Privacy Policy

1. Who We Are

Nian ("Nian", "we", "us", "our") is a mobile application that provides voice-based medication reminders and adherence logging, and lets a family member optionally see whether a reminder was answered.

Legal entity: Xiaoning Jin
Mailing address: 陕西省西安市莲湖区枣园丰盛园7号楼, China
Privacy contact:[email protected]
Data deletion requests: https://mind.jinlab.com/delete-account

2. Scope of This Policy

This Policy applies to the Nian mobile app and the Nian backend service (collectively, the "Service"). It does not apply to third-party services you reach from the Service (for example, Google Play), which are governed by their own privacy policies.

Nian is not a healthcare provider, health plan, or healthcare clearinghouse, and is not a business associate of any of them. See section 7 for what that means for the health-related information you give us.

3. Information We Collect

We collect only what the Service needs to function.

3.1 Account information: email address; phone number (optional); Google account identifier if you use Google Sign-In; password (stored only as a bcrypt hash, never in plain text); nickname and avatar; subscription status and Google Play purchase token; time zone (e.g. America/New_York), read from your device operating system setting; account timestamps and verification flags.

Nian does not request or receive any location permission and does not collect GPS, Wi-Fi, or IP-derived precise location. Time zone is a coarse geographic signal, so we disclose it here rather than treat it as invisible.

3.2 Medication and adherence information: medication names, dosage, times per day, reminder times; whether a dose was marked taken or missed and when; escalation records when a reminder goes unanswered. We treat medication names as sensitive. We do not use this data for advertising, we do not sell it, and we do not share it with data brokers or analytics vendors.

3.3 Voice and audio: short voice commands you speak to create or update a reminder; voice confirmations such as "I took it"; family voice recordings you deliberately record and save, played back exactly as recorded; consent recordings and consent metadata (name, exact consent text shown, version, timestamps, withdrawal timestamp). See section 4 for what we deliberately do not do with your voice.

3.4 Family / care group information: group membership, invitations sent or accepted, member nicknames, and the email or phone number used to invite someone. If you invite someone who is not yet a Nian user, we store that contact detail only to deliver the invitation, until it is accepted, declined, or cancelled.

3.5 Device and technical information: device model and OS version, app version, language setting, push notification token, crash and error information, and server-side request logs including IP address for security and abuse prevention.

3.6 Purchase information: subscriptions are sold through Google Play Billing. We receive a purchase token and subscription status from Google. We never receive or store your credit card number, bank details, or billing address.

4. What We Do Not Do

These are commitments, not just omissions. They are enforced in our code, not only in this document.

4.1 We do not create voiceprints and we do not clone voices. Nian's family-voice feature is recorded playback only. When a family member records a message, we store that audio file and play that exact recording back at reminder time. We do not train a synthetic voice model on it. We do not extract or store a voiceprint, speaker embedding, voice signature, or any other biometric template derived from a person's voice. We do not make a person's voice say words that person never actually recorded. Voice cloning is disabled at the configuration level and our production server refuses to start if the cloning flag is switched on.

4.2 We do not sell or "share" your personal information, as those terms are defined by the California Consumer Privacy Act as amended by the CPRA (and comparable state statutes). We have never done so.

4.3 We do not run advertising, ad networks, or third-party analytics SDKs.

4.4 We do not request location permission.

4.5 We do not use your data to train third-party AI models. We do not submit your recordings, transcripts, medication data, or adherence logs to any provider for the purpose of training that provider's models.

5. How We Use Your Information

We use the information described in section 3 to: create, schedule, and deliver the reminders you configure; convert what you say into text so a reminder can be created or a dose logged; record whether a dose was marked taken and show that to you and the family members you have authorized; notify a designated family member when a reminder goes unanswered, if you have turned that on; play back the family voice recordings you have saved; authenticate you, secure the Service, prevent fraud and abuse, and troubleshoot errors; process and validate subscription purchases; send you service communications; and comply with law and enforce our Terms of Service.

We do not use your medication data, adherence data, transcripts, or voice recordings for advertising, profiling for marketing, or sale.

6. Nian Is Not a Medical Device and Does Not Give Medical Advice

Nian provides medication reminders and logging. It does not diagnose, treat, cure, or prevent any disease; it does not recommend dosages; it does not evaluate drug interactions; and it does not interpret your health status. A dose marked "taken" in Nian is a self-report captured by automated speech recognition, not a clinically verified record. See the Terms of Service for the full disclaimer. Always consult a licensed healthcare professional about your medications.

7. Health-Related Information: What Law Applies

HIPAA does not apply to Nian. HIPAA regulates covered entities (health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically in connection with covered transactions) and their business associates. Nian is an independent direct-to-consumer app and is not hired by, contracted with, or acting on behalf of any hospital, clinic, pharmacy, insurer, or other covered entity. This means your medication data in Nian does not carry HIPAA protections — it carries the protections described in this Policy and the protections U.S. consumer privacy law gives it.

Other law does apply, in particular: the FTC Health Breach Notification Rule (16 C.F.R. Part 318), which applies to consumer health apps not covered by HIPAA; Washington's My Health My Data Act, Nevada SB 370, and comparable state consumer health data laws, which treat medication and health-status data as a protected category with its own consent, disclosure, and deletion rules; and California's CCPA/CPRA, which classifies health information as sensitive personal information (see section 8 for your rights).

8. Third Parties Who Receive Data

We use a small number of service providers, each receiving only what it needs to perform its function. Every provider named below acts as our service provider (a "processor" acting on our behalf), under terms that permit it to use the data only to perform that service for us. None of them is a "third party" to whom we sell or share personal information as those terms are defined by the CCPA/CPRA. None of them is a data broker, none may use your data for its own marketing, and none may use your data to train its own models.

Speech recognition (converting what you say into text): the short audio clip you spoke is sent to one of Groq, Inc. (Groq) or OpenAI, L.L.C. (OpenAI). Which one handles a given clip is selected automatically; see section 9 for what that means for where the audio is processed.

Text-to-speech (speaking a reminder aloud): the text of the reminder to be spoken is sent to Microsoft Corporation (Microsoft Edge TTS). This is on by default. The text sent is the reminder content you wrote — for a medication reminder, that includes the medication name.

Language model (parsing free-form text into a structured reminder): disabled by default in our production configuration — reminder text is parsed by a local rules engine running on our own servers, and no reminder text is sent to any language model provider. If we turn a language model on, the provider will be Groq or a model we host ourselves, and we will update this Policy and this list before doing so.

Google Play Billing: purchase token and subscription state.
Google Sign-In: your Google ID token, if you choose that sign-in method.
Email delivery provider Resend: recipient email address and message body.
Cloud hosting provider Amazon Web Services, Inc. (AWS), United States region: all data at rest and in transit on our infrastructure.

We may also disclose information to comply with law or a lawful government request, to protect the rights, safety, or property of Nian or our users, or in connection with a merger, acquisition, or sale of assets, with notice given before your information becomes subject to a different privacy policy.

9. Where Your Data Is Stored and Processed

Nian's production servers for the U.S. market are located in the United States. Your account data, medication data, adherence logs, and voice recordings are stored on that infrastructure.

Some of the service providers listed in section 8 process a limited slice of your data outside the United States. Specifically: the speech recognition providers may process the audio clip you spoke on infrastructure outside the United States, and Alibaba Cloud (Qwen), one of the three speech recognition providers, is a mainland China entity whose processing may take place in mainland China. We disclose this explicitly rather than leave it to a general statement about "providers and their regions". Where cross-border processing happens, it is limited to the specific processing described in section 8: the clip is sent to be converted into text and is not used for any other purpose.

10. How Long We Keep Your Information

Account information: for as long as your account exists.
Medication configurations: until you delete the medication, or delete your account.
Adherence logs: until you delete your account.
One-off reminders marked auto-delete: shortly after the reminder time passes.
Family voice recordings: until you delete the recording, withdraw consent, or delete your account.
Voice command audio: not retained by us at all. The clip is held in memory only for the seconds it takes to send it for recognition, and is never written to our disks or databases. The speech recognition provider that receives it retains it under its own terms; see section 8 for who those providers are.
Server logs: rotated automatically, capped at roughly 30 MB per service (three 10 MB files). Older entries are overwritten as new ones arrive; we do not archive them anywhere else.

When you withdraw consent for a voice recording, we delete the recording, the consent audio, and any associated artifacts.

11. Your Rights and Choices

Depending on where you live, you may have the right to: know / access what personal information we have collected about you; obtain a portable copy of your data; correct inaccurate personal information; delete your personal information; limit the use and disclosure of sensitive personal information (your health-related and voice data); opt out of sale or sharing (we do not sell or share, so there is nothing to opt out of, but the right exists); and not be discriminated against for exercising any of these rights.

These rights are provided under the California Consumer Privacy Act as amended by the CPRA, and under comparable laws in Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states. We extend them to all U.S. users regardless of state.

In the app: each medication, reminder, family voice recording, and family group you created can be deleted individually from the screen where you manage it. Withdrawing consent for a voice recording deletes that recording, the consent audio, and any associated artifacts.

To export a copy of your data, or to delete your entire account and everything associated with it, write to [email protected] or submit a request at https://mind.jinlab.com/delete-account. We will verify your identity before acting on a request and respond within the time limits applicable state law requires. You may use an authorized agent. If we deny your request, you may appeal by writing to [email protected].

Deletion without the app installed: you can request deletion of your account and associated data at any time, whether or not the app is still installed on your device, at https://mind.jinlab.com/delete-account.

12. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. We do not offer child-directed features, we do not use child-directed advertising (we have no advertising at all), and we do not knowingly permit a child under 13 to create an account.

If you believe a child under 13 has provided us personal information, contact [email protected] and we will delete it.

13. Security

We protect your information with encryption in transit (TLS), password hashing with bcrypt, access controls on our infrastructure, and restricted internal access on a need-to-know basis.

No system is perfectly secure, and we do not claim otherwise. If a breach affecting your personal information occurs, we will notify you and the appropriate authorities as required by applicable state breach-notification law and, where applicable, the FTC Health Breach Notification Rule.

14. Changes to This Policy

If we make a material change — in particular any change to section 4 (what we do not do), section 8 (third parties), or section 9 (where data is stored) — we will notify you in the app and by email before the change takes effect, and update the "Last Updated" date above. Continued use after the effective date constitutes acceptance of the updated Policy, except where applicable law requires your affirmative opt-in, in which case we will ask for it.

15. Contact Us

Privacy: [email protected]
Postal: Xiaoning Jin, 陕西省西安市莲湖区枣园丰盛园7号楼, China
Data deletion (including after uninstall): https://mind.jinlab.com/delete-account

California residents may also contact us using the methods above to exercise CCPA rights.