Privacy Policy

Aimedis Care Pro is a personal health record. This policy explains what personal data we process when you use it, why we process it, who we share it with and what rights you have. It applies to the web and mobile application and to the account you register with us.

1. Who is responsible for your data

The data controller responsible for the processing described in this policy is Aimedis LLC, 16192 Coastal Highway, Lewes, Delaware 19958, USA, email contact@aimedis.com. Further company details are published on our Imprint page.

• Data protection officer: [TO BE COMPLETED: data protection officer]
• Representative in the European Union (Art. 27 GDPR): [TO BE COMPLETED: EU representative under Art. 27 GDPR]

2. Categories of data we process

• Account data: name, email address, authentication credentials, language and locale preference.
• Health records you enter: vitals, diagnoses, conditions, medications, laboratory results, radiology reports and uploaded documents.
• Wearable data: readings you choose to sync from a connected device or provider, such as Withings, Oura, Whoop or Apple Health.
• AVA conversation content: the text or voice questions you ask our AI assistant and the responses it gives you.
• Technical and session data: strictly necessary cookies (see section 8), and security logs such as sign-in timestamps and IP address.

3. Why we process your data

• To provide, operate and maintain your health record and its features.
• To power AVA so it can answer questions about the records you have entered.
• To let you share a scoped view of your record with a doctor or caregiver, on your instruction.
• To keep your account and our service secure, and to detect and prevent misuse.
• To comply with legal obligations that apply to us.

4. Legal basis for processing

We rely on your consent (Art. 6(1)(a) GDPR) and, for the parts of the service you actively request, on the performance of our contract with you (Art. 6(1)(b) GDPR). Because health records are a special category of personal data, we process them only on the basis of your explicit, freely given consent (Art. 9(2)(a) GDPR), which you give when you create an account and each time you choose to add a record, connect a wearable, or start a conversation with AVA.

5. Where your data is hosted

Your data is hosted by the infrastructure providers listed in section 6; where they are located outside the European Economic Area, section 7 applies. Data at rest and in transit is encrypted. Only you, the people you share your record with through a sharing PIN or your emergency card, and the providers listed in section 6, each for the service it provides, can reach your health records; row-level security at the database layer keeps other accounts out of them.

6. Who we share data with

We do not sell your data. The following providers process data to operate the features you request:

• Supabase: database, authentication and file storage.
• Anthropic: processes the text you send to AVA and the record context needed for the conversations and dashboard insights you request, every health-diary entry you save (each is analyzed automatically to keep your diary overview current), diary drafts you submit for writing assistance, diary summaries, and documents you submit for AI extraction.
• ElevenLabs: converts AVA's replies to speech and transcribes your voice when you dictate to AVA or into your health diary.
• Voyage AI: generates the text embeddings that power search and retrieval for AVA; for general health questions it receives only a general topic derived from your question, never your record.
• U.S. National Library of Medicine (PubMed): receives only a general medical topic derived from your question, without personal details, so AVA can find published research summaries.
• Wearable providers you connect: only the provider or providers you explicitly authorize, and only to import the readings you approve.
• Hosting provider ([TO BE COMPLETED: hosting provider]): runs the servers of the application; everything you send to the application and receive from it passes through them.
• Resend: delivers the emails we send you: account emails such as the confirmation of your sign-up, password resets and security notices, and, if you turn them on, reminder and alert emails. It receives your email address and the content of each email.
• The push service of your browser's vendor (for example Google, Apple or Mozilla): if you turn on notifications on a device, they reach it through this service. It receives each notification in encrypted form, together with the device's push address and the time; it cannot read the content. We store the device's push address and encryption keys and the browser's identification (user agent) until you turn notifications off on that device, or until the push service reports that the address no longer exists or deliveries to it keep failing.
• Open Food Facts: receives the name of a food you search for in Nutrition, sent from our server without your name or record, to look up its nutrition values.
• Aimedis Wiki (wiki.aimedis.com, operated by Aimedis): for AVA's reference answers it receives only a general question or topic derived from your question, never your record.

7. International transfers

Where a processor is located outside the European Economic Area, we rely on an adequacy decision or on Standard Contractual Clauses to ensure your data remains protected to an equivalent standard.

8. Cookies and tracking

We do not use advertising, analytics or other tracking cookies. We only set strictly necessary cookies: the session cookie that keeps you signed in, a cookie that remembers the language you chose, security cookies for features you use (for example the app lock and connecting a wearable), and, when you sign in, a cookie that stores your device's time zone so that dates and times appear in your local time. That is why this site does not show a cookie consent banner: strictly necessary cookies are exempt from that requirement under EU law.

9. How long we keep your data

We keep your data for as long as your account is active. When you delete your account, your data is deleted from our systems, other than information we are required to retain to meet a legal obligation.

10. Your rights

You have the right, at any time, to:

• Access the personal data we hold about you and export it yourself at any time using the Export tool in your account settings.
• Correct inaccurate or incomplete data directly within the application.
• Erase your account and all associated data using the Delete account tool in your settings.
• Restrict or object to certain processing.
• Receive your data in a portable, machine readable format.
• Withdraw your consent at any time, without affecting the lawfulness of processing carried out before your withdrawal.

You also have the right to lodge a complaint with your local data protection supervisory authority.

11. Automated decisions

AVA provides informational insights only. It does not make automated decisions that produce legal or similarly significant effects about you.

12. Changes to this policy

We may update this policy as the service evolves. Material changes will be communicated through the application before they take effect.

13. Contact us

Questions about this policy or your data can be sent to contact@aimedis.com. Our other contact details are on our Imprint page.