Effective date 28 September 2026
This Privacy Policy explains how Parkiva OÜ collects, uses, stores and shares personal data when you use the Parkinson’s Daily Diary App and its related web services. The app allows adults with Parkinson’s disease and their invited caregivers to record symptoms, medication response, ON and OFF periods, notes and other information for personal tracking and healthcare discussions.
The app is a record-keeping and communication tool. It does not provide medical advice, diagnosis, treatment recommendations or emergency monitoring.
1 Who is responsible for your data
Parkiva OÜ is the data controller responsible for the processing described in this policy.
Company: Parkiva OÜ
Registry code: 17602980
Registered address: Rävala pst 7-29, 10143 Tallinn, Estonia
Privacy contact: contact@parkinsondailydiary.com
2 Who may use the app
The app is intended only for people aged 18 or older. It is not intended for children. If we learn that personal data has been provided by a person under 18, we will take reasonable steps to delete it.
3 Personal data we collect
Account and contact information
- Name, email address and account identifiers
- Account role, such as patient or caregiver
- Verification, password-reset and reminder-email information
Diary and health-related information
- Movement and non-movement symptom ratings
- Medication timing, medication status, response and reported side effects
- ON and OFF periods, pain, fatigue and daily activity information
- Free-text notes, appointment notes and questions for healthcare professionals
- Dates and times associated with diary entries
This information may reveal health information and is therefore treated as sensitive personal data under applicable data-protection law.
Caregiver information
- Caregiver name, email address, invitation status and connection to a patient account
- Permissions and diary information viewed or entered through an authorised caregiver connection
Technical, support and security information
- Security, audit and access records needed to protect accounts and investigate misuse
- Information you provide when requesting support
- Email delivery information, such as recipient address, subject and delivery status
We do not use the app for advertising, behavioural profiling or research. We do not sell personal data.
4 How we use personal data and our legal bases
Providing the app
We use account information to create and maintain your account, authenticate access, provide app features, generate reports and respond to support requests. This processing is necessary to provide the service you request and perform our agreement with you.
Processing health-related information
We process diary and health-related information only to provide the tracking, charting, reporting and caregiver-sharing functions you choose to use. We rely on your explicit consent to process this special-category data. You may withdraw that consent by deleting your account or contacting us, but withdrawal does not affect processing that was lawful before withdrawal. If processing this information is necessary to provide a feature, withdrawing consent may mean that the feature or account can no longer be used.
Caregiver access
A caregiver receives access only after being invited or authorised through the app. The patient can review connected caregivers and remove access. Patients should invite only people they trust. Caregivers must use information only to assist the person who authorised them.
Messages and reminders
We use your email address to send account verification, password-reset, security and user-requested reminder messages. Optional reminders can be managed through the available app settings. We do not automatically add app users to the Parkinson’s Viewpoint newsletter. Newsletter subscriptions are separate and voluntary.
Security and legal responsibilities
We may process limited account, audit and access information to secure the app, prevent misuse, investigate incidents, establish or defend legal claims and comply with applicable law. We rely on our legitimate interests in operating a secure service or, where applicable, a legal obligation. We balance these interests against users’ rights and limit this processing to what is reasonably necessary.
5 AI and automated decision-making
The AI Insights feature is disabled, and its dashboard entry points have been removed. No production user data is currently sent to Google Gemini. We do not use personal data for automated decisions, profiling or AI training, and the app does not make decisions that produce legal or similarly significant effects.
If an AI feature is introduced in the future, we will assess the data-protection implications and update this policy before enabling it for users. Where required, we will also request an appropriate choice or consent.
6 Service providers and recipients
We use carefully selected service providers to operate the app. They process data on our instructions under contractual data-protection terms.
- Google Firebase, Firestore and Cloud Functions provide authentication, database and backend infrastructure.
- Vercel hosts and serves the app’s web files. Patient diary data is not stored by Vercel as part of its hosting role.
- Twilio SendGrid delivers verification, password-reset and reminder emails and therefore receives the recipient email address and relevant email content.
Authorised Parkiva OÜ personnel or contractors may access data only when reasonably necessary for support, maintenance, security or legal compliance. We may also disclose information when required by law or to protect the rights and safety of users or others. We do not share health information with healthcare professionals automatically. Users decide whether to download or share their reports.
7 International data transfers and storage locations
Production data is stored in the default Firestore database for the project parkinson-daily-diary in Google’s nam5 United States multi-region, principally Iowa and South Carolina. Cloud Functions and the email extension operate in us-central1 in Iowa. Vercel and Twilio SendGrid are also United States-based providers.
Where personal data is transferred from the European Economic Area or the United Kingdom to the United States, transfers are supported as applicable by the EU Standard Contractual Clauses, the UK Addendum, participation in the EU-US Data Privacy Framework and UK Extension, and approved Binding Corporate Rules. Additional technical and organisational measures are applied where appropriate.
8 How long we keep personal data
Account and diary information is kept while your account remains active or until it is no longer needed to provide the service. You may delete your account through the app or request deletion by contacting us.
When an account is deleted, the account profile, diary entries, caregiver links, permissions, insights, alerts and notifications are deleted. Obsolete testing records containing personal information are also deleted.
Limited security, audit, access and email-delivery records may be retained only for the period reasonably necessary to protect the service, investigate incidents, demonstrate accountability, resolve disputes or comply with legal obligations. Identifying information is removed or anonymised when it is no longer needed, and these records are subject to defined deletion or review controls. We do not retain deleted users’ information indefinitely without a documented purpose.
The production system currently has no point-in-time recovery, scheduled backup or manual backup copies outside the live database. If backup arrangements change, deletion from backups may occur on a separate secure rotation schedule, which will be described in an updated policy.
9 Your data-protection rights
Depending on applicable law, you may have the right to:
- request access to your personal data and information about how it is used
- request correction of inaccurate or incomplete data
- request deletion of your personal data
- request restriction of processing in certain circumstances
- object to processing based on legitimate interests
- withdraw consent at any time where processing relies on consent
- receive data you provided in a structured, commonly used and machine-readable format where the right to data portability applies
- lodge a complaint with a data-protection supervisory authority
To exercise a right, contact contact@parkinsondailydiary.com. We may ask for information needed to verify your identity. We normally respond within one month, although the period may be extended where permitted by law for complex or numerous requests.
The app’s PDF report is designed for personal review and healthcare discussions. If you require a broader machine-readable copy for a data-portability request, contact us and we will provide the data covered by that right in an appropriate format.
10 Account deletion
Deleting an account is permanent. Users should download any reports they want to keep before deletion. Account deletion also removes connected caregiver relationships and access permissions. A caregiver’s separate account is not necessarily deleted when a patient removes the caregiver connection, and either user may request deletion of their own account.
11 Security
We use technical and organisational measures designed to protect personal data, including role-based access, authentication controls, restricted administrative access, service-provider security controls and monitoring of relevant access or security events. No online service can guarantee absolute security. Users should protect their login details, use a secure device and notify us promptly if they believe their account has been accessed without permission.
12 Medical and emergency limitations
The app is not monitored by healthcare professionals or emergency services. Information entered into the app is not reviewed in real time. Do not use the app to request urgent medical help. In an emergency, contact the appropriate local emergency service immediately.
13 Complaints
You may contact us first so that we can try to address your concern. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority in the country where you live or work.
Estonian Data Protection Inspectorate: www.aki.ee
14 Changes to this policy
We may update this Privacy Policy when the app, its service providers or legal requirements change. We will publish the updated version with a new effective date. If a change materially affects how we process sensitive data or relies on consent, we will provide an appropriate notice and request consent where required.
15 Contact us
For privacy questions, rights requests or concerns about the handling of personal data, contact:
Parkiva OÜ
Registry code 17602980
Rävala pst 7-29, 10143 Tallinn, Estonia
contact@parkinsondailydiary.com