Privacy Policy

Aimedis Care Pro is a personal health record. This policy explains what personal data we process when you use it, why we process it, who we share it with and what rights you have. It applies to the web and mobile application and to the account you register with us.

1. Who is responsible for your data

The data controller responsible for the processing described in this policy is Aimedis [TO BE COMPLETED: full registered legal entity name]. Our registered address, commercial register details and contact information are published on our Imprint page.

2. Categories of data we process

• Account data: name, email address, authentication credentials, language and locale preference.
• Health records you enter: vitals, diagnoses, conditions, medications, laboratory results, radiology reports and uploaded documents.
• Wearable data: readings you choose to sync from a connected device or provider, such as Withings, Oura, Whoop or Apple Health.
• AVA conversation content: the text or voice questions you ask our AI assistant and the responses it gives you.
• Technical and session data: the strictly necessary session cookie that keeps you signed in, and security logs such as sign-in timestamps and IP address.

3. Why we process your data

• To provide, operate and maintain your health record and its features.
• To power AVA so it can answer questions about the records you have entered.
• To let you share a scoped view of your record with a doctor or caregiver, on your instruction.
• To keep your account and our service secure, and to detect and prevent misuse.
• To comply with legal obligations that apply to us.

4. Legal basis for processing

We rely on your consent (Art. 6(1)(a) GDPR) and, for the parts of the service you actively request, on the performance of our contract with you (Art. 6(1)(b) GDPR). Because health records are a special category of personal data, we process them only on the basis of your explicit, freely given consent (Art. 9(2)(a) GDPR), which you give when you create an account and each time you choose to add a record, connect a wearable, or start a conversation with AVA.

5. Where your data is hosted

Your data is hosted on infrastructure located in the European Union. Data at rest and in transit is encrypted, and access to your health records is restricted to you by row-level security enforced at the database layer.

6. Who we share data with

We do not sell your data. We use a small number of processors, each bound by a data processing agreement, strictly to operate the service:

• Supabase: database, authentication and file storage.
• Anthropic: processes the text you send to AVA, your health-diary entries submitted for analysis, and the record context needed to generate the AI insights and summaries you request.
• ElevenLabs: converts AVA's replies to speech when voice mode is enabled.
• Voyage AI: generates the text embeddings that power search and retrieval for AVA; it receives the query text needed for that lookup.
• Wearable providers you connect: only the provider or providers you explicitly authorize, and only to import the readings you approve.

7. International transfers

Where a processor is located outside the European Economic Area, we rely on an adequacy decision or on Standard Contractual Clauses to ensure your data remains protected to an equivalent standard.

8. Cookies and tracking

We do not use advertising, analytics or other tracking cookies. The only cookie we set is a strictly necessary session cookie that keeps you signed in, which is why this site does not show a cookie consent banner: strictly necessary cookies are exempt from that requirement under EU law.

9. How long we keep your data

We keep your data for as long as your account is active. When you delete your account, your data is deleted from our systems, other than information we are required to retain to meet a legal obligation.

10. Your rights

You have the right, at any time, to:

• Access the personal data we hold about you and export it yourself at any time using the Export tool in your account settings.
• Correct inaccurate or incomplete data directly within the application.
• Erase your account and all associated data using the Delete account tool in your settings.
• Restrict or object to certain processing.
• Receive your data in a portable, machine readable format.
• Withdraw your consent at any time, without affecting the lawfulness of processing carried out before your withdrawal.

You also have the right to lodge a complaint with your local data protection supervisory authority.

11. Automated decisions

AVA provides informational insights only. It does not make automated decisions that produce legal or similarly significant effects about you.

12. Changes to this policy

We may update this policy as the service evolves. Material changes will be communicated through the application before they take effect.

13. Contact us

Questions about this policy or your data can be sent to us using the contact details on our Imprint page.