud Messaging and Apple Push Notification service (notifications); Google Analytics for Firebase and Firebase Crashlytics (usage statistics and crash reports, without health content); the email service that sends sign-in codes; the HealthAI AI provider (Anthropic or OpenAI), only with your consent and with direct identifiers removed; Apple and Google, for in-app purchases.
- When the law requires it.
Security
Connections are encrypted (HTTPS). The app locks with Face ID, fingerprint or passcode on launch and after two minutes in the background, and hides the record in the app switcher. Session tokens are kept in the Keychain (iOS) and in Android's encrypted storage.
How long we keep data
For as long as the account exists. When you ask to delete the account you have thirty days to change your mind; after that the account and the records you are the only guardian of are permanently deleted. Audit records without health content may be kept longer where the law requires it.
Your rights
- See what we keep: Settings → Privacy, in the app.
- Take everything with you: export the full record, with documents.
- Correct any entry in the record.
- Delete the account, in the app (Settings → Privacy) or on the web at iasora.app/settings/privacy, even without the app installed. Deleting the account does not cancel a subscription: cancel it in the App Store or Google Play.
- Withdraw consent for HealthAI at any time.
To exercise any of these rights, or to complain, write to contact@iasora.app. If you are in South Africa you may also lodge a complaint with the Information Regulator (POPIA).
Children
The app is used by parents and guardians, who are adults. Children's data is entered by them, or by a clinician with their permission.
Changes
If this policy changes in a meaningful way, we will tell you in the app before the change takes effect.