Who operates DoseCanvas
DoseCanvas™ is a division of UtopiaCharleston. In this notice, “DoseCanvas,” “we,” “us,” and “our” refer to UtopiaCharleston’s DoseCanvas service. This notice applies to the public website, installable web app, charts, forms, and administrator tools.
Consumer health data we collect
- Identity and account data: the account identifier and email supplied through sign-in, and the patient name or relationship you choose to record.
- Medication and care data: medications, supplements, strengths, doses, routes, schedules, reasons, directions, precautions, contraindication and interaction concerns, allergies, health conditions, professional-review status, care notes, doctors, pharmacies, appointments, and review history.
- Images and derived data: bottle-label or pill-reference photos you choose to save, codes on labels, and text derived from images.
- Sources: information entered by you or an authorized caregiver; images and codes captured by your device; account data supplied through sign-in; and limited billing status supplied by PayPal if payments are later enabled.
DoseCanvas does not intentionally collect precise location, contacts, microphone recordings, government identification, Social Security numbers, military documents, or full card or bank-account numbers. Do not submit them.
Other information we collect
We may collect inquiry, feedback, plan-interest, organization, veteran-benefit self-attestation, consent, security, and diagnostic information. Privacy-safe product events may count actions such as beginning or saving an entry, opening print view, or confirming a list review. These events exclude medication names, diagnoses, chart text, and photos.
Why we collect and use information
We use information with your consent or as otherwise permitted by law to provide, secure, troubleshoot, and improve DoseCanvas; save user-directed records; generate printouts; support sign-in; respond to requests; administer benefits and plans; prevent misuse; and meet legal obligations. DoseCanvas does not sell consumer health data, use it for targeted advertising, or make paid medication recommendations. We will request any legally required separate authorization before selling consumer health data or sharing it for a purpose outside those disclosed here.
Who may receive information
Information may be processed by service providers that support hosting, database and photo storage, authentication, security, transactional email, and—only if enabled—PayPal payments. These providers may process only the information needed for their assigned service under their applicable terms. We may also disclose information when you direct us, when required by law, to investigate fraud or security incidents, to protect rights or safety, or in a business transfer subject to appropriate protections.
DoseCanvas does not automatically send a chart to relatives, clinicians, pharmacies, advertisers, or data brokers. Inquiry, waiting-list, benefit-request, and feedback content may be sent to the DoseCanvas administrator through the transactional-email provider. Do not include health records or medication details in those forms.
Your consent and authority
Before creating or changing a chart, you must confirm that you are the patient or have the patient’s permission or other lawful authority, and consent to DoseCanvas processing the health information you choose to save. You may withdraw consent by deleting the chart or contacting us. Withdrawal does not make earlier lawful processing invalid and may prevent DoseCanvas from continuing to provide the chart.
Your choices and requests
Signed-in users can use My data to download structured chart data or permanently delete chart data and saved photos. You may also request access, confirmation, correction, deletion, withdrawal of consent, or review of a denied request by contacting us from the account email. We may need to verify identity and authority before acting. We will explain a denial and any available appeal process required by applicable law. You may authorize an agent where the law permits; we may verify that authorization.
Retention
- Saved charts and attached photos remain until the user removes them or deletes the chart, subject to limited backup, legal, fraud-prevention, and security needs.
- Phone-capture links expire after 20 minutes. Unsaved or unlinked capture photos are targeted for deletion after 24 hours.
- Privacy-safe product event counts are targeted for deletion or aggregation after 90 days.
- Inquiries, feedback, and waiting-list records are reviewed periodically and are targeted for deletion within 24 months after closure or withdrawal unless a shorter period is requested or a longer period is legally required.
- Billing, consent, dispute, fraud-prevention, and legal records may be retained for the period reasonably required by law or to establish, exercise, or defend claims.
Data may remain briefly in restricted backups until normal rotation. A structured export currently excludes image files.
Security and incident response
DoseCanvas uses account-scoped access checks, restricted administrator access, private/no-store responses for sensitive routes, upload validation, request throttling, and security headers. Online systems cannot promise absolute security. Protect your account and printed copies. Report a suspected privacy or security incident through the contact form using “Security or privacy incident.” We will investigate and provide notifications required by applicable law.
HIPAA and health-app laws
DoseCanvas’s direct-to-consumer service is not represented as covered by HIPAA. HIPAA may apply differently if a service acts for a healthcare provider, plan, pharmacy, or other covered organization. DoseCanvas will not open an organizational patient-data workflow without a separate agreement and privacy, security, access-control, and compliance review. Other federal and state consumer-health, privacy, security, and breach-notification laws may apply even when HIPAA does not.
Children
DoseCanvas accounts are intended for adults. A parent or legal guardian may maintain information for a minor when legally authorized. Children must not create an account or submit personal information directly. Contact us if you believe a child submitted information without appropriate authorization.
Cookies, tracking, and automated decisions
DoseCanvas may use strictly necessary sign-in and security technologies and limited first-party product counts. The service does not currently use third-party advertising trackers, sell health-data profiles, or make decisions producing legal or similarly significant effects through automated processing.
Changes and contact
We may update this notice as the service or law changes. We will post a new effective date and provide additional notice or request renewed consent when required. Privacy requests and appeals may be submitted to the contact below.
Questions, requests, or concerns can be sent to utopiacharleston@gmail.com.