Effective date: 7 July 2026
Your data never leaves your phone. DPS Tracker doesn't have a server, doesn't ask you to make an account, and doesn't send any of your information anywhere. Everything it stores stays on your device, protected by your phone's built-in encryption. The one optional exception is the HSE drug-price lookup below, which sends a drug code and nothing else.
To help you track the Drugs Payment Scheme (DPS) cap, prepare a MED1 tax relief claim, and fill in Med 2 dental forms, DPS Tracker stores the following on your device only:
Your profile details and the amounts and dates read from receipts live in an encrypted (SQLCipher) database on your phone. The encryption key is held in your device's secure enclave or keystore — the same secure hardware your phone uses to protect things like your lock screen passcode. Receipt photos are kept in the app's private storage on your device, which iOS and Android encrypt at rest and which no other app can read. DPS Tracker does not have its own server to store a copy of anything.
DPS Tracker is built so that none of the following can happen, because there is nothing on the other end to receive it:
On a receipt's "HSE value of drugs" tab you can choose to look up what the HSE pays for a drug. This is off until you tick a box agreeing to it. When you tap Look up, DPS Tracker sends only the drug codes you typed (up to five) to the HSE's public reimbursable-items list at www.sspcrs.ie/druglist/pub and reads back each drug's name and HSE price, which it then stores on your phone with the receipt. No name, PPSN, address, receipt photo or any other information is sent. This is the only part of DPS Tracker that uses the internet; everything else works offline.
When DPS Tracker reads amounts and dates off a photographed receipt, it uses Google's ML Kit running entirely on your device. The photo is processed locally and is never uploaded anywhere for this to work.
If you turn on app lock, DPS Tracker asks your phone's operating system to check your fingerprint, face, or passcode before letting you in. DPS Tracker never sees, receives, or stores your biometric data — that's handled entirely by your device's OS, outside the app.
DPS Tracker lets you export or share the forms and PDFs it generates — for example, emailing a signed Med 2 form to your dentist, or sending a summary to yourself. This only happens when you actively choose to share something, using your phone's normal share screen. DPS Tracker does not do this automatically or on your behalf.
Uninstalling the app deletes everything DPS Tracker stored, immediately and completely. Because nothing is stored anywhere else, there is no separate copy to ask us to delete.
DPS Tracker is not directed at children and is not designed for use by children. It is intended for adults managing health-scheme paperwork for themselves and their household.
If this policy changes, the updated version will be posted at this same page with a new effective date. Since DPS Tracker never phones home, it can't notify you in-app — please check back here if you'd like to review it.
DPS Tracker is developed in Ireland. If you have questions about this policy or how DPS Tracker handles data, get in touch:
Because DPS Tracker never transmits or receives your health data — it stays on your device and the developer never processes it — the developer is not acting as a data controller for that data under GDPR. That said, you always have the right to contact us with questions or concerns about your data and how DPS Tracker is built.