Privacy Policy

1. Controller

The data controller is THARAN. Data contact: kontakt@tharan.tech.

2. What we process

• Account: email address, password stored as a cryptographic hash, language, creation date, record of consents given.
• Health data: whatever you enter or import. Body measurements, blood pressure, pulse, glucose, sleep, activity, food, blood test results, symptoms, medication and supplements, body photos.
• Technical: server logs needed to run and secure the service.

3. Why and on what basis

Health data is processed solely on your explicit consent given at sign-up (GDPR Art. 9(2)(a)), to keep your diary and show your statistics. Account data is processed to perform the service contract (GDPR Art. 6(1)(b)). Marketing messages are sent only with a separate, optional consent you can withdraw at any time.

4. Reading photos and PDF files

When you ask us to read a product label or a lab report from a photo or PDF, the image is sent to a language model provider (Anthropic) purely to transcribe its text. The image is not used to train models. You can avoid this entirely: the app can read images locally in your browser.

5. Apple Health data

If you connect the app to Health on iPhone, we read from your watch and scale only what you allow in the system: sleep, heart rate, HRV, blood oxygen, steps, weight and blood pressure. This data is used solely to show you your statistics and insights. It never goes to advertising, is never sold and is never shared with third parties beyond the hosting described below. You can revoke the connection at any time in iPhone settings.

6. Processors

• Railway (server and database hosting in the European Union, EU West region): stores all application data.
• Resend (email delivery): receives your email address and the content of system messages, such as the registration code.
• Anthropic (language model): receives a photo of a product label or a page of a lab report only when you yourself use the image reading feature, and only to transcribe its text. Images are not used to train models.

We do not sell data and do not pass it to advertisers or data brokers.

7. Retention

We keep data while your account exists. Deleting the account erases entries, lab results and photos. Backups expire within 30 days of deletion.

8. Your rights

You have the right of access, rectification, erasure, restriction, portability, and to withdraw consent at any time. Withdrawal does not affect processing before it. You may lodge a complaint with your data protection authority.

9. Security

Traffic is encrypted, passwords are stored as PBKDF2 hashes, sessions are signed. Each account's data lives in its own directory.

10. Children

The service is not intended for anyone under 16.

11. Contact

For anything about your personal data write to kontakt@tharan.tech. We reply within 30 days.