Privacy policy — INR Notebook

Last updated: 13 October 2026

INR Notebook is an Android app for people taking warfarin. It keeps your INR results, your clinic's dose instructions, the doses you take and your clinic visits in one place. This policy explains what the app does with that information.

The short version

Your health records stay on your phone. There is no account and no sign-in, and there is no analytics, advertising or tracking of any kind. We never receive your records.

Only three things can leave your phone, and only in the ways described below: an encrypted backup copy, if you choose a folder to send it to; what Google Play needs to handle a subscription; and a photo of a meal or of a medicine's packet, if you choose to have one read by an AI service you set up with your own key.

What the app stores, and where

INR Notebook keeps the following in its own private storage on your device:

Health records: INR results and target ranges, dose instructions from your clinic, the doses you record as taken or missed, clinic visits and appointments, the questions you note for your next visit, symptoms and notes you type, and the change history of each INR result and clinic visit
Your details: anything you choose to enter on the profile and clinic screens, such as your name, date of birth, hospital, file number, reason for taking warfarin, your clinic's contact details and any other contacts you add, such as your pharmacy, and a profile photo if you add one
Health diary: symptoms you note, with any photo you take for one; events such as an illness or travel; the medicines you take besides warfarin; the weights and height you enter; and your blood pressure and pulse readings, with any limits for them you enter from your clinic
Meals: meal plans, your weekly meal timetable, your food log (the photos you take, what you type in, when you ate and how much), the water you drink, and what the AI service you chose said about them
AI service settings: which AI service reads your meal photos, the model, and your key for it, locked with the Android Keystore
Reminders: the reminders you turn on and their times
Documents: photos and PDFs you attach, such as your warfarin card, copied into the app's storage
Settings: theme and notification choices and, if you set an app lock, a salted hash of your PIN (never the PIN itself)
Subscription status: the day your free trial started, and whether Google Play last reported an active subscription

This information is not uploaded to us, not shared with anyone and not sold. We never see it.

Backups

Backup on your phone. When you tap Back up now, and once a day during the free trial or with INR Notebook Premium, the app saves everything above into a single encrypted file (AES-256-GCM, with the key held in the Android Keystore). It is kept in the app's storage on the phone.
Weekly copy to a folder you choose. If you choose a folder, for example in Google Drive, the newest backup is copied there each week, or when you tap Send now. The file is encrypted before it leaves your phone, so the service holding it cannot read your records. That service keeps the file under its own terms, and it stays there until you delete it.
Recovery code. A 64-digit recovery code lets you restore a backup on a new phone. Keep it somewhere safe: we do not have it and cannot recover it for you. The app keeps a copy locked by the Android Keystore, so the weekly copy can run without asking you for it. The Backup screen can share the code through Android's share sheet, for example to your own email, only when you tap Share; anyone who has both the code and a backup file can read your records, so send it only to yourself.
Android's own backup is switched off for INR Notebook, so Google's device backup does not copy your records.

Meal and medicine photos and AI

If you set up an AI service in Settings, you can photograph a meal and have it analysed, or photograph a medicine's packet to fill in its name and strength in your health diary. This is off until you set it up, and works only with an account and API key of your own with that service (Anthropic, OpenAI, Google Gemini, or another service you name). We provide no key and receive nothing.

What is sent: the meal photo, reduced in size, and a list of food names from your clinic's food list so the service can use the same names. To look up nutrients, only food names are sent. For a medicine, only the photo of its packet, reduced in size; the photo is not kept on your phone afterwards. Nothing else from your records is sent: no name, no INR results, no doses.
Your agreement first: before anything is first sent, the app names the service that will receive it, says what is sent, and asks you to agree. Nothing is sent if you do not. Choosing a different service asks again.
When: only when you take or choose a photo, add a food, or rename one. A medicine photo is sent once, when you take or choose it. A photo analysed before is not sent again, and a food analysed before is not asked about again; the saved answer is used.
Who handles it: the service you chose, under your agreement with it. Read its privacy policy to see how it keeps and uses what you send. It may charge your account for each request.
Your key is stored on your phone, locked with the Android Keystore. It is never included in backups or exports, and you can remove it in Settings at any time.
What comes back (food names, amounts and nutrient estimates) is stored with your other records, and included in your backups and exports. A medicine's name and strength are filled into the form for you to check, and kept only if you save it.

What the app sends over the internet

Google Play, for subscriptions. INR Notebook Premium is sold through Google Play Billing. Google Play takes the payment; the app only learns whether you have an active or pending subscription, and confirms each purchase back to Google Play. We never receive your card, mobile money or other payment details. Google handles purchase information under the Google Play Terms of Service and the Google Privacy Policy.
The backup copy, if you choose a folder, through the storage app you picked.
Meal photos, food names and medicine packet photos, to the AI service you set up, as described above.

Nothing else. The app contains no analytics, crash reporting or advertising code, and the published app writes no logs.

Sharing your records

Only when you choose to. The Export screen, part of INR Notebook Premium after the free trial, creates a PDF, CSV or JSON file on your phone and opens Android's share sheet, so you decide who receives it; so does sharing the summary since your last visit as a PDF. Exported files contain your health information, so share them only with people you trust, such as your clinic.

Adding to your calendar. When you tap Add to your calendar beside an INR test or clinic appointment, the app opens your phone's calendar app with the date and "INR test" or "Clinic appointment" filled in. The app does not read or change your calendar and needs no calendar permission. The event is saved only if you save it there, and then your calendar app keeps it, and may sync it to your calendar account, under its own terms.

Permissions the app asks for

Permission	Why
Notifications	Reminders for your warfarin dose, before your warfarin tablets run out, INR tests, clinic appointments, meals and record keeping. A reminder never shows an INR result or a dose amount, and its text is hidden on a locked screen. If you turn on your emergency card on the lock screen, one notice there says that you take warfarin, and is meant to be read without unlocking.
Alarms and reminders	So a reminder arrives at the minute you set, rather than whenever the phone gets round to it.
Run at startup	To set your reminders again after the phone restarts or the app is updated.
Fingerprint and face unlock	To open the app with your fingerprint or face, if you turn that on. Android does the check; the app never receives biometric data.
Vibration	So a dose reminder can ring like an alarm.
Internet and network state	Used by Google Play Billing for the subscription, to wait for a connection before sending the weekly backup copy, and to send a meal photo to the AI service you set up.
Google Play billing	To offer INR Notebook Premium and check whether you have it.
Wake lock and foreground service	Used by Android's job scheduler so the daily backup can finish.

To attach a photo or a document, the app uses Android's photo and file pickers. They need no permission, and the app receives only the items you pick. To fill in your clinic's phone number from your contacts, the app opens Android's contact picker; it has no contacts permission and receives only the name and number you pick. To photograph a meal, a medicine's packet, a symptom or yourself for your profile, the app asks your camera app to take the picture; it has no camera permission of its own and receives only the photo you take. The app does not ask for your location.

Keeping your records safe

Your records are protected by your phone's own lock screen and storage encryption, by the encryption of every backup and, if you turn it on, by the app lock. If you also choose to show your emergency card at the app lock, anyone who opens the app on your phone can read that card without your PIN: that you take warfarin, why, your target range, your other medicines and the numbers on it. Nothing else in the app can be opened from there. If you choose to show your emergency card on your phone's lock screen, a notice there says that you take warfarin, and tapping it opens the card without unlocking the phone, so anyone holding your phone can read it; nothing else on the phone is unlocked by it. The emergency card can also be copied, by you, into your phone's own medical information, which your phone shows on its lock screen; the app never puts it there itself. Keep your phone locked, and keep your recovery code private.

Children

INR Notebook is meant for adults managing their own warfarin treatment, or a parent or carer doing it for someone. It is not directed at children under 13, and it sends no personal information to us from anyone, of any age.

Deleting your data, and your rights

Because your records are on your phone and not with us, you are in control of them:

Delete any record inside the app at any time. Correcting some records, and exporting a copy, need INR Notebook Premium after the free trial; nothing you have recorded is ever hidden from you.
Uninstalling INR Notebook deletes everything it stored on the phone, including the daily backups kept there.
Backup copies in a folder you chose stay there until you delete them.
Subscription records are held by Google. Manage or cancel a subscription in the Play Store, under Payments and subscriptions.

We hold no copy of your records, so there is nothing for us to access, correct or delete on your behalf. You can still write to us with any question about your information, including under the Kenya Data Protection Act, 2019.

Changes to this policy

If the app starts handling information differently, such as a new permission or something sent somewhere new, this policy will be updated before that version is released. The new version will be published at this address, and the date above will change.

Contact

Questions about this policy: coolnjeru@gmail.com