MedMatch · Effective August 26, 2026
Privacy, in plain language.
We built MedMatch to help people ask better questions about medicines and supplements without requiring an account. This page explains what the companion app stores, why it is needed, and what it does not do.
What the app stores
The companion app uses an opaque, random device token so it can reconnect to the same private device workspace. No name, email address, phone number, or account is required.
Saved context
When you choose to use these features, the service may store profile and family-profile fields, medicines, allergies, diet, routines, reminders, optional pharmacogenomic context, product lookup results, and scan history under that token.
Retention and control
Saved context remains until you ask to delete it. History is capped at 100 entries, lookup cache at 200 entries, and operational coverage telemetry at 10 MiB. You can export or delete the current device workspace from the companion app. Clearing app storage removes the local token but does not by itself delete the server workspace.
What we do not do
- No advertising SDKs or behavioral advertising.
- No sale of health-related data.
- No profile, medication, or allergy fields sent to an external provider by the public build.
- Label photos used for OCR are processed in memory and are not stored by MedMatch.
Limited operational telemetry may record a truncated product lookup key, hit/miss result, source, and timestamp for recognition-quality work. It does not include profile fields or a device identifier.
Public data and medical limits
Product and scientific-reference lookups may send a barcode, product name, ingredient text, or search term to the public service requested, including Open Food Facts, USDA FoodData Central, NCBI, NIH DailyMed, openFDA, or RxNorm.
MedMatch provides reference information, not medical advice, diagnosis, or treatment. Interaction data may be incomplete. Always consult a licensed physician or pharmacist before changing a medication routine.
Export, deletion, and security
Within the companion app, you can request:
- Export: a copy of your current device workspace.
- Delete: clear the current device namespace.
- Purge: clear the namespace and remove its per-device server file when possible.
The public deployment must enforce HTTPS. The server-side workspace is keyed by a random, HTTP-only cookie rather than a personal identity. Hosting providers may retain standard infrastructure logs under their own policies.