Privacy Policy - TravelHealth Planner

Effective date: August 25, 2026 Last updated: August 25, 2026

1. Who we are

TravelHealth Planner ("we", "us", "the Service") is operated by Badexy Technologies, LLC ("the Company"), located at 5726 Lake Cyrus Blvd, Hoover, AL 35244, U.S.A.

This policy covers the TravelHealth Planner iOS app, Android app, and website (together, "the Service") - they share one account system and one backend, so one policy covers all of them.

Contact: info@badexytechnologies.com

2. What we collect

We collect only what the Service needs to function. Specifically:

Account information

Name and email address, when you create an account.
Your password is never stored in plain text - it's hashed before storage.

Trip and health-planning data

Trip details you enter: destination, departure and return dates.
Vaccine/medication dose schedules generated for your trips, and which doses you've marked complete.
Checklist progress and any reminder settings you configure (timing, quiet hours, push/email preferences).

Medical details (sensitive)

If you choose to enter them: blood type, allergies, medications, health conditions/notes, and an emergency contact name and phone number.
This is entirely optional. It exists so it's available to you on the Emergency screen if you need it - we don't require it to use the rest of the Service, and we don't use it for anything beyond displaying it back to you.
This data is stored separately from the rest of your account data, and is permanently deleted (not just hidden) when you delete your account - see Section 6.

AI assistant conversations

If you use the in-app travel health assistant, your questions are sent to our AI provider (OpenAI) to generate a response.
We do not store your chat conversations on our servers. Each conversation exists only for the duration of that chat session.

Technical and device information

A push notification token (from Apple or Google), so we can deliver reminders you've asked for. You can disable push notifications at any time in Settings.
Standard technical data any server receives (IP address, request timestamps) as part of normal operation - we do not use this for tracking or advertising.

What we do not collect: we do not access your device's camera, photo library, contacts, or location. We do not use third-party analytics, advertising, or crash-reporting SDKs - there is no tracking pixel or ad network anywhere in this app.

3. How we use your information

To provide the Service: generate your vaccine schedule, show your checklist, send reminders you've opted into, and answer your questions via the AI assistant.
To maintain your account: authentication, password resets, and account recovery.
To communicate with you about the Service (e.g. a password reset email). We do not send marketing email unless you separately opt in.
We do not sell your data, and we do not share it with third parties for their own marketing purposes.

4. Who we share information with

We use a small number of service providers to operate the Service. Each only receives the minimum data needed to do its job:

| Provider | What they receive | Purpose | |---|---|---| | OpenAI | The text of your message to the AI assistant, plus basic trip context (destination, departure date) if you have an active trip | Generating the assistant's response | | Apple (APNs) / Google (Firebase Cloud Messaging) | A device push token | Delivering push notifications you've enabled | | Amazon SES | Your email address | Sending transactional email (password resets, reminder emails) | | AWS | All of the above, as our infrastructure provider | Hosting our servers and database |

We do not share your medical details with any of the above except as strictly necessary to render them back to you inside the app (they are not sent to the AI assistant or included in push/email content).

We may disclose information if required by law, or to protect the rights, safety, or property of the Company, our users, or others.

5. Data security

Session tokens are stored in your device's secure hardware-backed storage (iOS Keychain / Android equivalent via expo-secure-store), not in plain application storage.
Data in transit between the app and our servers is encrypted (TLS/HTTPS).
Passwords are hashed, never stored or logged in plain text.

No system is perfectly secure, and we can't guarantee absolute security, but we design with these protections as defaults, not afterthoughts.

6. Data retention and deletion

You can delete your account at any time from Profile → Delete account. This requires re-entering your password as confirmation.
Deleting your account immediately and permanently deletes your medical details (blood type, allergies, medications, conditions, emergency contact).
Your account, trips, and other account data are deactivated immediately upon deletion, with no recovery window.
If you'd like a copy of your data, or want anything deleted that isn't covered by the in-app deletion flow, contact us at info@badexytechnologies.com.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, or object to certain processing of your personal data. You can delete your account and all associated data at any time directly in the app (see Section 6). For any other request, including a copy of your data or a correction, contact us at info@badexytechnologies.com and we will respond within a reasonable time.

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) to know what personal information we collect, request its deletion, and not be discriminated against for exercising these rights. We do not sell personal information.

To exercise any of these rights, contact us at info@badexytechnologies.com. Account deletion is also available directly in the app (Section 6).

8. Children's privacy

The Service requires users to be at least 18 years old (see our Terms and Conditions), and is not directed at or intended for use by anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with personal information, contact us at info@badexytechnologies.com and we will delete it.

9. International data transfers

Badexy Technologies, LLC is based in the United States (Alabama), and our servers and infrastructure are located in the U.S. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll notify you in the app or by email before they take effect. The "Last updated" date at the top of this page always reflects the most recent version.

11. Contact us

Questions about this policy or your data: info@badexytechnologies.com

Badexy Technologies, LLC 5726 Lake Cyrus Blvd Hoover, AL 35244, U.S.A.