Legal
Privacy Policy — Coagly
Last updated 2026-08-20
Coagly helps people taking warfarin record their doses and their INR results, and reminds them to take a dose and attend a blood test. This policy explains exactly what the app stores, where it goes, and what you can do about it.
We have tried to write this in plain language, because the people using this app are patients, not lawyers.
In one paragraph: the app stores your doses, INR results and appointments so it can show them back to you and remind you. It does not sell your data, does not show advertising, and does not send your medical information to analytics. Analytics is off unless you switch it on. You can export everything as a spreadsheet at any time, free, and you can delete your account and all of it from inside the app.
1. Who is responsible for your data
Coagly is published by Juan Antonio Veloz Gutiérrez, an independent developer trading as VELOZ.
For questions about this policy or your data: privacy@veloz.dev
Under the UK/EU GDPR we are the data controller for the information described below.
2. What the app stores
2.1Health information you enter
This is the heart of the app, and it is what the GDPR calls special category data. We store it because the app cannot do its job without it.
| What | Details |
|---|---|
| INR results | The value, the date it was measured, and any note you add |
| Doses | The amount in mg, the day it was for, whether it was taken, when you marked it, and any note |
| Your medication | Which anticoagulant, a name you type if you choose "other", your daily dose or your per-weekday schedule, and the dates you started and stopped it |
| Appointments | The date and time of your next INR test, and optionally a location and a note |
| Your settings | Your target INR range, your reminder time, your time zone, and — only if you enter them for the INR calculator — your laboratory's mean normal prothrombin time and ISI value |
Notes are free-text boxes. Whatever you type into them is stored as you typed it, so please treat them the way you would treat anything written in a paper diary.
2.2Your account
By default the app creates an anonymous account. It holds no name, no email address and no phone number — just a random identifier that links your records to your device. You can use the whole app this way.
If you choose to add an email address and password (so you can get your history back on a new phone), we store your email address and an encrypted form of your password. We never see or store your password itself.
2.3Purchases
If you buy a subscription or the lifetime option, the purchase is handled by Apple or Google, and by RevenueCat, which tells the app whether your purchase is active.
We never see your card number, billing address or any payment details. Those go to Apple or Google and never reach us or the app.
2.4Usage analytics — off unless you turn it on
The app can send anonymous usage statistics through Google Firebase Analytics, to tell us which parts of the app people actually use.
This is switched off when you install the app. It stays off until you turn it on in Settings → Privacy, and you can turn it back off at any time. When you turn it off we also ask Google to delete the analytics identifiers it created.
When it is on, it records that something happened — never what it was:
- We record: "an INR result was saved", "the reminder was switched on", "the insights screen was opened", which step of the setup you reached.
- We never record: your INR values, your doses, your notes, whether a reading was in range, or anything else about your health.
That is a deliberate rule enforced in the app's code, not a promise about intent. Your medical information is never sent to analytics.
2.5Advertising — none
Coagly shows no advertising and contains no advertising networks. We do not sell, rent or share your information with data brokers or advertisers.
On iOS, Apple requires apps to ask before using the device's advertising identifier. If you are asked and you say no — or if you never answer — no advertising identifier is used. We only ever use it, if you allow it, to understand which app installs came from where. It is never connected to your health information.
2.6Reminders
Your daily dose reminder and your appointment reminders are created on your own phone. The reminder text, including the dose amount, is put together on the device and does not travel over the internet.
We also use OneSignal to send occasional service messages. OneSignal receives a notification identifier for your device, and your country and language. It never receives your health information.
3. Where your data is stored
Your records are stored in a Supabase database (hosted on Amazon Web Services) in the United States.
Every table is protected by row-level security, which means the database itself refuses to return one person's records to anyone else, regardless of what the app asks for.
If you are in the UK or the EU, this transfer relies on the standard contractual clauses operated by our hosting providers.
4. Why we are allowed to store it (legal bases)
Under GDPR we rely on:
- Your explicit consent (Art. 9(2)(a)) for your health information. You give it by entering your data into the app, and you can withdraw it by deleting your account, which erases the data.
- Performance of a contract (Art. 6(1)(b)) for your account and your purchases.
- Your consent (Art. 6(1)(a)) for analytics — which is why it is off by default.
5. Who we share it with
We do not sell your data. We do not share it with advertisers. We do not share your health information with anyone for their own purposes.
We use these service providers, who process data only on our instructions:
| Provider | What they handle |
|---|---|
| Supabase (hosting) | Stores your records and your account |
| Google Firebase | Anonymous usage analytics — only if you turned it on, and never health data |
| RevenueCat | Whether your purchase is active |
| Apple / Google | Payment, if you buy something |
| OneSignal | Push notifications |
We will disclose information if the law requires it — for example a valid court order. If that ever happens we will tell you unless we are legally prevented.
6. How long we keep it
Your records are kept until you delete them. There is no automatic expiry, because a warfarin history is worth more the longer it runs — many clinics want to see months of it.
When you delete your account, your doses, INR results, medication, appointments and settings are deleted from our database, and your scheduled reminders are cancelled. This is immediate and cannot be undone: we hold no backup copy that we could restore for you afterwards.
7. Your rights
You can exercise the two that matter most without contacting anyone, from inside the app:
- Get a copy of your data (Art. 20). Settings → Data → Export sends your doses and INR results out as a CSV spreadsheet you can open, email or hand to your clinic. Export is free on every plan, covers your entire history, and is never restricted — it is your medical record, and we do not think anyone should have to pay to get it out.
- Delete everything (Art. 17). Settings → Your account → Delete my account and data.
You also have the right to correct your data (you can edit any dose or INR result in the app), to object to or restrict processing, to withdraw consent at any time, and to complain to your national data protection authority.
For anything not covered by the in-app options, email privacy@veloz.dev. We aim to reply within 30 days.
8. Security
- Everything travels over encrypted connections (HTTPS/TLS).
- Row-level security in the database restricts every record to its owner.
- Passwords are stored hashed; we cannot read them.
- The app can be used entirely anonymously, so you need not give us an email address at all.
No system is perfectly secure. If a breach ever affects your data we will notify you and the relevant regulator as the law requires.
9. Children
Coagly is not directed at children under 16. Anticoagulant therapy in children is managed by a specialist clinic, and this app is not a substitute for that. If you believe a child has given us data, email us and we will delete it.
10. This app is not medical advice
Coagly is a record-keeping and reminder tool. It does not diagnose, does not prescribe, and does not replace your anticoagulation clinic. Always follow the dose your clinician gives you, and contact them — not this app — if your INR is out of range or you feel unwell.
If you think you are having a medical emergency, call your local emergency number immediately.
11. Changes to this policy
If we change this policy we will update the date at the top. If a change materially affects how your health information is handled, we will tell you in the app before it takes effect.
12. Contact
Juan Antonio Veloz Gutiérrez
Email: privacy@veloz.dev