Privacy policy.

What stays on your device

The App has no user accounts. What you log or save in the App — meals and their photos, lab results you scan, your goals and settings — is stored only on your device. Deleting the App deletes it. Data the App writes to Apple Health (meals, nutrients, weight) stays in Apple Health, where you can view and delete it.

Apple Health (HealthKit)

The App reads and writes Apple Health data — such as sleep, heart rate, HRV, activity, weight and nutrition — only with the permission you grant in iOS, and you can change that permission at any time in the Health app.

• No sale of data. We never sell, rent or share your health data for advertising or marketing, or with data brokers.
• Only for the App. Health data is used only to provide the App's features.

AI analysis (Google Gemini)

The App's AI features — meal analysis from photos and descriptions, the daily and weekly reports, and lab result analysis — use Gemini, an AI service from Google. They only run if you allow AI analysis in the App. You can withdraw that at any time under Health Center → AI analysis.

When they run, the following is sent encrypted to our server in the EU (Google Cloud, Belgium), which passes it to Google for processing:

• Photos and descriptions of meals you log.
• Health data from Apple Health: sleep, heart rate, HRV, breathing, activity, workouts, weight, height and body measurements, blood pressure, blood glucose, oxygen saturation, wrist temperature and ECG classification, together with your age, your sex and whether you use a wheelchair.
• What you have saved in the App: your health goal, your calorie and weight goals, what you have eaten and the values from lab results you have scanned.
• Photos and documents of lab results you choose to scan.

We process this on the basis of your explicit consent (GDPR Article 9(2)(a)). If what the App sends changes materially, the App asks for your consent again. Our server does not store the content. Google processes it to produce the analysis under its terms for the paid Gemini API, which do not allow it to be used to train Google's models, and may process it outside the EU/EEA under the EU Standard Contractual Clauses. We never sell this data or use it for advertising.

Crash reports

The App uses Firebase Crashlytics, a service from Google, to receive reports when the App crashes. A report contains technical information: the device model, iOS version, App version, the state of the App at the time of the crash and a random installation identifier. It does not contain your health data, meals or lab results. We use crash reports to find and fix errors, on the basis of our legitimate interest in a working App (GDPR Article 6(1)(f)). Google may process them outside the EU/EEA under the EU Standard Contractual Clauses. Crash reports are kept for 90 days.

Technical logs and security

Our server keeps technical logs for 30 days to operate and protect the service. They contain request times, error messages and IP addresses, never the content of your health data, meals or lab results. The App proves it is a genuine copy of Ork to our server using Apple's App Attest (Firebase App Check), which sends no health data. All communication between the App and our server is encrypted (HTTPS).

Your rights

Under the GDPR you have the right to access, correct and delete your personal data, to restrict or object to its processing, to data portability, and to withdraw your consent at any time without affecting processing that took place before. Because the App has no accounts and stores your data on your device, most of these rights you can exercise directly in the App, in Apple Health or by deleting the App. For anything else, contact us at the address below. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, www.imy.se).

Changes to this policy

We may update this policy. We will tell you about significant changes in the App before they take effect, and changes to what is sent for AI analysis ask for your consent again.

Contact us

Questions about this privacy policy, or about how we handle your data? Reach us at support@kynne.se.