TotMediX Privacy Policy
Effective date: 27 August 2026
Our privacy policy #
It is our mission to help parents manage their child's health with confidence. To achieve this, we build easy to use tools that lighten the mental load of managing a child's health. To do this well, we need parents, caregivers, and pediatric care providers to trust us with some of the most sensitive information a family has: their child's health. Earning and keeping that trust is central to everything we build.
Introduction #
This privacy policy governs the use of data collected through our website (totmedix.com), our waitlist sign-up form, and our mobile app, TotMediX, available on iOS and Android (together, "the service", "TotMediX", or "the app"). TotMediX is developed and operated by Nimah Prime Technologies.
By using TotMediX, you acknowledge that you have reviewed both our terms and conditions and this privacy policy, and agree to be bound by both. IF YOU DO NOT AGREE WITH ANY PART OF THIS PRIVACY POLICY, PLEASE DO NOT ACCESS OR USE THE APP. IF YOU DO NOT WISH TO ACCEPT A FUTURE UPDATE TO THIS PRIVACY POLICY, PLEASE STOP USING THE APP AND DELETE YOUR ACCOUNT.
You can contact us anytime with queries about this privacy policy at info@totmedix.com.
Definitions #
"Profile" This includes personally identifiable information we collect when you create an account. This may include your name, email address, phone number, and your role (admin or village member).
"Child profile" This includes personal and health information about your child, added by you or another village member. This may include your child's name, date of birth, gender, height, weight, premature birth status, profile picture, allergies, and medical conditions.
"Village" The group of caregivers connected to a child's profile, invited to help manage that child's care.
"Village member" Any caregiver who has been invited to, and has joined, a child's village.
"Medication data" This includes all information related to a child's medications, including names, dosages, schedules, and the history of doses logged or missed. This may be entered manually, or added through AI-assisted scanning of a prescription image.
"Symptom log" This includes all content added to a child's symptom tracker. This may include the symptom name or type, severity, body location, duration, start time, temperature reading, notes, and photos. It also includes a record of who logged or edited each entry and when.
"Vaccination record" This includes a child's vaccination history, including which vaccines were administered, the date administered, and the name of the clinic and doctor who administered them, where provided.
"AI-assisted scanning" Refers to the process by which TotMediX reads a photo of a prescription that you upload and extracts the medication details from it, so you can add them to your child's profile without typing them out. The scan uses Microsoft Azure services. Most of this happens inside the UAE; one step is processed by Microsoft outside the UAE, using text from which identifying details have been removed. This is described in full in the "AI-assisted prescription scanning" section of this policy.
"Data Controller" The Data Controller is the entity that decides why and how personal data is used within TotMediX. For TotMediX, this is Nimah Prime Technologies.
"Data Subject" The Data Subject is the individual (parent, caregiver, or child) to whom personal data belongs. Data Subjects have rights over their data, including the right to access, correct, or delete it.
"Data Processor" A Data Processor stores or manages personal data on behalf of, and according to the instructions of, the Data Controller. TotMediX's Data Processors are listed in the "who we share your data with" section of this policy.
What is TotMediX? #
TotMediX is a pediatric health management app that helps parents and caregivers manage a child's health in one place. TotMediX is available as a mobile app on iOS and Android. There are two types of users on TotMediX: Admin and Village members. Below is a brief summary of what each type of user can do:
Admin: The admin is usually a parent who creates a child's profile and has full control over that child's health information. The admin can add and edit information related to a child's health, and can invite other caregivers to join the child's village.
Village members: Village members are caregivers invited by the admin to help manage a child's care, such as a co-parent, grandparent, or nanny. Depending on the permissions the admin grants, village members can view and add information related to a child's health.
Children: The child is the subject of the health information stored on TotMediX.
TotMediX is intended for use by parents and caregivers to manage a child's health information. Children do not create accounts or access the app independently; all information about a child is added and managed by their admin or village members, in accordance with applicable consent requirements.
Compliance with UAE's Personal Data Protection Law (PDPL) #
TotMediX is committed to protecting the privacy of parents, caregivers, and children who use our app. TotMediX complies with the UAE Personal Data Protection Law (PDPL), Federal Decree-Law No. 45 of 2021.
TotMediX, operated by Nimah Prime Technologies, acts as the data controller for personal data processed through the app. This means we are directly responsible for how your data, and your child's data, is collected, used, and protected. You can find detailed information on how we meet our obligations under the PDPL in this privacy policy.
Data collected by TotMediX #
Data collected through the app
TotMediX collects personal information directly from you, the parent or caregiver using the app. You, as the admin or a village member, decide what information to add to a child's profile, and you control it directly within the app. Below is a list of data we collect through the app and how we refer to it. These terms are also defined in full in the Definitions section above.
- Profile: your name, email address, phone number, and your role (admin or village member)
- Child profile: your child's name, date of birth, gender, height, weight, premature birth status, profile picture, allergies, and medical conditions
- Village and village member: the caregivers you invite to help manage a child's care
- Medication data: medication names, dosages, schedules, and dose history. This may be entered manually, or added through AI-assisted scanning of a prescription image
- Symptom log: symptom name or type, severity, body location, duration, start time, temperature reading, notes, and photos, along with a record of who logged or edited each entry
- Vaccination record: a child's vaccination history, including which vaccines were administered, the date administered, and the name of the clinic and doctor who administered them, where provided
- Log data: technical information such as your device type, operating system, general location at the country level, app crashes, an advertising identifier used only for analytics purposes (not for advertising), and how you use the app, collected through Firebase Analytics, Crash Analytics, and Performance Monitoring
Mobile application permissions
TotMediX may request access to your device's camera, photo gallery, and notifications. Camera and photo gallery access are used when you take or upload a photo of a prescription to be scanned, or when you add a profile picture for your child. If you do not grant these permissions, you will not be able to scan a prescription or add a profile picture, but you can still add medication information manually. Notification access is used to send you reminders for scheduled doses, and to notify you when another village member logs a dose. If you do not grant this permission, you can still add and schedule medications, but you will not receive reminders. TotMediX also uses standard Android system permissions to ensure reminders are delivered reliably, including after your device restarts.
Data collected through our website and waitlist form
When you sign up to join our beta through our website (totmedix.com), we collect personal information such as your name, email address, WhatsApp number, how you currently manage your child's health, and the type of phone you use. Our sign-up form is hosted on Google Forms; if you use it, your information is also subject to Google's own privacy practices.
Our website uses one analytics cookie, from Google Analytics, to help us understand how the site is used, for example which pages people visit and how they arrived. This cookie is only set if you accept it. When you first visit, you are asked to accept or decline; if you decline, no analytics cookie is placed and no analytics data about your visit is collected. You can change your mind by clearing your browser's cookies for totmedix.com and choosing again. We do not use any advertising or tracking cookies, and we do not use the Facebook pixel or any similar technology.
Data minimisation
TotMediX collects, uses, and retains personal information only as needed to provide, secure, and improve the app. We do not collect information for purposes unrelated to these activities.
Data Ownership #
TotMediX does not claim ownership over any personal information related to you or your child that is stored within the app. Nimah Prime Technologies acts as the Data Controller for this information, meaning we determine why and how it is used and are responsible for protecting it, but the information itself belongs to you.
As a Data Subject under the UAE Personal Data Protection Law, you retain rights over your personal data and your child's personal data, including the right to access, correct, and delete it, as outlined in the "your rights over your data" section of this policy.
Why do we collect this data? #
We use the data we collect only to provide the app to you as described in this privacy policy. This applies to data collected through the app as well as information you provide through our website or waitlist form.
Below are the ways we use the data, and the basis under which we process it.
Data collected through the app
| Purpose | Legal basis for processing |
|---|---|
| To provide access to TotMediX and its core features, including medication tracking, vaccination records, symptom logging, and village/caregiver access. | Processing is necessary to perform our agreement with you, as set out in our terms and conditions. |
| To create and manage your account and your child's profile. | Processing is necessary to perform our agreement with you. |
| To provide technical and customer support. | Processing is necessary to perform our agreement with you, or is based on your consent when you contact us. |
| To send you dose reminders, notifications, and other operational communications related to your use of the app. | Processing is necessary to perform our agreement with you. |
| To maintain the security of the app and protect against unauthorised access. | Processing is necessary to comply with our obligations under the UAE Personal Data Protection Law to secure personal data. |
| To read prescription images you choose to scan, and extract medication details from them, including processing part of that text outside the UAE. | Processing is based on your explicit consent, given before your first scan. |
| To engage third-party service providers (such as cloud hosting and AI-assisted scanning) that help us deliver the app's features. | Processing is necessary to perform our agreement with you, subject to contractual safeguards with these providers. |
| To analyse de-identified or aggregated usage data (such as through Firebase Analytics) to understand how the app is used and improve it. | Processing is based on your consent, given by agreeing to this privacy policy. |
| To detect, investigate, or report conduct that may violate our terms and conditions or applicable law. | Processing is necessary to comply with our legal obligations, or to establish, exercise, or defend legal claims. |
Data collected through our website and waitlist form
| Purpose | Legal basis for processing |
|---|---|
| To operate and maintain our website. | Processing is necessary to provide our website to you. |
| To respond to your beta sign-up and notify you when TotMediX becomes available or is updated. | Processing is based on your consent, given at the time you sign up. |
| To understand how our website is used, through Google Analytics. | Processing is based on your consent, given when you accept the analytics cookie. If you decline, we do not collect it. |
| To comply with applicable legal obligations, or respond to valid requests from courts or regulatory authorities. | Processing is necessary to comply with our legal obligations. |
If we ever want to use your information for a new purpose that is different from the one it was originally collected for, we will provide clear notice and obtain your permission before we do so.
Where do we store the data? #
Our data is hosted using Google Firebase and Microsoft Azure infrastructure. Different types of data are stored in different locations, as follows:
- Your account information, your child's profile details, medication records, symptom entries, and vaccination records are stored using Google Firebase, hosted in the Middle East (Dammam, Saudi Arabia).
- Photos and images, including prescription photos, your child's profile picture, and photos added to a symptom log, are stored using Google Firebase Storage, hosted in the United States (Iowa).
- Prescription scanning is carried out using Microsoft Azure services located in the UAE (Azure UAE North), with a single step processed by Microsoft outside the UAE. What that step is, and what is sent to it, is set out in the "AI-assisted prescription scanning" section below.
- The text extracted from your prescription is saved to your child's medication record in Firebase, alongside the medications themselves.
If we transfer personal information outside the region in which it was originally collected, we use appropriate safeguards, including contractual protections with our service providers, to protect your information in accordance with the UAE Personal Data Protection Law.
AI-assisted prescription scanning #
When you photograph a prescription, TotMediX reads it and suggests the medications it finds, so you can add them without typing each one out. Because a prescription is one of the most sensitive documents a family holds, we want to be specific about what happens to it.
The image #
Your photo is uploaded to our storage (Google Firebase Storage, United States) so that you and your child's village can see the original prescription later, alongside the medications taken from it. The image itself is never sent outside the UAE for scanning; it is read on Microsoft Azure servers located in the UAE.
Each image is stored at a private web address containing a long, randomly generated key. It is not listed, not searchable, and cannot be guessed, but it is not password-protected, so anyone who obtains that exact address can open the image. Inside TotMediX it is only ever shown to you and your child's village. We mention it because if that address is shared or forwarded outside the app, it will work for whoever receives it.
The text, and what leaves the UAE #
Reading the prescription and identifying the medicines both happen in the UAE. One step in between (reassembling a photographed page into readable order, which is difficult when it is shot at an angle or mixes Arabic and English) uses a Microsoft AI service that Microsoft may run from data centres outside the UAE.
Before anything reaches that step, we remove details identifying your child or your family: names, dates of birth, file and record numbers, contact numbers, and the doctor's and clinic's names. Only the remaining clinical text (medicine names, doses, and instructions) is sent. This removal is automatic and highly effective, though not guaranteed to be perfect; we keep what is sent abroad to the minimum and review it regularly.
Microsoft processes this text for us under contract. It is not used to train Microsoft's AI models, is not retained after processing, and is not used for any other purpose.
What we keep #
We save the extracted prescription text to your child's record: not only the medications you add, but the full text the scan produced, with identifying details removed as above. We keep it so you can check what the prescription actually said if a medication later looks wrong, and so we can investigate a scan that got something wrong.
It is stored in Firebase (Dammam) with your child's other health records, visible only to your child's village, and deleted when you delete the prescription, your child's profile, or your account, under the timeframes in the "data retention" section.
The scan does not give medical advice #
TotMediX records what your prescription says. It does not calculate doses, recommend medicines, check for interactions, or offer clinical judgement. Everything the scan finds is shown to you to review, correct, or discard before it is saved. If what the app shows does not match what your doctor told you, follow your doctor.
Your consent #
Because prescription information is sensitive health data, and because part of the scan is processed outside the UAE, we ask for your explicit agreement before your first scan, separately from the agreement you gave at account creation. You give it on your child's behalf, as their parent or guardian.
You can decline and still use TotMediX fully: every medication can be added manually, and nothing else depends on the scan. If you change your mind later, you can stop using it at any time and ask us to delete previously scanned prescriptions at info@totmedix.com.
What is the data NOT collected for? #
- We do not allow advertising or sharing data for advertising through the TotMediX app or website.
- We never display ads, share data for the purpose of displaying ads, or allow data collection by advertisers or data brokers through the app or website.
- We never sell data to anyone for any purpose.
- We never allow profiling of our users for targeted online ads.
- We do not use your health information for profiling, algorithmic decision-making, or any commercial purpose unrelated to providing the app's services. TotMediX helps you follow your doctor's instructions accurately; it does not provide medical advice, diagnosis, or clinical recommendations.
- We do not use your data, including prescription images or the text extracted from them, to train artificial intelligence models, and neither do our service providers.
- We do not collect precise geolocation or biometric identifiers.
How consent is managed #
Since TotMediX collects data directly from you rather than through an institution, consent works differently depending on who you are and how you interact with the app.
Your own consent
Everyone who uses TotMediX creates their own account, and is asked to review and agree to this privacy policy and our terms and conditions at that time. This applies whether you go on to create a child's profile as an admin, or later join a child's village as a village member using an invite code. Joining a village is a separate step from creating your account, but agreement to this privacy policy happens once, at account creation, and applies to your use of TotMediX regardless of which role you hold.
Separate consent for prescription scanning
Agreement at account creation covers your general use of TotMediX. Prescription scanning is treated separately: because it involves sensitive health data and processing outside the UAE, we ask for your explicit agreement the first time you use it, and we explain what is sent and where before you agree. Declining does not limit any other part of the app.
Consent on behalf of your child
Your child cannot consent to the collection of their own information. When you, as a parent or legal guardian, create a child's profile, you are confirming that you have the legal authority to do so and are giving consent on your child's behalf for TotMediX to collect and process their information, as described in this privacy policy. This includes the consent you give before your first prescription scan.
Legal basis for processing
Depending on the purpose, we process your information based on your consent, the necessity of processing to provide the app to you under our terms and conditions, or our legal obligations under the UAE Personal Data Protection Law, as set out in the "why do we collect this data" section above.
Withdrawing consent
You may withdraw your consent at any time by contacting info@totmedix.com, or by deleting your account through the app's settings. If you withdraw consent for information that is necessary for us to provide the app, we may no longer be able to provide some or all of TotMediX's features to you.
If you believe your information, or your child's information, has been added to TotMediX without appropriate consent, please contact us immediately.
Your rights over your data #
Under the UAE Personal Data Protection Law, you have certain rights over your personal data, and your child's personal data. These include the right to:
- Be informed about how your personal data is collected, used, and shared
- Access your personal data
- Correct or update inaccurate or incomplete personal data
- Request deletion of your personal data, subject to the retention periods described in this policy
- Restrict or limit the use of your personal data in some cases
- Object to certain types of data use
- Withdraw consent where data is processed based on consent
- Receive your data in a portable format, where applicable
- Appoint someone to act on your behalf, where permitted by law
Exercising these rights
Since TotMediX collects and processes your information directly, without an institution acting on your behalf, you can exercise any of these rights by contacting us directly at info@totmedix.com. Unlike platforms where requests must be routed through a school or employer, there is no intermediary here; we are the ones responsible for responding to you.
Exercising rights on behalf of your child
As a parent or legal guardian, you may exercise any of these rights on behalf of your child by contacting us in the same way. Since your child does not create their own account, requests relating to their information should come from you, as the parent or guardian who added their profile to TotMediX.
What happens if we decline a request
We respond to privacy requests within a reasonable time. If we decline a request because of a legal exception, we will explain why, and let you know how you can contest the decision. If you remain unsatisfied with our response, you have the right to lodge a complaint with the UAE Data Office.
If you have reason to believe your information, or your child's information, has been processed without an appropriate legal basis, please contact us immediately.
Data Retention #
TotMediX retains your information for as long as necessary to provide you the app and fulfil the purposes described in this privacy policy.
- If you delete your account, we retain your information for 30 days, after which it is permanently deleted, except where we are required to retain it for longer by law.
- If your subscription lapses and is not renewed, we retain your information for 12 months, giving you the chance to resubscribe without losing your child's health history. We will notify you before this period ends. After 12 months without renewal, your information is permanently deleted, except where required to retain it by law.
- Prescription images and the text extracted from them are kept with your child's medication records and follow the same timeframes. You can delete an individual prescription at any time, which removes both the image and its extracted text.
- We instruct our third-party service providers to delete any personal information they process on our behalf once it is no longer needed, in accordance with our agreements with them.
When does TotMediX share data with third parties? #
We use a few third-party services to operate and improve TotMediX. All of these services are contractually prohibited from using your information for any purpose other than providing services to us. Below is a list of our current third-party service providers:
| Service | Purpose | Data they may access | Location |
|---|---|---|---|
| Google Firebase | Account authentication, database, storage, app infrastructure, crash reporting, performance monitoring, app analytics, and push notifications | Profile, child profile, medication data, symptom log, vaccination record, log data | Saudi Arabia (database), United States (storage, functions, analytics, notifications) |
| Microsoft Azure (Document Intelligence, Language, OpenAI Service) | Reading prescription images and extracting medication details | Prescription images (UAE only); prescription text with identifying details removed | United Arab Emirates (Azure UAE North); one processing step may run in Microsoft data centres outside the UAE |
| RevenueCat | Subscription and payment management | Your account identifier and subscription status (not your payment card details, which are handled directly by the Apple App Store or Google Play Store) | United States |
| Google Analytics | Understanding how our website is used, only if you accept the analytics cookie | Website usage (pages visited, referring site, approximate location from IP, browser and device type) | United States |
| Google Forms | Hosting our beta sign-up form | Name, email address, WhatsApp number, and the answers you give on the form | United States |
| GoDaddy | Website hosting for totmedix.com | Website visitor information (such as IP address) | United States |
We commit to giving you the opportunity to opt out if we ever disclose your personal information to an independent third party outside this list, or if your information is to be used for a purpose materially different from what's described in this policy. If you wish to limit how your information is used or disclosed, please contact us at info@totmedix.com.
Business transfers
If TotMediX is involved in a sale, merger, bankruptcy, sale of assets, or reorganisation, we may disclose or transfer your information to the acquiring or successor entity. We will notify you if this happens. The acquiring entity will be required to comply with the terms of this privacy policy in relation to your information.
Legal disclosures
We will not disclose your personal information in response to law enforcement or other legal demands unless legally required to do so. Where feasible, we will notify you before any such disclosure, unless the law or a court order prohibits us from doing so.
Third-party analytics #
To improve your experience with TotMediX, we collect and analyse aggregate data about how you use the app, for example, which features you interact with, which buttons you tap, and how long you spend on a page. This helps us understand how TotMediX is used and improve it.
We use Google Firebase's built-in analytics, crash reporting, and performance monitoring tools to collect and analyse this data. These are contractually obligated to use this information only to provide these services to us, and are prohibited from sharing it or using it for other purposes. You can find details of this and our other third-party service providers in the "third-party service providers" section of this policy.
Signing in with Google or Apple #
TotMediX allows you to create an account and sign in using your Google or Apple account, in addition to signing in with an email and password. If you choose this option, we receive only the information needed to create or authenticate your account, such as your name and email address. We do not share your personal information back to Google or Apple, except as required to complete the sign-in process.
TotMediX's use of AI #
Artificial intelligence is used in TotMediX for one purpose only: reading a prescription you photograph and extracting the medication details from it, so you do not have to type them out. This is described in full in the "AI-assisted prescription scanning" section above, including what is processed where.
TotMediX does not use AI to give medical advice, calculate doses, recommend treatment, or make decisions about your child's care. Everything the scan produces is shown to you for review before it is saved, and you can change or discard any of it.
The above reflects our use of AI as of the date of this privacy policy. If this changes, we will update this section and notify you of any material changes.
Use of cookies #
On our website (totmedix.com) we use a single analytics cookie from Google Analytics, and only if you accept it when asked. If you decline, no cookie is set and no analytics data about your visit is collected. We use no advertising or tracking cookies, no Facebook pixel, and no similar technology.
In the app we do not use cookies or any tracking technology. App usage analytics are described in the "third-party analytics" section above.
If this changes in the future, we will update this section accordingly. We do not knowingly collect personal information from children under 13 without appropriate parental consent. In fact, children do not create accounts on TotMediX at all; all information about a child is added by their parent or guardian.
Viewing, editing, or accessing your information #
You can directly view and edit most of your own information, and your child's information, within the app. If you need help with something you cannot change directly in the app, or wish to request a copy of your information, you can contact us at info@totmedix.com and we will do our best to assist you promptly.
Data deletion requests #
If you would like to delete your account, or request deletion of any content you've added to TotMediX, you can do so directly in the app's settings, or by contacting us at info@totmedix.com.
As set out in the "data retention" section of this policy, we remove your information from our active systems within 30 days of account deletion, or within 12 months if your subscription lapses without renewal, except where we are required to retain it for longer by law.
Images (such as prescription photos and profile pictures) stored using Firebase Storage have a default soft-delete period of 7 days before permanent removal.
Data protection practices #
We are committed to protecting your information and apply industry-standard security measures, including:
- Encryption in transit and at rest, provided by default through our infrastructure providers
- Access controls that restrict who can view or edit information, based on your role and permissions within a child's village
- Removal of identifying details from prescription text before any part of it is processed outside the UAE
In the event of a security breach involving your personal information, we will notify you without undue delay, consistent with the UAE Personal Data Protection Law and our internal data breach response process. Where required by law, we will also notify the UAE Data Office.
Changes to this privacy policy #
We may update this privacy policy from time to time to reflect changes in our practices or applicable law. If we make a change that we believe materially affects your rights, we will notify you by email at least 30 days in advance. If you continue using TotMediX after such a change takes effect, we will treat that as your acceptance of the updated policy. If you'd like to see a previous version of this policy, you can contact us at info@totmedix.com.
Contact information #
If you have any questions about this privacy policy, please contact us at info@totmedix.com and we will respond as soon as possible.