Privacy Policy

1. Controller

The controller responsible for processing is Aralel GmbH, Aachen, Germany ("Aralel", "we").

2. Data we process

• Account data: name, email address, your Google account identifier if you sign in with Google, and your language and calendar preferences. We do not use passwords: you sign in with a one-time link emailed to you or with Google.
• Family and health data you enter: family members, relationships, medical documents, vitals and measurements, tasks, and doctors. This is special-category data under Art. 9 GDPR.
• Technical data: IP address, device and browser type, and log entries needed to operate and secure the service.

3. Why we process it and on what legal basis

• To provide the service you asked for (Art. 6(1)(b) GDPR).
• To store and analyse your health data, based on your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time by deleting the data or your account.
• To keep the service secure and prevent abuse (Art. 6(1)(f) GDPR).

4. Who can see your data

Only you can see your records by default. You decide which documents are shared with which family member or doctor in the Sharing page, and you can revoke access whenever you like. We do not sell your data and do not use it for advertising.

5. AI document analysis

When you upload a medical document, its content may be sent for automated analysis to extract values such as lab results. Depending on how the service is configured, this is done by a self-hosted model or by a processor engaged under a data processing agreement. Analysis results are suggestions for you to review; they are not medical advice.

6. Processors and transfers

We use hosting, email delivery and, if you choose it, Google Sign-In. Processors act only on our instructions. Where data leaves the European Economic Area, we rely on adequacy decisions or standard contractual clauses.

7. Retention

We keep your data while your account exists. When you delete a record it is removed from active systems; deleting your account removes your profile and the data you own. Backups are overwritten on their regular cycle. You can delete your account in the app (Settings) or without the app at https://app.ehsana.com/delete-account: enter your email address, then open the confirmation link we send you.

8. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object to processing, and to withdraw consent at any time. You may also lodge a complaint with a data protection authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

9. Security

Data is transmitted over TLS and access is protected by authenticated sessions. No system is perfectly secure; please keep your email account and devices secure, since access to your mailbox lets you sign in.

10. Cookies and local storage

We use only what is needed to keep you signed in and remember your language. We do not use advertising or cross-site tracking cookies.

11. Changes

If we change this policy in a meaningful way we will tell you in the app before it takes effect.