Privacy Policy

Reference translation. The Korean version of this document is the
authoritative text. If the two differ in meaning, the Korean version prevails.

Pilltree ("the Company") establishes and discloses this Privacy Policy pursuant
to Article 30 of the Personal Information Protection Act of the Republic of
Korea, in order to protect users' personal data and to handle related complaints
promptly.

Pilltree is not a medical device. It is an everyday tool that helps you
record a medication schedule and share it with family. It does not replace
diagnosis, prescription, or treatment.

---

Article 1 (Purposes of Processing)

The Company processes personal data for the purposes below. It does not use the
data for any other purpose, and obtains separate consent if a purpose changes.

Article 2 (Categories of Personal Data Processed)

The Company does not process the following:

• Date of birth — only the year of birth.
• Height and weight
• Home address, phone number, resident registration number
• Location data
• Full access to your contacts or photo library

Article 3 (Processing of Sensitive Data)

Medication names and check-in records constitute health-related information
("sensitive data") under the Personal Information Protection Act. The Company
processes them only with separate consent, and manages them apart from other
personal data. See "Consent to Processing of Health Data" for details.

Article 4 (Retention Periods)

Where a statute requires longer retention, the data is kept for that period.

Article 5 (Provision to Third Parties)

The Company does not provide personal data to third parties, except:

1. Where the user has given prior consent
2. Where an investigative authority requests it through lawful procedure

Sharing within a family is not third-party provision. Check-in status is
visible only within a relationship that the user created by invitation and the
other person accepted, and either side can end the connection at any time.

Article 6 (Outsourcing of Processing)

The Company specifies the safeguards required for the safe handling of personal
data in each outsourcing contract, and supervises compliance.

Article 7 (Overseas Transfer)

Some processing is outsourced to providers outside Korea, so personal data is
transferred overseas. See "Consent to Overseas Transfer of Personal Data" for
details.

**Medication names and check-in records are stored on servers in the Republic of
Korea (Seoul) and are not transferred overseas.** Medication names never appear
in notification text, and error records contain no medication name, condition,
or free text that you have entered.

You may refuse the overseas transfer. However, notifications must pass through
Google's notification servers, so refusing means we cannot remind you at the
scheduled time.

Article 8 (Destruction Procedure and Method)

1. Procedure — Personal data is destroyed without delay once the retention

period expires or the purpose of processing is achieved. Deleting your account
in the app starts that process immediately.

1. Method — Data held in electronic files is permanently erased by a method

that makes recovery impossible; data printed on paper is shredded or
incinerated.

Article 9 (Rights of Data Subjects and How to Exercise Them)

You may exercise the following rights at any time:

1. Request access to your personal data
2. Request correction of errors
3. Request deletion
4. Request suspension of processing

How to exercise them:

• In the app — [Settings] → [Delete account] removes your account and records.
• On the web — Request deletion at https://pilltree.app/delete-account.
• By email — Write to support@pilltree.app; we act within 10 days.

Article 10 (Personal Data of Children under 14)

Pilltree is not directed at children under the age of 14 and does not
knowingly collect their personal data.

Article 11 (Measures to Ensure Security)

1. Access control — Row-level security policies in the database mean each

user can read and write only their own records and those of the people they
care for.

1. Encryption in transit — All communication between the app and the server

is encrypted with HTTPS.

1. Minimal collection — Items not needed for the service are never collected

in the first place (Article 2).

1. Minimal logging — Error and usage records contain no medication name,

condition, or free text that you have entered. They are filtered once more
immediately before being sent, and an automated test verifies that the
filtering works on every build.

1. Access privilege management — The number of staff who may handle personal

data is kept to a minimum, and grants, changes, and revocations are logged.

Article 12 (Automatic Collection Devices and How to Refuse Them)

The Pilltree app does not use cookies. The website (pilltree.app) uses no
advertising or analytics cookies either.

The app stores the following on your device. They are removed when you delete
the app:

• Your sign-in session
• Your text size setting
• Your push notification token

Article 13 (Advertising)

Pilltree carries no advertising on any screen. It does not collect
advertising identifiers and does not track you for targeted advertising.

Article 14 (Data Protection Officer)

The Company designates the following officer as responsible for personal data
processing and for handling complaints and remedies:

Article 15 (Remedies for Infringement of Rights)

To seek redress for infringement of your personal data rights, you may contact:

Article 16 (Changes to This Policy)

This Privacy Policy takes effect on 1 September 2026.

Where content is added, removed, or amended, we will give notice in the app and
on the website from 7 days before the change takes effect. Where a change
materially affects users' rights, we will give at least 30 days' notice.