jal aushadhi offline therapeutic runtime
§ legal & compliance runtime / public audit spec v1.4.2 / last modified: october 2026

privacy policy & regulatory disclosure

jal aushadhi is engineered as a strictly sovereign, offline-first therapeutic adherence vault. We collect exactly zero personal identifiers, execute zero cloud analytics, transmit zero outbound packets, and store every clinical record locally inside an encrypted SQLite ledger on your physical hardware.

runtime: v1.4.2 stable
outbound egress: 0 bytes
cloud accounts: 0 required
third-party trackers: 0 detected
wellness utility: non-diagnostic
license: mit open source
cryptographic sovereign baseline
shield

our foundational architectural contract

jal aushadhi was founded on an unapologetic premise: your medication adherence logs, circadian hydration patterns, and physiological biometrics belong exclusively inside your physical hardware enclave. We do not maintain user databases, we do not require authentication tokens, and we cannot access your records even under judicial subpoena because no servers, egress proxies, or analytics endpoints exist in our build.

§ 01 · telemetry & data audit

zero data collection & zero telemetry

Traditional health applications routinely log every tap, dosage, and medication timestamp, funneling behavioral telemetry to commercial brokers or third-party CRM systems. The table below represents the complete, exhaustive record of data handled by jal aushadhi.

data category where it lives cloud transfer retention lifecycle
medication schedule & pill stock local sqlite (sandboxed storage) 0 bytes (never leaves device) user controlled / app deletion
hydration intake & meal timing local sqlite (sandboxed storage) 0 bytes (never leaves device) user controlled / app deletion
bodyweight & daily kcal baseline local sqlite (sandboxed storage) 0 bytes (never leaves device) user controlled / app deletion
biometric authentication tokens hardware secure enclave (tee) 0 bytes (inaccessible to app) managed by mobile os kernel
crash analytics & diagnostic logs not generated / disabled 0 bytes (no crashlytics/sentry) none created
device identifiers (imei, idfa, gaid) never queried or stored 0 bytes (0 trackers) n/a
§ 02 · storage mechanics

local architecture & sqlite persistence

jal aushadhi employs a high-performance relational storage engine constructed with Drift (Dart SQLite ORM). Data files reside inside the sandboxed app folder allocated by the Android and iOS kernels, isolated from other applications on your system.

sandboxed file location

android: /data/user/0/com.jalaushadhi.app/databases/drift_sqlite.db
ios: ~/Library/Application Support/com.jalaushadhi.app/drift_sqlite.db

operating system sandbox constraints prevent external apps from reading database files without explicit root or physical storage clearance.

instant zero-latency execution

read latency: 0.12ms · write latency: 0.44ms · egress packets: 0

every query executes against on-device flash memory. The app does not poll remote sync queues, eliminating network failover delays or offline staleness.

§ 03 · device access boundaries

hardware permissions & biometric protection

We request the absolute bare minimum set of device privileges required to wake your screen for critical medication dosing and authenticate your physical presence.

[permission] android.permission.SCHEDULE_EXACT_ALARM
wakes the device CPU at scheduled dosage times for time-sensitive medicines (e.g. metformin 08:30 with breakfast).
local only · zero internet
[permission] USE_BIOMETRIC / local_auth (Face ID & Fingerprint)
gates access to your medication locker using your phone's Secure Enclave / Hardware Keymaster. Biometric scan data never enters app RAM.
hardware enclave isolated
[permission] android.permission.INTERNET
completely omitted from manifest. The mobile operating system actively prevents the app binary from opening socket connections.
omitted from binary
§ 04 · portability & encryption

encrypted backups & clinical export portability

You own your adherence records in perpetuity. jal aushadhi rejects proprietary lock-in, providing instant, uncompressed, and cryptographically secured export formats for doctor consultations and cross-device migration.

01 · aes-256 backup

export an encrypted local JSON snapshot encrypted via user-supplied master key using PBKDF2 key derivation and AES-256-GCM cipher.

02 · clinical pdf audit

generates a one-tap cryptographic PDF report for nephrologists or general practitioners showing timestamp variance and intake adherence curves.

03 · raw json / csv stream

developers and biohackers can inspect or pipe raw SQLite table dumps into personal scripts or local LLM inference engines.

§ 05 · regulatory & clinical classification

medical disclaimer & regulatory status

warning wellness tracking tool — not a certified diagnostic device

jal aushadhi is designed as an informational adherence tracker and habit-pacing companion for general wellness. jal aushadhi is not a medical device as defined by the United States Food and Drug Administration (FDA 21 CFR 801), the European Union Medical Device Regulation (EU MDR 2017/745), or the Central Drugs Standard Control Organisation (CDSCO).

  • It does not provide clinical diagnosis, medical triage, or pharmacological dosage calculation.
  • Calculations for hydration baseline (e.g. 35mL per kg bodyweight) and gastric digestion buffers are informational heuristics derived from ayurvedic principles and clinical nutrition guidelines, not individualized prescriptions.
  • Always consult a licensed medical physician, pharmacist, or specialist before modifying medication schedules, stopping doses, or adjusting fluid restrictions.
  • If experiencing an adverse drug interaction, acute anaphylaxis, or medical crisis, immediately call emergency services (911 in the United States, 112 in the European Union, 102/108 in India).
§ 06 · third-party sdk audit matrix

zero third-party sdk inspection matrix

Most mobile health applications bundle dozens of surveillance trackers to monetize ad targets or aggregate behavior. Below is the static code analysis verification of jal aushadhi v1.4.2:

google firebase / crashlytics [absent · 0 code]
meta (facebook) graph sdk [absent · 0 code]
mixpanel / segment / amplitude [absent · 0 code]
appsflyer / adjust telemetry [absent · 0 code]
sentry error telemetry [absent · 0 code]
ad networks / admob / applovin [absent · 0 code]
§ 07 · jurisdictional standards

global privacy compliance (gdpr, ccpa/cpra, hipaa)

european general data protection regulation (gdpr - eu 2016/679)

under gdpr, jal aushadhi acts neither as a "data controller" nor as a "data processor." Because zero personal data is gathered, transmitted, or stored on external servers, no international data transfers (chapter v) take place. User rights under article 17 (right to erasure) and article 20 (data portability) are fully autonomous: users may clear data or export local databases at any second directly within the app settings.

california consumer privacy act & cpra

we do not sell, rent, share, or broker personal information. There is no personal data to opt out of, as we possess zero records of your name, email, IP address, device ID, or medical schedule.

united states hipaa compliance scope

jal aushadhi is a direct-to-consumer software package, not a "covered entity" or "business associate" under the Health Insurance Portability and Accountability Act (HIPAA) of 1996. Because no protected health information (PHI) is transmitted or held by jal aushadhi personnel, no Business Associate Agreements (BAAs) are executed.

§ 08 · open source manifest

open source transparency & core runtime dependencies

jal aushadhi is licensed under the permissive MIT Open Source License. We believe therapeutic software holding health records must be verifiable line-by-line. The core runtime relies on these audited packages:

drift (sqlite) v2.16.0 · type-safe reactive persistence
MIT license
flutter_local_notifications v17.0.0 · local alarm manager orchestration
BSD-3 license
local_auth v2.1.8 · hardware biometric authentication hooks
BSD-3 license
cryptography_flutter v2.7.0 · local aes-256 backup encryption
Apache 2.0
§ 09 · developer contact & disclosure

security contact & vulnerability disclosure

If you discover an architectural flaw, potential data leakage pathway, or local security vulnerability in jal aushadhi, please report it immediately directly to the maintainer:

primary maintainer Aditya Gupta
security & disclosure email mailadityaguptaa@gmail.com
pgp fingerprint 4A92 C108 55F2 83D1 90A2 B561 0271 88EE
we pledge to acknowledge vulnerability reports within 24 hours and publish cryptographic patches via github releases within 72 hours of verification.