Privacy Policy

Effective date: 01.11.2026

This Privacy Policy explains how we collect, use, share and protect personal data when you use the EpiTrack mobile application for iOS and Android (the “App”), the website epitrack.eu (the “Website”) and the EpiTrack online shop (the “Shop”), together the “Services”. We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and the Bulgarian Personal Data Protection Act.

In short: EpiTrack is a diary for people with epilepsy and the people who care for them, so it handles health data. We use your data only to provide the Services, we never sell it, we never use your health data for advertising, and you can delete your account and all of your diary data from the App at any time.

1. Who is responsible for your data

The data controller is:

Advanced Coding Enterprise LLC
Company ID (EIK): 202649498
Registered address: Burgas, zhk. Slaveikov, bl. 12, ap. 21
Email for data protection matters: privacy@epitrack.eu
Phone: +359 988 880 840

2. What data we collect

2.1 Account data

• Name, email address and phone number;
• Password (stored only as a one-way hash) or, if you sign in with Google or Apple, the identifier provided by that service (via Google Firebase Authentication). With “Hide my email” Apple gives us a relay address instead of your real email;
• Whether your phone number and email are confirmed, your language, time zone and notification preferences;
• Whether you have epilepsy yourself or use the App only for someone you care for.

2.2 Health data (special category data)

Depending on what you choose to enter, the App stores:

• Episodes (seizures): date and time or part of the day, seizure type, duration, symptoms, triggers, free-text notes and which assistants were notified;
• Medical card: type of epilepsy, year of diagnosis, date of birth, blood type, allergies, other conditions, first-aid instructions and your doctor’s name and phone;
• Medications: medicines, doses and dosing times;
• Documents: photos and files you upload, such as test results, EEG or MRI reports and prescriptions.

This information is health data under Article 9 GDPR and receives the highest level of protection described in this Policy.

2.3 Patient profiles (people you care for)

You can add other people, for example a child or a relative, as patient profiles. For each profile we store the name, date of birth, an optional photo, the relationship to you, which assistants should be notified, and the same kinds of health data as in section 2.2. You may only add a person if you are their parent or legal guardian or if they have agreed to it (see section 9).

2.4 Assistants and report recipients

You can add family members, friends or carers as assistants. We store the name, email address, phone number and relationship you enter, and whether the invitation was confirmed. We send the assistant an invitation email, and – when you record an episode and choose to notify them – an alert email containing the patient’s name, the episode details, your phone number and, if filled in, the first-aid instructions, blood type and allergies from the medical card.

When you export a PDF report, we send it to the email addresses you enter (for example your doctor’s). We use these addresses only to deliver the report.

2.5 Precise location

Only if you grant the App permission, the App uses your device’s location (precise or approximate, as you choose in the system dialog) to record where an episode happened and to include the location in the alert sent to your assistants, so they can find and help the person. The location is used only when an episode is recorded or an alert is sent, never in the background. This is precise location data linked to your account and the episode; we use it only to provide this App functionality and never for advertising, profiling or tracking. You can withdraw the permission at any time in your phone’s settings; the rest of the App keeps working without it.

2.6 Device, notifications and usage of the App

• Push notification token, platform (iOS/Android), time zone and the time you last used the App – to deliver medication reminders, alerts and helpful tips;
• A record of which reminders and tips we sent you, so that we do not repeat them too often;
• Analytics: how the App is used (screens viewed, features used, app version, device model, operating system, country, pseudonymous app-instance identifier), collected through Google Analytics for Firebase;
• Crash reports: technical data about errors (stack trace, device model, operating system, app version, a pseudonymous identifier), collected through Firebase Crashlytics.

We configure analytics and crash reporting so that they do not receive the content of your diary (episodes, medical card, medications, documents) and do not receive your name or email.

2.7 Subscriptions (EpiTrack Premium)

Subscriptions are bought through the Apple App Store or Google Play. We receive from Apple or Google the transaction identifiers, the product purchased, the status (trial, active, in grace period, expired, cancelled, refunded), the start and expiry dates and whether you have used the free trial. To link a purchase to your account we use a pseudonymous account identifier. We never receive your card or payment details – they are handled by Apple or Google.

2.8 Website, Shop and contact form

• Orders: name, email, phone, chosen courier, city, postcode, delivery address or courier office, notes, the products ordered, amounts and order status;
• Premium gift codes: the code and the email address of the account into which it is redeemed;
• Contact form: name, email, optional phone, topic and your message;
• Technical data: IP address, browser type and the pages requested, recorded in the server logs, and the strictly necessary cookies described in our Cookie Policy.

3. Why we use your data and on what legal basis

Purpose	Legal basis
Creating and running your account, storing your diary, patient profiles, medications and documents, generating reports	Performance of our contract with you (Art. 6(1)(b) GDPR). For health data: your explicit consent (Art. 9(2)(a) GDPR), which you give when you register and before you enter health data
Sending alerts to your assistants and reports to the recipients you choose	Contract (Art. 6(1)(b)) and your explicit consent to share the health data (Art. 9(2)(a)); for the assistants’ own contact data – our and your legitimate interest in delivering the alerts you requested (Art. 6(1)(f))
Precise location – recording where an episode happened and including it in the alert to your assistants (App functionality)	Your consent (Art. 6(1)(a)), given through the device permission
Medication reminders, alerts and service messages (password reset, confirmations)	Contract (Art. 6(1)(b))
Helpful tips and the monthly summary in the App	Legitimate interest in helping you get value from the App (Art. 6(1)(f)); you can switch them off in the notification settings at any time
Analytics	Your consent (Art. 6(1)(a)), which you can withdraw in the App settings
Crash reporting and security (preventing abuse, keeping logs)	Legitimate interest in a reliable and secure service (Art. 6(1)(f))
Subscriptions, free trial and gift codes	Contract (Art. 6(1)(b)); preventing repeated free trials – legitimate interest (Art. 6(1)(f))
Shop orders, delivery and returns	Contract (Art. 6(1)(b))
Accounting and tax records, consumer-protection obligations	Legal obligation (Art. 6(1)(c))
Answering contact-form and support messages	Legitimate interest (Art. 6(1)(f)) or steps before a contract at your request (Art. 6(1)(b))
Establishing, exercising or defending legal claims	Legitimate interest (Art. 6(1)(f)) and Art. 9(2)(f) GDPR

You can withdraw any consent at any time, without affecting the lawfulness of processing before the withdrawal. Withdrawing consent to the processing of health data means that we can no longer provide the diary; in that case you can delete the data or your whole account from the App.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Reminders and tips are sent according to simple rules (for example, “no medication added yet”) and have no such effect.

4. Who we share data with

We do not sell personal data and we do not share health data for advertising or marketing. We share data only with:

• People you choose: your assistants and the recipients of your reports;
• Service providers (processors) that act on our instructions under a data processing agreement:
  • SuperHosting.BG (Bulgaria) – hosting of our servers and database in the European Union;
  • Google Ireland Ltd / Google LLC (Firebase) – sign-in with Google or Apple, delivery of push notifications (Firebase Cloud Messaging), app analytics (Google Analytics for Firebase) and crash reporting (Firebase Crashlytics);
  • Apple Inc. – Sign in with Apple and delivery of push notifications on iOS (APNs);
  • 650 Industries, Inc. (Expo) – delivery of push notifications;
  • Mailtrap (Railsware Products Studio LLC) – sending emails (alerts, reports, confirmations);
  • Mobica.bg – sending SMS confirmation codes;
  • Our accountant and IT support, where needed.
• Apple and Google as operators of the App Store and Google Play, for purchases and subscriptions, under their own privacy policies;
• Couriers (Econt Express and Speedy) – name, phone and delivery address for Shop orders;
• Authorities and courts, when the law requires it, and professional advisers bound by confidentiality.

If the business or the App is transferred to another company, your data may be transferred as part of that transaction, under the same protections; we will inform you in advance.

5. Transfers outside the European Economic Area

Our main servers are in the EU. Some providers listed above (Google, Apple, Expo and our email provider) may process data in the United States or other countries. Such transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, where the recipient is certified, or on the Standard Contractual Clauses approved by the European Commission, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

6. How long we keep data

• Account and diary data (including patient profiles, assistants, medications, documents, the medical card and device data): until you delete them or your account. After deletion they are removed from our live systems immediately and from backups within 30 days;
• SMS codes expire within minutes and are deleted with your account; password-reset links expire after 60 minutes;
• Subscription records: for as long as the subscription is active and then for up to 5 years for accounting, refund and dispute purposes; after account deletion they are kept without your name, email or diary data;
• Shop orders and accounting documents: for the period required by the Bulgarian Accountancy Act (currently up to 10 years);
• Contact-form messages: up to 2 years after the last communication;
• Server logs: up to 90 days, unless needed to investigate a security incident;
• Analytics and crash data: according to the provider’s retention settings, which we set to no more than 14 months.

7. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy of it;
• rectification of inaccurate or incomplete data – most data can be edited directly in the App;
• erasure (“right to be forgotten”) – you can delete your account and all diary data from the App (see how to delete your account);
• restriction of processing;
• data portability – receiving the data you gave us in a structured, machine-readable format; the PDF report also gives you a readable copy of your episodes;
• object to processing based on legitimate interest, including the tips and analytics;
• withdraw consent at any time;
• lodge a complaint with a supervisory authority. In Bulgaria this is the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg. You may also contact the authority in the EU country where you live or work.

To exercise your rights, write to privacy@epitrack.eu from the email address of your account. We may ask you to confirm your identity. We reply within one month; this can be extended by two more months for complex requests, in which case we will tell you why.

8. Assistants and other people whose data you enter

If you add an assistant, a patient profile or a report recipient, please make sure that you are allowed to share their data with us and tell them about this Policy. Assistants receive an invitation and can decline it; anyone whose data was entered can contact us at privacy@epitrack.eu to have it removed.

9. Children

You must be at least 16 years old to create your own account. Children under 16 can be included only as a patient profile managed by a parent or legal guardian, who gives the necessary consent on their behalf. If we learn that a child under 16 has created an account without that consent, we will delete it.

10. How we protect your data

We use appropriate technical and organisational measures, including: encrypted connections (HTTPS/TLS) between the App, the Website and our servers; passwords stored only as strong one-way hashes; confirmation codes stored as keyed hashes; documents and photos kept in private storage that can be accessed only by the account holder through authenticated requests; ownership checks on every request; limited staff access on a need-to-know basis; and regular backups. No system is completely secure; if a personal data breach is likely to put your rights at high risk, we will inform you and the supervisory authority as required by law.

11. Medical disclaimer

EpiTrack is a diary and communication tool. It is not a medical device, does not diagnose, monitor or treat any condition and does not replace your doctor or emergency services. In an emergency call 112.

12. Changes to this Policy

We may update this Policy when the Services or the law change. The current version is always available in the App and at epitrack.eu/privacy, with its effective date. For material changes we will inform you in the App or by email before they take effect, and where the law requires it we will ask for your consent again.

13. Contact

Advanced Coding Enterprise LLC, Burgas, zhk. Slaveikov, bl. 12, ap. 21
Email: privacy@epitrack.eu · Phone: +359 988 880 840