Privacy Policy

1. Introduction

OneCareLog ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services (collectively, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this privacy policy, please do not access the service.

2. Information We Collect

2.1 Personal Information You Disclose to Us

We collect personal information that you voluntarily provide to us when you register on the Service, express an interest in obtaining information about us or our products and services, or otherwise when you contact us. This may include:

• Account Information: Name, email address, password.
• Profile Information: Names, relationships, and dates of birth for family members you add.
• Health Information: Health-related data you voluntarily provide, such as temperature readings, medication schedules, blood pressure, etc.

2.2 Information Automatically Collected

We automatically collect certain information when you visit, use, or navigate the Service. This information does not reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and other technical information. This information is primarily needed to maintain the security and operation of our Service, and for our internal analytics and reporting purposes.

2.3 AI-Powered Features and Third-Party AI (Google Gemini)

OneCareLog offers an optional AI-powered feature to help you add health data more quickly. When you upload a lab report, you can choose to have it read for you so that draft health entries are created automatically instead of typing every value by hand. This feature is entirely optional and is described in detail below.

2.3.1 The two upload paths — one uses AI, one does not

When you import health data from a file, OneCareLog gives you two distinct paths, and you choose which one to use:

• "Read by AI" (Lab Report path): When you upload a lab report as a PDF, document, or image, the file is sent to a third-party artificial-intelligence service — Google's Gemini API — which reads (transcribes) the document to extract health readings (for example, test names, values, units and dates) into draft entries. Before this happens, we ask for your explicit consent (see Section 2.3.3).
• "Parsed directly · No AI" (CSV / Excel path): When you upload a CSV or Excel (spreadsheet) file, it is parsed entirely on our own servers. This path does not use any artificial intelligence and your file is never sent to Google, Gemini, or any other third-party AI service. It requires no AI consent. If you prefer not to use AI at all, this is the privacy-preserving alternative.

2.3.2 What data is sent to the AI service

If, and only if, you choose the "Read by AI" path and grant consent, the following is sent to Google's Gemini API:

• The uploaded lab-report file itself (the document's content — the PDF, document, or image you selected) together with a fixed instruction that asks the AI only to transcribe and extract the readings, not to diagnose or interpret them.

What we do NOT add: We do not attach your name, email address, account ID, profile name, or other account identifiers to the request. Only the document and the extraction instruction are sent.

Please note — content of the document: A lab report may itself contain personal details printed on it by the laboratory (for example, a patient name or date of birth). Because the AI needs to read the document to transcribe it, the document is sent as it is, including any such details printed on it. We highlight this in the consent screen so you can decide accordingly, or choose the CSV / Excel "No AI" path instead.

2.3.3 Your consent is required before any AI processing

The "Read by AI" path is consent-gated. The first time you attempt an AI-assisted upload, you are shown a consent screen with a clear, non-pre-ticked checkbox and a link to this Privacy Policy. No file is sent to Google's Gemini API unless and until you give this explicit consent. If you do not consent, the AI feature will not run — but the CSV / Excel "No AI" path and all other app features remain fully available. You may withdraw your consent at any time; once withdrawn, further AI-assisted uploads are blocked and you will be asked to consent again before any future AI upload can proceed.

2.3.4 You review every AI result before anything is saved

The AI creates a draft only. Nothing extracted by the AI is saved to your health records automatically. You review the draft entries, make any corrections, and confirm before they are saved. Low-confidence results are flagged for your review and are never pre-selected on your behalf.

2.3.5 Third-party AI provider and how the data is handled

The AI reading feature is powered by Google LLC through the Gemini API (generativelanguage.googleapis.com). When you use the "Read by AI" path, the document you uploaded is transmitted to Google's servers to be processed and returned as extracted text. It is our design requirement that this content be used only to perform the extraction for you and not be used to train Google's AI models. Google's own handling of data submitted to its Gemini API is governed by Google's terms and policies, including the Google Gemini API Terms of Service and the Google Privacy Policy. We encourage you to review them.

2.3.6 Retention of uploaded files

Retention of the uploaded lab-report file on our systems is off by default — we do not keep the source file unless you explicitly opt in to file retention. Where a file is retained at your choice, it is treated as your personal data and is included in your data-access and deletion rights (see Sections 6 and 7).

2.3.7 Malware scanning of uploads

To protect you and other users, every file you upload is scanned for malware before it is processed. Files that fail the security scan are rejected and are not parsed or sent to any AI service.

3. How We Use Your Information

We use your information for purposes based on legitimate business interests, the fulfillment of our contract with you, compliance with our legal obligations, and/or your consent. This includes:

• To provide, operate, and maintain our Service.
• To manage your account and enable user-to-user communications (within your care circle).
• To send you administrative information, such as updates to our terms and policies.
• To respond to your inquiries and offer support.
• For data analysis, identifying usage trends, and improving our Service.

4. Will Your Information Be Shared With Anyone?

We only share information with your consent, to comply with laws, to provide you with services, to protect your rights, or to fulfill business obligations.

• Care Circle Sharing: We share your health information only with individuals you explicitly authorize through our care circle feature. You maintain full control.
• Service Providers: We may share data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work (e.g., cloud hosting).
• Third-Party AI Service (Google Gemini): If, and only if, you opt in to the "Read by AI" lab-report feature, the uploaded document is sent to Google's Gemini API to be transcribed into draft entries, as described in Section 2.3. This never happens without your explicit consent, and the "Parsed directly · No AI" CSV / Excel path is available as an alternative that involves no AI and no such transmission. We do not sell your personal or health information to anyone.
• Legal Requirements: We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process.

5. Data Security

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. We use end-to-end encryption for health data. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Service is at your own risk.

6. Your Privacy Rights

Based on the laws of some countries, you may have the right to request access to the personal information we collect from you, change that information, or delete it in some circumstances. To request to review, update, or delete your personal information, please contact us at the information provided below.

Account deletion: You can request deletion of your account from within the app. When you do, your account enters a 30-day grace period, after which your account and associated personal data are scheduled for deletion, except where a longer retention period is required or permitted by law.

AI-related data: Any health entries created from an AI-assisted upload — and any lab-report file you chose to retain (see Section 2.3.6) — are your personal data and are covered by the same access, correction, and deletion rights described here. Withdrawing AI-processing consent stops future AI uploads but does not, by itself, delete entries you already reviewed and saved; those can be edited or deleted like any other entry.

7. Data Retention

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

8. Policy for Children

We do not knowingly solicit data from or market to children under 13 years of age. By using the Service, you represent that you are at least 13 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Service. If we learn that personal information from users less than 13 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records.

9. Changes to This Privacy Policy

We may update this privacy policy from time to time. The updated version will be indicated by an updated "Last Updated" date and the updated version will be effective as soon as it is accessible. We encourage you to review this privacy policy frequently to be informed of how we are protecting your information.

10. Contact Us

If you have any questions, comments, or concerns about this Privacy Policy, please contact us using the details below: