Home › Guides › Medication app privacy

Medication App Privacy: What Really Matters

Updated: October 13, 2026 · by PrettyLights Software, the team behind Nurelio

A medication app handles some of the most sensitive data there is: active ingredients reveal diagnoses, and dosing times reveal entire daily routines. Whether an app really protects this data comes down to five criteria. First: where is the data stored — locally on your device or centrally in a cloud? Second: how is the app funded — through advertising and tracking, or through a transparent paid model? Third: do you have to create an account before you can use it at all? Fourth: are the servers in the EU, so the GDPR applies directly? And fifth: is shared data end-to-end encrypted, so that not even the provider can read it? This guide explains each of these criteria, compares the main types of apps in a table, and gives you a seven-point checklist you can use to check any medication app yourself in a few minutes — before you trust it with your health data. The criteria apply regardless of the provider — to the app you already use just as much as to a new one.

How secure is health data in medication apps?

As secure as the app's architecture allows — and the differences are big. Under the GDPR, health data is one of the specially protected categories of data, because a medication list is never “just a list”: if you know the medications, in many cases you also know the condition. Even so, the market ranges from apps that collect everything centrally on their own servers to apps that keep data exclusively on the device. The good news: you don't need to be a tech expert to spot the differences. The following sections go through the most important criteria one by one.

Local storage or cloud — what's the difference?

Local-first means your medications, doses and readings sit in a database directly on your device. The app works fully offline, and the provider has no central health data store that could be attacked or analyzed. Cloud-based apps, on the other hand, store your data on the provider's servers. That can be convenient (when switching phones, for example), but it also means the provider can read the data in plain text — unless it is stored end-to-end encrypted. With true end-to-end encryption, the data is already encrypted on your device, and only you (or the people you share with) hold the key. The server sees nothing but ciphertext. So don't just ask an app “Is it encrypted?”, but “Who holds the key?” — server-side encryption protects against third parties, not against the provider itself.

How can I tell if an app is ad-free and doesn't track me?

Three places give it away. First, the privacy details in the app store: the provider has to declare which data is collected and whether it is used for advertising. Second, the privacy policy — look for terms like “advertising ID”, “third parties”, “analytics partners” or “personalized ads”. Third, the business model: an app that is completely free and neither shows ads nor offers anything paid has to cover its costs somehow — often through data. A freemium model, where the basic version stays free and extra features are paid, is more transparent. With a medication app in particular, many users find ads between dose reminders inappropriate — quite apart from the fact that ad networks can read along with usage data. You can read more about what being ad-free feels like in everyday use in the guide Medication reminders that actually get through.

Do I need an account for a medication app?

For the core features — adding medications, getting reminders, keeping an eye on supply — no account is technically required if the app stores its data locally. A mandatory account, by contrast, means your health data is linked to an email address or identity before you can even try the app. That's a warning sign if there is no clear functional reason for it. An account or device pairing can be legitimate once data is synced between devices or people — and then, again, what matters is whether the contents stay end-to-end encrypted. Rule of thumb: a privacy-friendly app lets you get started without signing up first.

What types of apps are there — and how do they differ?

Rather than comparing individual products, it's worth looking at the basic types. Most medication apps can be classified along five dimensions:

None of these dimensions is a deal-breaker on its own — but the more points an app collects in the right-hand column, the more closely you should look before trusting it with a complete medication list.

Checklist: 7 criteria for a privacy-friendly app

• 1. Local storage: Is the data stored on your device rather than in a central cloud?
• 2. Works offline: Does the app work fully without an internet connection? That's the simplest real-world test for local-first.
• 3. No mandatory account: Can you get started without signing up?
• 4. Ad-free and tracking-free: No ads, no advertising IDs, no third-party analytics according to the store listing and the privacy policy?
• 5. End-to-end encryption: Is data that leaves the device (sync, sharing, backup) encrypted before it is sent — with keys only you hold?
• 6. EU servers and GDPR: Does the provider state the server location and rule out sharing data with third parties?
• 7. Transparent pricing: Is it clear how the provider makes money — and is it not your data profile?

How does Nurelio measure up against these criteria?

Nurelio is built around exactly these criteria: your medications, doses and readings are stored local-first in a database on your device, the app works fully offline and requires no mandatory account. Whatever you share with family members is end-to-end encrypted on your device — our server sees only ciphertext, never plain text. Hosting is in the EU, processing follows the GDPR, with no ads, no tracking and no advertising IDs. Nurelio is funded through a transparent model: the basic version is free forever, and you only pay for extra features such as family support. All the details are in the Privacy section of the home page and in the privacy policy.

Further guides on the individual topics: managing medications for a family member with fine-grained sharing, and what makes a medication reminder truly reliable.