Privacy and security, designed in from the start
In Buddy Forever, patients are not real people but nicknames you make up. Everything else is built around that idea.
Use made-up nicknames for patients. Never enter real names, initials, file numbers or phone numbers.
- Sunflower
- Daisy
- Tulip
The app has no field for a patient's name, initials, file number or phone number. We left them out on purpose.
You see this rule when you sign up and you accept it. It comes back on the patient screens too.
Who sees your data, and who does not
-
Only between the two of you
Your calendar and plans are shared with your buddy. They are not shared with anyone else.
-
A buddy sees a patient only while assisting
Your buddy sees a patient plan only for a live visit they are assisting. A temporary assistant sees only the appointment they were invited to.
-
Admins never see patient records
Admins run the app but cannot open patient records. Admin actions are logged.
-
Codes, not links
Messages the app sends contain codes, never links to click. It is a small defence against fake emails.
-
Notifications stay in the app
You see notifications in your inbox. Email is used only for sign-in codes.
-
No ads, no tracking
We do not use your data for advertising, we do not sell it and we do not track you on the website or in the app.
Your data: download it, delete it
You can do both yourself in Settings. You do not need anyone's permission.
Export your data
Your profile, setup, events, progress, patients and plans download as a single JSON file. Your buddy's data is not in it. You can import the same file again if you like.
Delete your account
-
The moment you confirm
Your account is locked and signed out everywhere. Your buddy is told.
-
Within 7 days
If you change your mind, sign in and choose "Restore my account".
-
Within 14 days
Your account and everything it owns is fully removed from the system.
-
Within 5 weeks
Backups age out, so a deleted account leaves them too.
Security: how it is protected, briefly
No big claims. This is what we do.
-
Data lives on Cloudflare
The app and its database run on Cloudflare's infrastructure. The exact data region and the basis for transfers outside Türkiye will be finalised before the public launch; the privacy notice says so.
-
HTTPS everywhere
Every connection is encrypted.
-
Passwords are stored hashed
Nobody can see your password; only an irreversible hash of it is kept.
-
Rate limits
Sign-in, codes and invite requests have rate limits that make automated attacks harder.
-
Admin audit log
What admins do is written to an audit log.
-
Access checked on every request
A record can be read only by its owner, their active buddy or an invited temporary assistant.
This website
This site sets no cookies, uses no analytics or tracking and loads nothing from third parties.
The legal pages
You will find the details on the three legal pages. They are the closed-beta version and will be reviewed by a lawyer before the public launch.
A privacy question?
Write to us with requests, questions and notices about your data. We answer within 30 days at the latest, as the law requires.