Privacy Policy

Last updated: May 2026

Zareva is a medication reminder and wellness companion published by BDKM LLC, a Washington limited liability company ("BDKM," "we," "us," or "our"). We built Zareva with privacy at its core. This policy explains what data we collect, why, how it's protected, and the choices you have. We wrote it to be clear and readable — no legalese tricks.

Important: Zareva is NOT a covered entity under the Health Insurance Portability and Accountability Act (HIPAA), and information you store in Zareva does not receive HIPAA protections. We voluntarily apply HIPAA-aligned security practices (AES-256 encryption at rest, TLS 1.3+ in transit, access controls, minimum data collection) but you should not assume HIPAA rights apply to your use of the app.

1. What We Collect

Zareva collects only the minimum data needed to provide medication reminders and wellness tracking:

We do not collect your real name, physical address, or phone number (unless you voluntarily provide a phone number for caregiver escalation). We do not collect anything beyond what you explicitly enter into the app.

2. How We Use Your Data

3. What We Never Do

We will never sell, rent, or trade your health data to anyone — period.

4. Third-Party Services

Zareva uses a small number of carefully selected third-party services:

Supabase (database & authentication) — Stores your account and wellness data with encryption at rest (AES-256) and in transit (TLS 1.3+). Row-level security policies ensure that only you (and caregivers you explicitly authorize) can access your data.

Firebase Cloud Messaging (notifications) — Delivers push notifications to your device. Only an opaque device token is shared with Google. No health data, medication names, or personal information is included in push notification payloads.

Firebase Crashlytics (crash diagnostics, opt-in) — Reports app crash stack traces and device/OS information so we can identify and fix stability issues. Disabled by default. Only active if you grant the Analytics consent in Settings → Privacy & Data. Every crash report is passed through a client-side redactor that strips emails, quoted free-text, URL query strings, and JSON bodies before sending — so medication names, dosages, notes, and wellness data never reach Crashlytics. No user identifier is ever attached. Collection toggles off immediately when you revoke consent.

OpenFDA (drug information) — When you check drug interactions, medication names are sent to the U.S. FDA's public API. No user identifiers, device information, or account data is included in these requests.

Affiliate links (GoodRx, EzRx, Amazon) — When you choose to visit an external savings service, your medication name may be visible to that service in the URL. You are always notified and asked for confirmation before leaving the app. Zareva may earn affiliate commissions from these services at no additional cost to you. These commissions are disclosed in-app.

5. Data Sharing

Your data is shared only in these specific circumstances:

We never share data with advertisers, data brokers, or any party for marketing purposes.

6. Data Security

We take the security of your data seriously:

7. Data Retention & Deletion

You can delete your account at any time from Settings → Account → Delete Account. Upon deletion:

You may also request data deletion by emailing privacy@zareva.app. We will process your request within 45 days.

For instructions on deleting your account, see our account deletion page.

8. Your Choices

You control your data through separate consent categories in Settings → Privacy & Data:

You can change these choices at any time. Withdrawing consent does not affect the lawfulness of processing performed before withdrawal.

9. Age Requirement & Children's Privacy

Zareva is intended for users who are at least 18 years of age. We do not knowingly collect personal information from individuals under 18. If you are managing medications for a minor (such as a child or dependent), you must have legal authority to do so as a parent, legal guardian, or authorized caregiver — and the account must be in your name, not the minor's.

If you believe a child has provided us with personal information, please contact us immediately at privacy@zareva.app and we will delete the account and data promptly.

10. International Data Transfers

Your data may be processed in the United States where our servers are located. By using Zareva, you consent to the transfer and processing of your data in the United States. We ensure that appropriate safeguards are in place to protect your data regardless of where it is processed.

11. Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will notify you through the app before the changes take effect. Continued use of Zareva after changes constitutes acceptance of the updated policy. The "Last updated" date at the top of this page indicates when this policy was last revised.

12. Contact Us

For privacy questions, concerns, or data deletion requests:

Email: privacy@zareva.app
Publisher: BDKM LLC
Governing law: State of Washington, United States

This app is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. Always consult your doctor or pharmacist for medical advice.