Privacy Policy

1. Who we are

VaxFile is a vaccination record app by Little Handy Apps. The controller responsible for your data is:

Email: support@vaxfile.app

2. What data we process

Account data: your email address and password (stored only as a secure hash).

Family profiles: the name, date of birth, sex, country and optional photo of each person you add.

Vaccination records: vaccine, date, dose, who administered it, and your notes. Vaccination records are health data, a special category of personal data under the GDPR.

Scanned documents (optional, Premium): photos of vaccination documents you choose to scan.

Usage statistics (optional): only if you opt in. Which features you use and how often you open the app, linked to your account ID but not to your email address, plus technical device information. No vaccination data, no IP address and no location.

Purchases: if you buy Premium, your account ID and purchase details.

On your device only: vaccination reminders, calendar entries and PDF exports are created on your device. We don't receive them.

3. Why we process it, and on what legal basis

• To create and run your account: performance of our contract with you (Art. 6(1)(b) GDPR).
• To store and show vaccination records and schedules: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you give when signing up.
• To read scanned documents: your explicit consent, each time you choose to scan.
• To improve the app with usage statistics: your consent (Art. 6(1)(a) GDPR), only if you opt in.
• To process purchases: performance of our contract with you.

We never use your data for advertising and never sell it.

4. Service providers

We only share data with providers needed to run VaxFile, under data processing agreements:

• Supabase stores your account, family profiles and vaccination records on servers in Frankfurt, Germany.
• OpenAI (United States) reads scanned photos and returns the vaccination data. OpenAI does not use them for training and keeps them for at most 30 days for abuse monitoring.
• PostHog (EU cloud) processes usage statistics, only if you opt in.
• RevenueCat (United States) manages Premium purchases. It receives your account ID and purchase details, but no vaccination data.
• Apple and Google process in-app purchases through the App Store and Google Play.

5. Transfers outside the EU

OpenAI and RevenueCat are based in the United States. These transfers rely on the EU-U.S. Data Privacy Framework, with EU standard contractual clauses as a fallback.

6. Storage and security

Your account, profiles and vaccination records are stored in the EU (Frankfurt), encrypted in transit and at rest. Row-level security ensures no other user can access your records. Profile photos are stored in a private storage area accessible only to your account.

7. How long we keep data

• Account, profiles and vaccination records: as long as your account exists. When you delete your account, we delete this data within 30 days.
• Scanned photos: not stored by VaxFile. OpenAI keeps them for at most 30 days.
• Usage statistics: kept by PostHog for up to 1 year, and deleted when you delete your account. Turning statistics off stops new collection.
• Purchase records: as long as required by tax and accounting law.

8. Your rights

Wherever you live, you have the right to:

• access the data we hold about you
• correct inaccurate data
• have your data deleted
• restrict or object to processing
• receive your data in a portable format
• withdraw your consent at any time, without affecting processing that took place before. Turn off usage statistics in Settings. Withdrawing consent for your vaccination records means deleting your account, since VaxFile can't work without them.
• lodge a complaint with a data protection supervisory authority, for example in the country where you live. Our supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit). In Switzerland, you can contact the Federal Data Protection and Information Commissioner (FDPIC).

To exercise your rights, email support@vaxfile.app. We respond within one month.

9. Is providing data required?

No law requires you to provide data. To use VaxFile you need an account and to consent to us storing your vaccination records. Scanning and usage statistics are optional.

10. Automated decision-making

We don't make decisions about you based solely on automated processing. The AI scanning only suggests records, which you review before saving.

11. Children's data

VaxFile is for parents and carers. All data about children is entered by the parent or carer who holds the account. We don't knowingly collect data directly from children.

12. This website

vaxfile.app is hosted by Netlify, which processes your IP address in server logs to deliver the site. The website uses no analytics or cookies.

13. Changes and contact

We'll tell you about significant changes in the app. The current version is always at vaxfile.app/privacy. Questions? Email support@vaxfile.app.

14. Additional information for users in Australia and Mexico

Australia

If you live in Australia, we handle your personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Vaccination records are health information, which is sensitive information under that Act. We only collect it with your consent.

Overseas disclosure: your data is stored and processed outside Australia: in Germany (Supabase, Frankfurt; PostHog EU cloud if you opt in) and in the United States (OpenAI for scanning, RevenueCat for purchases). Data processing agreements require these providers to protect your information.

Access and correction: you can view and correct most of your data in the app. For anything else, email support@vaxfile.app. We respond within 30 days.

Complaints: email support@vaxfile.app and describe your concern. We respond to complaints within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Data breaches: if a data breach is likely to cause you serious harm, we'll notify you and the OAIC as required by the Notifiable Data Breaches scheme.

Mexico

If you live in Mexico, the Spanish version of this policy contains the full privacy notice (aviso de privacidad integral) required by Mexico's Federal Law on the Protection of Personal Data Held by Private Parties. Read it in Spanish.