Privacy Policy

1. Who we are

“Akoma” is a trading name used by a UK-based operator to publish the Akoma iOS app and the akomahealthcare.com website. Akoma is not Akoma Labs Ltd and is not, at the time of writing, a registered company under that name. The operator is the “data controller” for personal data collected through Akoma and can be contacted at hello@akomahealthcare.com. The operator’s full identifying details (legal name and correspondence address) are available on written request to that address.

For UK/EU users, this policy is our statement under the UK GDPR and the EU GDPR. For California users, it doubles as our CCPA/CPRA notice.

2. What we collect and why

2.1 Account data

• Sign-in identifier (an opaque token from Sign in with Apple or Sign in with Google) — to recognise you across devices.
• Email address, when you choose to share it with us (not hidden via Apple’s private relay) — to email you about your account or reply to support requests.
• Account creation date and device type — for basic product analytics.

Legal basis (UK/EU GDPR Art. 6(1)(b)): performance of the contract you entered into when you signed up.

2.2 Logs you create

• Meals (name, macros, photo reference, barcode, meal kind, timestamp).
• Shots (drug, dose, site, timestamp).
• Water, weight, moods, side-effect entries.
• Reminders you configure.
• Subscription and purchase state (from RevenueCat).

We treat these as special-category health data under UK/EU GDPR, even when they’re not strictly diagnostic, because you have a reasonable expectation of strong protection.

Legal basis: your explicit consent (Art. 9(2)(a)), which you give when you complete the onboarding medical disclaimer. You can withdraw consent at any time by deleting your account.

2.3 AI meal recognition

When you take a meal photo, Akoma sends a resized copy over TLS to an authenticated Supabase Edge Function. The function uses OpenRouter to route the request to configured AI model providers. Every Akoma request requires endpoints marked for zero data retention and disallows providers that collect prompts. The providers return an editable estimate of what’s on the plate. Akoma does not persist the original image on its servers; a local copy can remain on your device until you delete the meal or account. You can skip AI and use barcode scan, search, or manual entry.

2.4 Apple Health

Akoma can read your weight, water, and step count from Apple Health, and write water you log in Akoma back to Health. Health data never leaves your device unless you explicitly log it into Akoma. You can revoke permission in Settings → Privacy & Security → Health → Akoma at any time.

2.5 Diagnostics

• Crash reports via Sentry, scrubbed of personal data. We see the stack trace, device model, OS version, and a pseudonymous install ID — never your logs.
• Event analytics via PostHog (US project). We track actions such as “logged a meal” or “viewed paywall” against a pseudonymous account or installation identifier. We do not send meal text, medication details, symptoms, exact weights, notes or photos as analytics properties. You can disable this in Profile → Your data → Product analytics.

Legal basis: legitimate interest in keeping the app functional and improving features. You can opt out in Profile → Data → Analytics.

2.6 Apple acquisition measurement

Akoma may use Apple AdServices to understand whether an install was attributed to an Apple Search Ads campaign. This Apple-provided attribution does not include your health logs, meal photos, notes or free text. Akoma does not ship Meta or TikTok SDKs, request App Tracking Transparency permission, access the IDFA, track you across other companies’ apps or websites, or forward app events to Meta or TikTok.

2.7 Food database

When you search or scan a barcode, Akoma queries Open Food Facts and, if needed, a commercial nutrition database fallback. These requests carry no personal data — they include only the query string or barcode.

2.8 Payment

Purchases run through Apple. We never see your card number. Apple sends us a receipt via RevenueCat so we can unlock Premium on your account.

2.9 Transactional email

Emails about your account (sign-up confirmation, password reset, email-change confirmation, etc.) are delivered through Resend, our email-sending provider, using SMTP configured inside our auth backend (Supabase). Resend receives only the destination email address, the subject, and the body of each email — no other data about you.

3. Who we share with

We use the processors below under their service and data-protection terms:

We do not sell personal data, share it with data brokers, or use it to train models. We do not share it with advertisers, insurers or employers. AI requests are restricted to zero-data-retention endpoints. We will only disclose data to law enforcement if compelled by a valid legal process, and we’ll notify you unless prohibited by law.

4. Where your data lives

Primary storage is in Supabase’s Frankfurt (eu-central-1) region. AI meal recognition and purchase verification involve transfers to processors that operate partly in the US under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (SCCs).

5. How long we keep it

• Account data: while your account is active. An in-app deletion removes active account data; limited processor, billing, security or backup records may follow separate legal retention schedules.
• Health and wellness logs: while your account is active, then removed from the active database on account deletion.
• Crash reports: 90 days.
• Analytics events: 12 months, then aggregated and the raw events deleted.
• Transactional email: delivery logs kept by Resend for up to 30 days for debugging, then purged.
• Meal photos: not persisted by Akoma servers. Requests require zero-data-retention AI endpoints; the local copy disappears when you delete the meal or account on-device.

6. Your rights

Under UK/EU GDPR, CCPA/CPRA, Australian Privacy Act, and New Zealand Privacy Act, you can:

• Access your data — Profile → Data → Export gives you a JSON bundle.
• Correct your data — edit it in-app, or email us.
• Delete your data — Profile → Data → Delete Account.
• Port your data — the export is machine-readable.
• Object to processing — stop logging or close your account.
• Restrict processing — opt out of analytics; opt out of AI features (barcode and manual entry still work).
• Complain to a regulator — ICO (UK), your national DPA (EU), the California Attorney General (US), the OAIC (AU), or the OPC (NZ).

California residents can exercise the right to know, delete, and opt out of sale/sharing (though we don’t sell or share to begin with) via hello@akomahealthcare.com.

7. Children

Akoma is not directed at or intended for children under 18. If you believe a child has given us personal data, email hello@akomahealthcare.com and we will delete it.

8. Cookies and web analytics

akomahealthcare.com uses only first-party, strictly necessary cookies (session and CSRF). We do not use third-party cookies or tracking pixels. There is nothing to consent to.

9. Changes

If we change this policy in a way that affects your rights, we’ll notify you in-app at least 14 days before the change takes effect. The “Last updated” date at the top always reflects the current version.

10. Contact

All privacy enquiries, data requests, and security disclosures: hello@akomahealthcare.com. A real person reads every message.

Akoma — operating in the United Kingdom