Effective Date: October 14, 2026
Last Revised: October 14, 2026
\This English translation is provided for convenience only. In the event of any discrepancy or conflict between the Korean version and this English translation, the Korean version shall prevail.
Itda (hereinafter referred to as the "Company") is a business operator that provides services to users worldwide. The Company complies with applicable privacy and data protection laws of each country and region, and processes users' personal information safely and securely.
The Company collects and uses only the minimum personal information necessary to provide the Service. Sensitive information is processed only to the minimum extent required under applicable laws. Additional personal information required for specific service features is collected and used only during the use of the relevant service, in accordance with this Policy.
| Collected Items | Purpose of Use | Retention Period |
|---|---|---|
| Name (nickname), profile information (profile image, etc.) | User identification and account management | Destroyed immediately upon account deletion |
| Email address (based on Apple/Google/Kakao accounts or verified email address for email sign-up) | Simple login (SSO) authentication and user identification, important notices | Destroyed immediately upon account deletion |
| Social identifiers (UID of each SSO provider, etc.) | Login authentication, account linking | Destroyed immediately upon account deletion |
(Important Notice Regarding Passwords)
Additional Notices
| Collected Items | Purpose of Use | Retention Period |
|---|---|---|
| IP address, device model/type, OS version, app version, browser type (if applicable), access date and time, usage records, error/diagnostic data, security-related logs, push tokens (FCM/APNs), advertising identifiers (if applicable) | Service quality improvement, security maintenance, prevention of fraudulent use, incident response, statistical analysis, development of new features, delivery of personalized content | Destroyed without delay upon account deletion or when the purpose of processing has been achieved. However, if retention is required under applicable laws, the information is retained for the required period and then destroyed. |
Additional Notice Regarding Push Tokens
| Collected Items | Purpose of Use | Retention Period |
|---|---|---|
| Medication name, dosing schedule, medication type, dosage, stock quantity, medication history (intake/missed records, etc.) | Generation of personalized medication reminders, medication history management, inventory management | Destroyed without delay upon termination of service use (account deletion) or when the user deletes the data |
| (If the user uses Exam Prep) Exam type, exam date and time, the exam name the user entered, preparation steps (diet, fasting, medications and other tasks with their times) | Exam preparation reminders, and continuing on a new device or after reinstalling or signing in again | Destroyed without delay when the user deletes it or deletes the account. Automatically deleted one year after the exam date |
| Collected Items | Purpose of Use | Retention Period |
|---|---|---|
| Family group ID, roles among members, family connection status, medication status sharing settings among family members, profile names (display names) of connected family members | Sharing medication status among family members and sending notifications | Destroyed without delay upon account deletion or upon disconnection/group withdrawal |
| (If the user allows Proxy Care) Permission status (the family member who asked, and when it was requested, allowed, declined or turned off) | Letting only family members the user has allowed add, change and delete the user's medications | Destroyed without delay when the user turns permission off, disconnects, or deletes the account. A decline record is kept for 7 days so the same request is not received again during that period, then destroyed |
| (If the user allows Proxy Care) Change records (the family member who made the change, time, medication, previous and new values of the changed items, whether the change was applied or undone) | Notifying the user of changes, applying them on the user's device, and undoing them | Automatically deleted 90 days after the record is created. Destroyed without delay if the medication owner deletes the account |
Important Notice Regarding Sensitive Information
| Collected Items | Purpose of Use | Retention Period |
|---|---|---|
| Prescription photos (optionally provided by the user), text extracted from images (OCR results) | Prescription recognition and input convenience | Not stored on the Company's servers; destroyed without delay once recognition is complete |
| (If the user consents to AI recognition) Prescription photo (a copy with location and other capture data removed), recognized text, medicine names | Prescription recognition using AI (Google Gemini), classifying medicine names into health topics | Not stored on the Company's servers. Under the paid API terms, the processor (Google) does not use this data to improve its products; it keeps logs for 55 days to detect policy violations and then deletes them (authorized Google employees may review content flagged by its abuse detection systems) |
| AI recognition usage records (daily usage count, version of the consent, time of last use) | Abuse prevention, consent verification | Automatically deleted one year after the last use |
| (If the user consents to AI recognition) Recognized medicine names | Confirming official names via the Ministry of Food and Drug Safety public drug API (e-Yakeun) | Only the name is sent and who looked it up is not recorded. Lookup results (per medicine name) are kept on the Company's server for up to 90 days |
Notice Regarding Processing Methods
| Collected Items | Purpose of Use | Retention Period |
|---|---|---|
| Subscription status, payment receipt identifiers (receipt numbers, etc.), purchase/expiration/renewal status | Activation of premium features (Pro) and subscription status verification, payment-related customer support | Retained for the period required under applicable laws and then destroyed (e.g., laws relating to electronic commerce) |
Notice Regarding Payment Method Information
The Company may collect and use the following information when a user makes an inquiry, report, or customer support request:
The Company uses the collected personal information for the following purposes:
The Company may entrust certain tasks to external specialized service providers to ensure smooth service provision, and personal information may be transferred to regions outside the user's country of residence due to the nature of the Service. The Company manages and supervises the processors to ensure they process personal information safely in accordance with applicable laws.
| Company Name | Location | Information Processed | Purpose |
|---|---|---|---|
| Google LLC (Google Analytics) | United States, etc. | Service usage records, device information | Usage statistics analysis and service improvement |
| Google LLC (Firebase) | United States, etc. | Account identification information, service data, device information, push tokens | Data storage, authentication, server operations, push notification delivery |
| RevenueCat, Inc. | United States, etc. | Subscription status, receipt identifiers, social identifiers (to the extent necessary) | Paid subscription status management and payment verification |
| Google LLC (AdMob, etc.) (if applicable) | United States, etc. | Advertising identifiers, device information | Ad delivery and performance measurement |
| Google LLC (Gemini API) (when AI recognition is used) | United States | Prescription photo (copy with capture data removed), recognized text, medicine names | Prescription recognition using AI, classifying medicine names into health topics |
※ Advertising identifiers can be reset or restricted through the user's device settings. (iOS: App Tracking Transparency/Privacy Settings, Android: Advertising ID Settings)
Cross-border transfer details — AI recognition (Article 28-8 of the Korean Personal Information Protection Act)
Users may request access, correction, deletion, suspension of processing, withdrawal of consent, and other actions regarding their personal information in accordance with applicable laws.