Privacy Policy

1. Information We Collect

a) Account & Profile Information

• Name or nickname

• Email address (for authentication & OTP verification)

• Profile details such as date of birth, gender, height, weight, and activity level

• Household information (region, language, currency, timezone)

• Profile type (adult, child, elder, pet)

b) Health & Lifestyle Data

• Meal logs, nutrition intake, and food preferences

• Dietary constraints (allergens, Halal requirements, ingredient avoidance lists)

• Fitness activity logs and workout history

• Fasting sessions and habit tracking data

• Caregiving notes, check-ins, and escalation records

• Pet health logs and feeding schedules (if applicable)

• Female health data such as pregnancy status or postpartum information (if voluntarily provided)

c) Food Safety & Scanning Data

• Barcode and QR code scan results

• Nutrition label photos (sent to our AI provider to extract ingredients; not retained by Kerah after processing)

• Ingredient text input for safety evaluation

• Product submissions for missing items

d) Device & Usage Data

• Device type, operating system, and app version

• Push notification tokens (for delivering reminders and alerts)

• App interaction analytics and feature usage patterns

• Crash logs and performance diagnostics

e) Health Device Data (Optional)

• Steps, active calories, and heart rate from connected health devices (Apple Health, Google Fit)

• Sleep duration and HRV data (if device integration is enabled)

2. How We Use Your Information

We use your data to:

• Provide, personalize, and improve Kerah’s features

• Generate AI-powered meal plans, swap suggestions, and lunchbox recommendations

• Evaluate food safety — detect allergens, Halal compliance issues, and harmful additives

• Build your taste profile and personalize meal scoring

• Track fitness, fasting, and habit progress

• Manage grocery lists and pantry inventory

• Support caregiving workflows — check-ins, escalation chains, and care documents

• Send push notifications (meal reminders, care alerts, habit nudges)

• Generate weekly insights and behavioral intelligence reports

• Maintain audit trails for safety-critical actions (e.g., allergy overrides)

• Improve overall app performance, stability, and user experience

3. Data Sharing

We may share data only in these limited circumstances:

• Service providers — cloud hosting and storage, email delivery, push notifications, crash and error diagnostics, and AI processing (photo label reading and assistant features), plus app-store subscription billing — all bound by data-processing agreements

• Within your household — Household members and caregivers you invite can see shared profiles and data according to the role-based permissions you configure

• Legal obligations — If required by law, court order, or to protect user safety

4. Data Storage & Security

• Your data is stored on encrypted databases hosted on Amazon Web Services (AWS) in the EU (Frankfurt, eu-central-1) region

• All data in transit is encrypted via TLS/SSL

• Passwords are hashed using industry-standard algorithms (bcrypt)

• Authentication uses JSON Web Tokens (JWT) with secure refresh token rotation

• Role-based access control ensures household members only see data they are authorized to view

• Safety-critical actions (allergy overrides, escalations) are recorded in an immutable audit log

• We implement rate limiting, abuse detection, and brute-force protection on all endpoints

5. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access — Request a copy of the personal data we hold about you

• Correction — Update or correct inaccurate information

• Deletion — Delete your account and its data yourself from Settings, or ask us to do it

• Withdraw consent — Opt out of optional data collection (e.g., health device integration) at any time

• Complain — Raise a concern with your local data-protection authority if you believe we have handled your data wrongly

6. Children’s Privacy

Kerah supports family use, including child profiles (KID type) that are created and managed exclusively by a parent or legal guardian (the household owner). Children do not have independent accounts.

• Child profiles are used for features like lunchbox planning and school food rules

• We do not knowingly collect personal data directly from children under 13 (or the applicable age in your jurisdiction)

• All child data is controlled by the parent/guardian and can be deleted at any time through the app

• No targeted advertising is served to child profiles

7. Third-Party Services

Kerah relies on trusted third-party service providers, each bound by a data-processing agreement and governed by their own privacy policies:

• Cloud infrastructure, database hosting, and file storage

• Push notification delivery

• Error monitoring and crash diagnostics

• App-store subscription billing (Apple App Store / Google Play)

• DNS, CDN, and web security

• Optional health-device data sync via Apple Health / Google Fit (you initiate this)

• Third-party AI service provider — reads ingredient and nutrition labels from the photos you submit (processed in the United States under a data-processing agreement; not used to train AI models).

• Sign-in providers — If you choose to sign in with Google or Apple, that provider confirms your identity to us. We receive your email address and a provider identifier; we never receive your password.

8. AI-Powered Features

Kerah uses AI to enhance your experience. Our AI features include:

• Meal planning engine — Generates personalized weekly plans based on your dietary constraints, taste profile, and nutritional goals

• Food safety scanner — Evaluates ingredients for allergens, Halal compliance, and harmful additives

• Nutrition label scanning — Extracts ingredient and nutrition data from the product photos you submit using AI vision, performed by a trusted third-party AI provider that processes the image in the United States under a data-processing agreement

• AI Coach — Provides personalized guidance on nutrition, fitness, and wellness topics

• Weekly insights — Generates behavioral intelligence reports about your nutrition and activity patterns

• Care suggestions — Provides care recommendations based on check-in patterns for elder profiles

9. Health & Device Integration

If you choose to connect a health device or platform (Apple Health, Google Fit), Kerah will read the following data types to enhance your fitness and wellness tracking:

• Steps and active calories

• Heart rate and resting heart rate

• Heart rate variability (HRV)

• Sleep duration and sleep quality scores

10. Cookies & Tracking

The Kerah mobile application does not use cookies. On our website, analytics cookies are optional and load only if you accept them — if you decline, nothing is set and the site works exactly the same. We do not engage in cross-app or cross-site tracking, and we never serve targeted advertisements.

11. Data Retention

• Active accounts — Your data is retained for as long as your account is active

• Deleted accounts — When you delete your account it stops being usable immediately, and the underlying records are permanently erased within 45 days. Anonymized, aggregated data may be retained for analytics

• Audit logs — Safety-critical audit records (allergy overrides, escalation events) are retained for 12 months for compliance purposes, then deleted

• Backups — Encrypted automated backups may retain data for up to 35 days after deletion, after which the backup cycle overwrites it. We also take occasional manual snapshots before major system changes; these are kept as an operational safeguard and deleted when they are no longer needed

• Health-device data — Readings synced from a connected device are kept for up to 24 months. The original payload we receive from the provider is discarded after 90 days, keeping only the summarized values

• Notifications and AI conversations — The detail inside older, already-read notifications is redacted after 90 days, and AI coach conversations are archived after 60 days

• Care contacts — An emergency contact who declines to take part is removed after 30 days, and an invitation never answered is removed after 180 days

12. International Data Transfers

Your data is primarily stored in the European Union (AWS eu-central-1, Frankfurt). Some third-party services (e.g. Firebase) may process data in other regions. When data is transferred outside the EU, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where applicable. Photos you submit for AI label reading are processed by our AI provider in the United States under Standard Contractual Clauses.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or via email. The “Last updated” date at the top of this page reflects the most recent revision.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us: