How Medule handles your data

Last updated 9 August 2026. Who is responsible, why we may hold this data, and your rights: see the privacy notice.

Where your data lives

Medule is self-hosted on a single server in Falkenstein, Germany (EU), run by the operator of this instance. The application and database run entirely on that server; the only copies that leave it are the encrypted backups, the limited transfers listed below, and any calendar feed a member chooses to subscribe to. There are no third-party analytics.

Services we rely on

A small number of providers process limited data so Medule can work:

What the operator sees

The operator has an in-app view of account-level figures: how many accounts exist, how many were created recently, how many are verified, how many care circles there are and how many members they have, how recently accounts were last used, whether the reminder worker is running, how many notifications were sent in the last 24 hours, and how many push devices are registered. It also shows figures derived from the health tables — a count for each dose status that occurs among the doses that were due in the last 24 hours, how many doses are pending ahead of now, how many appointments fall in the next 60 days, how many circles have no active medication, and how many accounts are in a circle with an active medication. Alongside those totals it lists one row per account showing the signup date, whether the address is verified, how many circles the account belongs to, and the date it was last used. That view identifies accounts by a short reference rather than by email, and every health-derived figure is a total only — no medication name, dose note, appointment detail or patient name.

Separately from that view, the operator administers the server this service runs on, which means they can technically reach the database and the encrypted backups. That is inherent to self-hosting rather than something the view above adds.

How long we keep data

Your care records stay for as long as your care circle exists. Deleting a circle removes its medications, schedules, dose history, appointments, and activity log immediately. We keep one small security record of the deletion itself — what happened and who did it, never any health information — so that misuse of an account can be investigated. Medication entries within an active circle are archived rather than deleted, so the shared record of who gave what, and when, stays truthful for everyone caring for the same person. Appointments work the same way: removing one that has no past visit deletes it outright, but removing one whose visit has already taken place only removes what is still to come — the visits that already happened stay in the circle’s record.

Some technical records are cleared automatically rather than kept for the life of the circle. Expired sign-in sessions are removed after 90 days, so the sign-in history in your own data export reaches back about that far. The counters we use to block abuse — which record either the network (IP) address a request came from or, for exports and label scans, the account that made it — are cleared after 48 hours. Invite links that expired without being used are removed 30 days later; invites that were used stay as the circle’s record of how each member joined.

Your own data: export and account deletion

While signed in, you can download a copy of the data Medule holds about you as a user from your profile page, or directly at /api/me/export: your account details, sign-in history (including IP addresses), notification settings, invite records, any consent or authority declarations you recorded (which circle and when), a record of the actions you took, which appointments you cancelled (the fact and when — not the visit’s details), whether you created a calendar-feed link (never the link itself), and our security-log entries about your account. It contains your data only: no other member’s identity and none of the patient’s health information — the patient’s record belongs to the circle, not to any one member.

The circle’s own copy is a separate thing, and it is wider. An admin of a circle can download everything in it as a single file from that circle’s settings page. That file holds every member’s name and email address alongside their role and when they joined, the medication and dose record (including who logged each dose), stock counts, condition tags, appointments and the reminders sent for them, the change log, invite records, and the consent or authority declarations members recorded — so if you are in someone’s circle, that circle’s admins can obtain a copy of your details and of what you logged. Invite links and calendar-feed links are never included, and neither is any of the account-level data the export above serves to you — your sign-in history, notification settings, push devices and security-log entries among it.

You can also delete your account from your profile page (your password is required). Deletion is immediate and removes your account, sign-ins, and circle memberships. Doses you logged and changes you made stay in the circle’s shared record — that history belongs to the person being cared for and the people still caring for them — but your identity is detached from those entries, including entries where someone else changed your role or removed you. The circle sees a “member left” entry with no name. If you are the only member of a circle, deleting your account deletes that circle and everything in it. If you are the only admin of a circle that still has other members, you must hand over the admin role or delete the circle first.

One category is kept indefinitely after account deletion: our internal security log — records of data exports, circle deletions, role changes, calendar-feed links being created or revoked, and reads of (or attempts to reach) the operator’s account-metrics view, with account identifiers and timestamps, never health data. We keep these so that misuse of an account cannot be covered up by deleting the account. They appear in your export while your account exists.

One other thing outlives deletion briefly. The abuse counters described above are not linked to your account record, so deleting your account does not clear them: where a counter was recorded against your account rather than an IP address, it remains — as an account identifier, a time and a count, and nothing else — until it is cleared automatically. That clean-up runs once a day against a 48-hour cutoff, so such a counter is never removed less than 48 hours after it started, and normally no more than about 72 hours after.

Calendar feeds

Any circle member can create a personal calendar link for the circle’s recent and upcoming appointments. That link is a secret address which works without signing in: anyone who has it can read the circle’s appointments without a Medule account, so treat it like a password.

If you subscribe from a calendar app, the details of each visit — its title, time, location, and any notes — are sent to your calendar provider, for example Google or Apple, under that provider’s own terms. You can rotate your link at any time, which cuts off the old address, and it stops working if you leave the circle. That only stops further requests, though: a calendar app which already downloaded appointments may keep its own copy of them.

Backups

Encrypted backups are kept for up to 90 days and then age out. Data you delete — a circle or your account — disappears from the live system immediately but can persist inside those encrypted backups for up to 90 days. The same is true of the technical records described above that we clear automatically: a sign-in session, an abuse-counter entry, or an expired invite link removed from the live system can still be present in a backup taken before that happened, for up to 90 days after that backup was made. Backups are only ever restored wholesale after a disaster, never used to look up individuals.

Reporting a security problem

If you believe you have found a security issue in Medule, please tell us via the contact listed at /.well-known/security.txt.

← Back to Medule