Your health record should show where the data goes.

1. Scope and contact

This policy applies to the Akros iPhone app and akros.life. Akros controls the personal data described here. For access, correction, deletion, or privacy questions, use the Akros support form. Do not include a lab report or other health data in the initial request.

2. Data Akros handles

3. How Akros uses data

• Display source-labeled health trends and use permitted evidence in the on-device Week Rescue decision flow.
• Normalize a lab report you intentionally select.
• Produce a bounded weekly briefing and show when the data is incomplete.
• Use profile sex and goals to provide relevant plan, progress, and bodyweight context.
• Verify, restore, expire, or revoke subscription access.
• Provide export, account recovery, deletion, support, fraud prevention, and service security.

Akros does not sell personal data, serve behavioral advertising, use health data to determine credit or insurance eligibility, or make your data public. Akros does not use your data to train a public foundation model. OpenAI does not use API inputs or outputs to train its models unless its customer explicitly opts in, as described below.

4. Lab PDFs and OpenAI processing

A lab PDF is not sent off your device until Akros shows the processing disclosure and you choose to continue.

The complete selected PDF passes through Akros's API on Amazon Web Services (AWS), is held temporarily in a private encrypted Amazon S3 bucket, and is sent from an AWS Lambda function to OpenAI's Responses API to extract marker names, values, units, and reference ranges. Akros sets store: false. OpenAI states that this creates no application-state retention for the response, but its default abuse-monitoring logs may still include customer content and be retained for up to 30 days. OpenAI does not use API inputs or outputs to train its models unless the customer explicitly opts in. Akros does not claim that this account has OpenAI zero-data-retention controls.

Akros deletes the raw PDF after a successful or failed extraction when immediate cleanup succeeds. If an upload is abandoned before processing or immediate cleanup fails, an automatic storage-lifecycle rule provides a one-day expiration backstop. Akros keeps normalized values, provenance, a document fingerprint, and an audit record so you can understand the source and avoid duplicate processing. Apple Health data is not sent to the document processor as part of this flow.

Automated extraction can be wrong. Compare normalized values and units with the original report. Akros does not diagnose or recommend treatment from a lab result.

5. Service providers and international processing

These providers process data for the function listed above. Akros remains responsible for the instructions it gives them and for honoring this policy. Provider terms or applicable law may permit the limited security, abuse-prevention, or legal retention described here.

Akros operates from Australia and uses cloud infrastructure in Australia and other countries. Data may therefore be processed outside your country, where privacy laws and regulatory regimes may differ. The provider and legal terms that govern a transfer depend on the active service, account plan, processing location, and applicable law.

6. Retention and deletion

7. Your choices and rights

In Akros, open Settings, then Data processing & consent, choose a processing scope, and select Withdraw consent to block future weekly aggregate uploads or PDF uploads for that scope. Withdrawal does not delete data already stored; use Delete my account to start deletion. You can separately deny or revoke each Apple Health category in the Health app. Revoking Health access prevents future reads but does not delete an on-device bodyweight mirror or server aggregate that was already created.

You can also decline PDF processing, restore or manage a subscription through Apple, request an export in Akros Settings, correct profile details, or start account deletion. Depending on where you live, you may have rights to access, correct, erase, restrict, object, or receive a portable copy of personal data.

Use the Akros support form if the in-app controls do not resolve your request. Akros may need to verify that you control the account before disclosing or deleting data.

8. Security

Akros uses encrypted transport, private encrypted object storage, scoped cloud permissions, signed authentication tokens, verified Apple transaction data, and deletion backstops. No system can guarantee absolute security. Report a suspected security issue through the Akros support form without including health data in the first message.

9. Children

Akros is not directed to children under 13. If local law requires parental consent for a minor to use a health service, do not use Akros without that consent. Use the Akros support form if you believe a child provided personal data without appropriate permission.

10. Changes

Akros may update this policy as the product or law changes. The effective date will change when a revision is published. A material change will be described in the app or by another reasonable notice before it takes effect where required.