Medicus

Privacy Policy

Effective October 15, 2026

Who this policy is for

Medicus is a practice-management app for independent practitioners, such as psychologists and therapists. In this policy, “you” means the practitioner who uses Medicus. Patients don’t use the app; if you’re a patient, see If you’re a patient.

Medicus isn’t a healthcare service. It gives no medical advice, diagnosis or treatment, and it isn’t a medical device.

What Medicus keeps, and where

On your devices

Everything you enter: your practice’s settings, services and prices; your patients and their details (such as names, birth dates, ID numbers, contact details, emergency contacts and photos); appointments; session notes and addenda; charges, payments, packages and prepaid sessions. Medicus also keeps a few settings for each device, such as App Lock, notification choices, the date of your last export and the last known status of your purchase.

This data lives in Medicus’s private storage on the device. On iPhone and iPad it’s protected by the device’s encryption, which is tied to your passcode. On a Mac, turn on FileVault for similar protection.

In your device backups

By default, Medicus’s data is included in your device backups: iCloud Backup or backups to a computer on iPhone and iPad, and backups such as Time Machine on the Mac. iCloud Backup is end-to-end encrypted only when Advanced Data Protection is on. You can leave Medicus out with Exclude from Device Backups in Settings › Privacy & Security, on each device.

In your iCloud account, only if you turn on sync

iCloud sync is off until you turn it on, on each device. When it’s on, Medicus keeps a copy of your practice in your own iCloud account, in its private database, so your devices signed in to the same Apple Account stay in step. Apple stores this data under the Apple Privacy Policy, and Apple’s push service tells your devices when changes are waiting. The developer has no access to your iCloud data.

• Names, photos, contact details, birth dates, ID numbers, notes, memos, reasons, appointment places and video links, and payment references are encrypted with keys in your iCloud Keychain.
• Other details don’t have that encryption, such as amounts and prices, appointment dates and times, payment dates and methods, statuses and flags (for example, that a note is confidential), your professional title, your practice’s settings and the links between records. Apple protects them as it protects the rest of your iCloud data.
• If you lose access to your iCloud Keychain, the encrypted parts can’t be recovered from iCloud. That’s why Medicus asks for a recent export before you turn on sync.

If you turn sync off, the device keeps its data and the copy in iCloud stays in your account until you delete it in your Apple Account’s iCloud storage settings.

In files you export

Export creates a file with your practice’s data (JSON or CSV), or one patient’s records, after you confirm it’s you. The file includes confidential notes with their text, and it isn’t encrypted: anyone who opens it can read everything in it. Medicus warns you before you save it. Where you keep export files, and who can open them, is up to you. Medicus prepares each file in its temporary folder and removes it there once the export ends.

If Medicus ever can’t open its data, its recovery screen offers Export Database Files, after you confirm it’s you. That file is a copy of Medicus’s database: it holds every record, confidential notes included, and it isn’t encrypted. Keep it as carefully as an export, and don’t send it to anyone, the developer included.

What leaves the app, and only when you choose it

• Reminders. Send Reminder… writes a message with the patient’s first name, the date and the time and, unless you leave them out, the place or video link and your name (your professional title only if you add it). It never includes notes, the service, the memo, amounts or the patient’s surnames. Medicus opens WhatsApp, Messages or Mail (or the share sheet) with that message, and you can edit it before you send it yourself. For WhatsApp, Medicus uses WhatsApp’s wa.me link, which carries the patient’s number and the message; if WhatsApp isn’t installed, the link opens WhatsApp’s website in your browser. Once you send it, the message is handled by that app and its provider, under their own privacy policies.
• Calls, WhatsApp, emails and video links. These open your phone app, WhatsApp (through its wa.me link), your mail or video app, or your browser, with the number or address you chose.
• Copying. Copy Note keeps the note’s text on the device you copied it on: on iPhone and iPad it’s cleared after 2 minutes, and on the Mac it stays off Universal Clipboard. Text you copy with the system’s own Copy command follows the system’s behaviour, so Universal Clipboard can carry it to your nearby devices signed in to the same Apple Account.
• Dictation is the system keyboard’s own and uses Apple’s speech recognition. On supported devices and languages it runs on the device; otherwise Apple may process it on its servers. Apple’s privacy policy applies to it.
• Keyboards. On iPhone and iPad, Medicus allows only Apple’s keyboards, so third-party keyboards never see what you type.

Notifications

Notifications are off until you turn them on in Settings › Notifications, on each device. They’re scheduled on the device itself, not sent from a server. They never show patient names, note text, services or amounts. You can choose to add initials such as “AL”, which are left out while Privacy Mode is on. On iPhone and iPad, the system may wake Medicus briefly in the background to keep them up to date; nothing is sent anywhere.

Face ID, Touch ID, camera and photos

App Lock, confidential notes and the other steps where Medicus confirms it’s you use the system’s check: Face ID, Touch ID or your passcode (on a Mac, Touch ID or your login password). Medicus only learns whether it succeeded, and it never receives biometric data. On iPhone and iPad, Medicus uses the camera only when you take a patient’s profile photo, and the photo picker gives it only the photo you choose. Medicus keeps only a small copy of each photo (256 pixels at most), like any other record.

Purchases

The free trial and Medicus Unlock are in-app purchases handled by Apple through the App Store. Apple processes any payment. Medicus checks your purchases on the device and remembers their last known status there. The developer never sees your payment details, and the app sends the developer nothing about you.

What the developer receives

Nothing from the app. Medicus has no server of its own and contains no analytics, crash reporting, advertising, tracking or third-party code. It doesn’t share or sell data, because it never collects any. The only services it uses are Apple’s: iCloud (only for sync, when you set it up and while it’s on), the App Store for purchases, and the system’s notifications.

Two things reach the developer outside the app:

• Emails you send. If you write to support, the developer receives your email address and your message, uses them only to answer you, and deletes them when they’re no longer needed. Please don’t include patient names, notes or other patient details, and don’t attach export files or database files.
• Apple’s reports. If you choose to share analytics with app developers in your device settings, Apple may give the developer crash reports and usage statistics. Apple also gives developers sales and download reports. These come from Apple, under Apple’s privacy policy, and don’t include your records or your patients’ data.

Your responsibilities

Medicus is software you run on your own devices. Where data-protection and health-privacy laws apply to your practice, such as the GDPR in the European Union, the LFPDPPP in Mexico or HIPAA in the United States, you are the one responsible for the personal and health data you keep about your patients. For example, you may need a lawful basis to keep it, to tell patients how you keep it, to answer their requests, and to keep clinical records for as long as the law requires.

The app never sends your patients’ data to the developer, and the developer has no access to it, so the developer doesn’t handle it on your behalf, as a data processor or a HIPAA business associate would. Apple provides iCloud under its own terms. Apple doesn’t sign business associate agreements (BAAs) for iCloud, so if HIPAA applies to you, the cautious setup is Medicus without iCloud sync, excluded from device backups, with regular exports to storage you control.

Medicus helps with patients’ requests: Export Patient… gives you one patient’s records as a file, and Delete Permanently… removes a patient. Deleting stays possible even after the free trial ends without a purchase, and so does Erase Medicus Data on This Device…, which removes your practice from a device.

This section describes how Medicus works. It isn’t legal advice. Check your obligations with your professional body or a lawyer.

If you’re a patient

If your practitioner uses Medicus, your records are on their devices and, if they use iCloud sync, in their iCloud account, and they decide how those records are kept. To see, correct, get a copy of or delete your records, ask your practitioner. The developer has no access to your records and can’t see, change or delete them.

Children

Medicus is made for professionals, not for children. Records about patients of any age, minors included, are kept by the practitioner like any other record, and the developer receives none of them.

Keeping and deleting data

Medicus never deletes clinical records by itself. You decide what to keep and what to delete; the Support page explains how. With iCloud sync on, a deletion reaches your other devices and your iCloud copy. It doesn’t remove copies in device backups or export files, or in an iCloud copy left from before you turned sync off: you delete those yourself. Erase Medicus Data on This Device…, in Settings › Privacy & Security, removes your practice from that device: its records, older copies it moved aside on that device, exports that were never saved and the date of your last export. It keeps only settings about the device itself, such as App Lock and the status of your purchase. It turns iCloud sync off there and doesn’t touch the copy in iCloud or your other devices. On a Mac, use it before you delete the Medicus app, which may otherwise leave its data on the Mac. Because the developer holds none of your data, there’s nothing for the developer to delete.

Security

Medicus protects your records with App Lock (Face ID, Touch ID or your passcode), Privacy Mode, confidential notes, the device’s own encryption and, with sync on, iCloud Keychain encryption for sensitive fields. App Lock and every step where Medicus confirms it’s you need a passcode on the device (a login password on a Mac): without one, Medicus can’t ask who you are, so those steps go ahead without a check, and Medicus shows a reminder to set one. No system is perfect, so keep a passcode on your devices, keep them up to date, and store export files carefully.

This website

This site has no cookies, analytics or trackers. It’s hosted on GitHub Pages, and GitHub logs visitors’ IP addresses for security, under GitHub’s own privacy statement.

Changes

If this policy changes, the new version will be posted on this page with a new effective date.

Contact

Medicus is made by Jesus Molina. For questions about privacy, email colgat3666@proton.me.