Proteneo is a local-first app. Information you enter (treatment items and administration records, completed lab draws, schedules, reminder records, workouts, nutrition, weight, and wellness check-ins) stays in encrypted storage on your phone. There is no Proteneo account or sign-in, and no Proteneo/MFS-managed health-data server or sync. Android cloud Auto Backup is disabled. Some Android 12+ manufacturer device-to-device flows may still move app files despite that setting; Proteneo does not support or promise that as recovery. iOS backup or device transfer may separately preserve app data according to platform behavior and your settings, but Proteneo does not promise that it will restore a readable record.
We do not sell your data or use advertising trackers. The routine app path makes no network call carrying your health or wellness records. This does not cover a separate email or attachment someone deliberately sends to a published support/privacy address.
Subscriptions: Proteneo is sold by subscription, billed by the Apple App Store or Google Play. The store takes your payment; Proteneo never receives your card or other payment details. RevenueCat, Inc. manages subscriptions for us. RevenueCat may process an anonymous App User ID; purchase, subscription, product, entitlement, transaction-history, and status information; an Apple receipt file or Google purchase token; last-seen or activity timing; device type and operating system; locale and currency; and network/IP metadata. RevenueCat uses this billing information to operate purchases and subscriptions and for its provider dashboard and analytics. Proteneo sends RevenueCat no health or wellness record and uses no custom RevenueCat login or customer-attribute API, and we use no outbound RevenueCat analytics integration. See revenuecat.com/privacy.
Proteneo keeps a few billing facts on your phone: whether it has seen an active free trial or subscription and the end date the store last reported, which decide whether a new dated entry can be logged while the store cannot be reached, and whether the app has shown its notes about the latest purchase, free trial, or ended subscription. These billing facts stay outside your records: backups do not include them, and restore and Clear all data leave them in place.
When you visit proteneo.com, the browser and our hosting provider, Google Firebase Hosting, process ordinary request information such as IP address, browser or user-agent details, requested pages, timestamps, referring page, and security or diagnostic logs to deliver and protect the site. We do not use the site for advertising tracking. The report reader reads a report you deliberately select inside your browser and does not upload the report contents to us, although loading the reader is still an ordinary website request.
If you email support@multifactorsolutions.net or privacy@multifactorsolutions.net, the email systems used by you and us process the sender name and address, message, ordinary email-routing headers, and any attachment or other information you choose to include. We use that communication to respond, route the request, investigate the reported issue, and keep the operational record needed to handle it. Do not email a report, backup, screenshot, or other health or wellness content unless it is necessary and you intend to send it.
Proteneo is a consumer wellness tracker, not a clinical tool. It is not operated through the app by a healthcare provider. The routine in-app path sends no health or wellness record to MultiFactor Solutions. A separate support/privacy email or attachment you deliberately send is handled as described above. We do not operate Proteneo as a HIPAA Covered Entity or Business Associate. Your data remains protected by this policy and applicable consumer-privacy laws.
What the app handles locally: treatment items and administration records; completed lab draws; schedules and reminder records; fitness, nutrition, weight, and wellness records; a Weight calculation profile with sex, age, height, and activity level if you choose to use calculated targets; preferences like theme and units; and the billing information and billing facts described above. In this version the app requests no account, camera, location, contacts, microphone, notification, HealthKit, Health Connect, or Google Fit permission and provides no dedicated government-ID or financial-account field. Free text can still contain whatever you write in it.
How it's stored: entered data is held in an encrypted local store. A random app-storage key in your phone's secure keychain protects against off-device file copying, not someone using an unlocked phone, so use a passcode or biometric lock. Before opening an existing MMKV data or CRC artifact, Proteneo requires a valid secure key and encryption marker plus a non-secret SHA-256 identifier beside the MMKV files that matches that exact key. A missing, malformed, pre-identifier, or mismatched state stops before the native store opens; Proteneo does not wipe, replace, or re-key the preserved store. On a fresh install, Proteneo verifies by readback that the key, marker, and file-side identifier were stored before opening the new store. Android cloud Auto Backup is disabled. Some Android 12+ manufacturer device-to-device flows may still move app files despite that setting; Proteneo does not support or promise that as recovery. iOS backup/transfer behavior is platform-controlled and not a promised recovery method.
File custody: generated PDF and interactive HTML reports are plaintext files outside the encrypted record store. Proteneo keeps them in app-owned document storage so you can reopen or delete them in Past exports. Each completed generation uses a collision-safe unique filename, including for multiple reports in the same format on the same day, and does not overwrite an existing retained report while creating the new one. Proteneo verifies the exact PDF or HTML contents before sharing and before cleaning up its source or temporary copy. It attempts to keep the 10 most recent report files, but cleanup, migration, or filesystem failures can leave more; 10 is a target, not a guarantee. A materialization failure never overwrites or deletes an earlier retained report. Cap pruning can remove calculated oldest excess reports before a later failure; unverified pruning or cleanup is reported rather than presented as complete.
A JSON backup is also plaintext outside the encrypted record store. It is a portable subset, not a copy of every app or device record. It includes portable local records and preferences. It excludes per-install legal acceptance and guided-setup state, device-bound cache/connection and recovery state, the billing facts described above, stored report files, and App Store, Google Play, or RevenueCat records. The on-device encryption does not follow report or backup files.
Your choices: prepare and share a PDF or interactive HTML report; create or restore a portable backup; use the available add, edit, replace, and delete controls for local records; clear local data; or uninstall. A settings-, filter-, view-, navigation-, or display-only file cannot authorize record replacement; at least one valid record-bearing section is required. A successfully completed restore is a full replacement of the portable record subset, not a merge. It does not replace per-install/provider state or delete retained Past exports, a backup, or a recipient copy. Clear all data first performs the bounded Proteneo-owned temporary-file and app-retained report cleanup. If a cleanup step reports a problem, app records remain in place; a file removed before that failure remains removed. Only after those cleanup steps report success does the app start its journaled clear of the clearable Proteneo record. Files or recipient copies stored elsewhere remain outside that action. Uninstall is controlled by the platform and does not run Proteneo's in-app cleanup. Its exact effect on app storage is not promised. Neither action cancels a store subscription or itself deletes store or RevenueCat billing records. Contact privacy@multifactorsolutions.net for a request concerning billing-provider customer information. Settings shows the exact anonymous Billing support ID RevenueCat uses to locate the record; include it with the request. Deleting a RevenueCat record does not itself cancel an Apple/Google subscription. Later app, receipt, or Restore activity may create or reassociate a RevenueCat record.
Planned, not live: we may later add optional cloud sync for a newly specified and consented subset of eligible data. We will update this policy and ask for fresh consent before enabling any cloud feature.
Questions or data requests: privacy@multifactorsolutions.net
MultiFactor Solutions, LLC · 7310 Menchaca Rd, #150091, Austin, TX 78715