Privacy Policy

This policy applies to the Pointra app ("the app") made by BIOSIGNBOX, LLC ("we"). Pointra is a health record app that helps you record and organize pain locations, questionnaire answers, readings such as blood pressure, medical history and medications. The app does not diagnose.

The app does not collect your location, contacts, photo library, or microphone recordings. When you sign a report to send to a doctor, the BioSignBox signing page takes your location and a face photo, and your phone asks for permission first.

• Bluetooth: to receive readings from blood pressure monitors, glucose meters, scales and pulse oximeters. Some Android versions require location permission to find Bluetooth devices; the app does not record or send your location.
• Apple Health / Health Connect (optional): the app reads only the items you allow. You can change this at any time in your phone's settings.
• Camera (optional): only when you photograph a medicine label or barcode.
• Biometrics (fingerprint / face) (optional): your phone checks it is you when the app opens. Your phone handles the biometric data; neither the app nor we receive it.

• Google Drive: only when you choose to save or restore a backup with Google Drive, the app uses the drive.file permission to create and read backup files in a "Pointra - 백업" folder in your Drive. With this permission the app can see only the folder and files it created; it cannot see or change any other file in your Drive. The file goes from your phone straight to your Drive without passing through our servers, and we do not keep it.
• We use information received from Google only for the purposes above; we do not use it for ads, sell it, or share it with others. Pointra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• You can remove Pointra's access at any time in your Google Account under Third-party apps & services.

• Our servers: the account number and linked-device registrations are stored with Supabase, the cloud service we use (data centers in the United States). They are encrypted in transit and at rest, and only people who need them for our work can access them.
• When you send a report to a doctor: the report PDF passes through our servers and is delivered by Amazon Web Services' email service (Amazon SES) to the doctor you chose. The PDF is encrypted with that doctor's password, and we do not keep the file after sending. We cannot delete the email or file the doctor received.
• Your signature: before a report is sent, you sign it on BioSignBox (sign.biosignbox.io), the electronic signature service we run. The report to sign and the signature record are stored in BioSignBox; once signed, the report comes back to your phone and the copy on our servers is deleted.
• Payment: the report fee is processed by Stripe (Stripe, Inc.). Stripe receives your card details directly under its own privacy policy. We receive only the amount, status, time and the Stripe payment number.
• Backups: backup files are saved only where you choose (Google Drive, OneDrive, phone files, iCloud and so on) and do not pass through our servers.
• No sign-in: when the app first opens, our server makes a random account number for your phone. We do not receive your email, name, or Apple or Google account information.

We do not sell personal information, use it for ads, or share it with other companies except as described above. We will comply when the law requires disclosure.

Records on your phone use your phone's built-in storage protection, and you can turn on biometric check when the app opens. They stay until you erase them or uninstall the app. Information on our servers is kept until you ask us to delete your account; we delete it within 30 days of your request. Payment records may be kept as long as tax and accounting laws require. BioSignBox signature records are kept to prove the signature is genuine; email support@biosignbox.io and we will delete them unless the law requires us to keep them. Please use a screen lock in case your phone is lost or used by someone else.

• In the app, Settings (the gear at the top left) → Erase all records erases the records on this phone, readings included.
• Settings → Delete account deletes your account and everything on our servers (account number, linked-device registrations, report send records) right away, along with the records on this phone. Payment records the law requires us to keep and BioSignBox signature records are handled as described in section 6. Because there is no sign-in, we have no other way to tell whose account it is. If you lose your phone, your linked-device registrations are released automatically after 30 days without use.

See How to delete your data and account for details.

Pointra is for adults 18 and older. People under 18 may not use it, and the app does not proceed with a birth date under 18.

If you live in California, Washington, or another state with privacy laws, you may have the right to know, access, correct, or delete your personal information (including health information), and to withdraw consent. You can view, edit and erase the records on your phone in the app; for information on our servers, contact us below. We will not treat you differently for using these rights.

If we add features that change how information is handled, we will tell you in the app and ask for any needed consent before you use them. When this policy changes, we update the date above.

BIOSIGNBOX, LLC · 13855 Visions Drive, La Mirada, CA 90638 · contact@biosignbox.io