Privacy policy

Arkalife stores account details, including your email address and a pseudonymous account identifier. A profile can include a name, date of birth, sex, height, diet, relationship and dated weight measurements.

Arkalife uses your email address to send you one email about getting started if you have not added a report a day after signing up. That email contains no health information, and every such email has an unsubscribe link that we honour.

When you upload a report, Arkalife stores the uploaded file and its report details, the extraction draft used by the review screen, and the results you confirm. Confirmed results can include the lab's printed test name, value, unit and reference range, canonical values, marker mapping and descriptive range flag. Arkalife also stores the insurance policy documents you upload and the details read from them, saved chat conversations and messages, and records needed for families, invitations and share links.

If you subscribe to a paid plan, Arkalife stores your plan, its renewal dates, the payment and subscription identifiers Razorpay returns, and the tax invoices we issue. Arkalife never sees or stores your card, bank or UPI details; Razorpay handles those.

We use your information to provide Arkalife to you: to read the documents you upload, show your records and trends, answer your Chat questions, share profiles with the family members you choose, bill paid plans and keep the service secure. We process it on the basis of the consent you give when you sign up and upload, and, for billing records, to meet our legal obligations.

We do not sell your information, and we never use your health records for advertising.

When you share a profile into a family, every member of that family can see it, and adult members can add to or change it. A member can leave a family at any time and takes their own profile with them.

When you add an adult, you confirm that you have their permission to store and view their records. When you add a child, you confirm that you are their parent or legal guardian and give consent on their behalf; we record which version of that consent you gave. Children cannot have their own login, and Arkalife does not track the behaviour of children or use their data for analytics or advertising.

The emergency card keeps a copy of the active profile's card on your device so it can open without a connection. That copy expires after 30 days and is removed when you sign out.

On paid plans you can create a share link to an emergency card. Anyone with the link can open a fixed copy of the card without signing in, until the link expires (after 1 hour, 24 hours or 7 days, as you choose) or you revoke it. We record how many times a link was opened and when it was last opened. Share-link pages are not indexed by search engines.

If you give analytics consent, Arkalife may send PostHog the following named product events and only their fixed properties:

• Signup started: which sign-in provider button was pressed.
• Signup completed: the number of onboarding steps completed.
• Report upload started: whether the report came from a camera or file.
• Extraction completed: duration and result and unmapped-result counts.
• Extraction failed: a fixed failure category.
• Review opened: result counts and a fixed patient-name match status.
• Review edited: the kind of field edited.
• Report confirmed: result, edited-result and unmapped-result counts.
• Marker viewed: the broad panel category, not the marker identity.
• Chat turn sent: the turn number, not the question or answer.
• Guide read: the published guide that was opened.

Analytics can also include fully-masked session replays and error reports. Session replays mask all text and all form inputs; they can show page layout and interactions such as clicks and scrolls. Arkalife removes query strings and fragments from its own URLs, and replaces marker, report, invitation, chat and guide identifiers in URL paths with route patterns before analytics properties are sent.

Arkalife counts five things about the sign-in screen, the short quiz at arkalife.ai/start, and the account setup screens. It does this before you have an account, and on the setup screens whether or not you agree to analytics, so without analytics consent:

• Sign-in screen shown: whether the screen was displaying an error.
• Sign-in button pressed: which provider button was pressed, whether it was on the sign-in screen or the quiz, and, if you arrived from one of our ads, which ad.
• Sign-in result: a fixed outcome — signed in, cancelled at the provider, or one of three failure categories.
• Quiz progress: how far a visitor got through the short quiz at arkalife.ai/start, never what they answered.
• Account setup progress: which setup screen was reached, and on the last one whether upload was pressed, a file was chosen, or setup was skipped — never what was entered or which file.

Each of these counts also records the general kind of browser used — for example, Instagram's built-in browser on Android, a phone browser, or a computer — so that we can see if sign-in stops working on one kind. It is one of eight fixed categories; the browser's full details, version and device model are never recorded.

These are counts and nothing else. They carry no account identifier, no email address, no name, no IP address, no location, and no identifier of any kind for you or your device — not even a temporary one, and no cookie is set. Each one is recorded against a single shared placeholder identifier, so they can be added up but not grouped by person, and they are not recorded against you or your account.

They exist because without them Arkalife cannot tell whether people who try to sign in are failing to. Nothing about your health records is involved.

To find and fix faults, Arkalife sends technical error reports to Sentry whether or not you have given analytics consent. This is part of running the service, not analytics. Before a report leaves Arkalife, lab values, reference ranges and email addresses are removed from error messages and logs, and no request bodies or user identity are attached.

PostHog does not receive lab values, reference ranges, patient names, marker identities, or the contents of chat questions or answers. It receives a pseudonymous account identifier for an account, never the account's email address or name. The sign-in counts described above carry no account identifier at all.

Your IP address is discarded on arrival and is never stored, so analytics carries no location derived from it. Arkalife does not record browser console output, does not automatically capture the text of elements you click, and does not collect heatmaps.

Supabase hosts Arkalife's database and file storage, in Mumbai, India, and runs sign-in. Your records and uploaded files are stored there.

Cloudflare runs the Arkalife application and carries its traffic.

Google provides sign-in. Google tells Arkalife your email address and account identifier when you sign in; Arkalife does not share your records with Google.

Anthropic processes the documents you upload, because extracting information from a report or policy is a product function, and processes Chat, because answering a question needs the question and the records it is about. What Anthropic receives therefore includes clinical content. It processes that content to provide the answer and does not use it to train its models.

Razorpay processes payments and subscriptions for paid plans. It receives the details you enter at its checkout and an internal identifier and plan name from Arkalife, and never receives your health records.

Resend, in the United States, sends Arkalife's emails. It receives your email address, your first name and the content of the email, and never receives your health records.

PostHog, in its United States region, processes behavioural events only. PostHog receives no clinical content and no email address or name.

Sentry, in the United States, receives the scrubbed error reports described above.

Meta receives conversion measurement for advertising, and only for visitors who reached Arkalife by clicking a Meta advertisement. If you arrived any other way, nothing about your visit is sent to Meta at any point. What is sent is the click identifier Meta itself added to the link you followed and, if you gave analytics consent, a one-way hash of your email address. A hash is not anonymous — Meta can match it to an account it already holds — which is why it is sent only with consent. Meta never receives a lab value, a reference range, a test or marker name, a report, a patient name, or anything else about your health records. There is no Meta tracking script anywhere on this site.

Your records and files are stored in India. Anthropic, PostHog, Sentry, Meta and Resend process the data described above for them in the United States, and Cloudflare serves traffic from the location nearest to you. We share with each provider only what its role needs.

Arkalife uses a small number of cookies, none of them for advertising tracking on other sites:

• Sign-in session cookies, which keep you signed in.
• arkalife_profile, which remembers the profile you last viewed, for up to a year.
• arkalife_last_seen, which signs you out after a period of inactivity.
• arkalife_attr, set only when you arrive from an advertisement, which records which advertisement brought you, for up to 30 days.

Arkalife asks for analytics consent at signup and records the version of the policy you accepted. Consent to an older policy version does not count as consent to a materially changed policy. If you withhold analytics consent, the app works fully and no product analytics events are sent. The only exception is the sign-in counts described above, which carry no identifier of any kind and are not tied to you or your account.

Health records, reports and policies are kept for as long as the account exists. You can delete your account from the app at any time: it is frozen straight away and permanently deleted after 30 days, and signing in within those 30 days cancels the deletion. Deletion removes your own profile, the profiles you created that no one else has claimed, and your uploaded files. A profile another person has claimed as their own stays with that person.

Tax invoices are kept for as long as GST law requires, even after an account is deleted. PostHog analytics events are retained for 12 months, and session replays for 30 days.

Under India's Digital Personal Data Protection Act, 2023, you can ask us for a summary of the personal data we hold about you and who we have shared it with, ask us to correct, complete or update it, ask us to erase it, withdraw consent you have given, and nominate someone to exercise these rights for you if you die or become unable to. Most of this you can do directly in the app; for anything else, write to us at the address below.

Withdrawing consent does not affect processing that happened before you withdrew it, and some features cannot work without the information they depend on.

Questions, requests and complaints about your personal data go to our Grievance Officer, Kanika Agarwal, at privacy@arkalife.ai. We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

When we change this policy, we update the date at the top. For a material change, we tell you in the app before it takes effect, and, where the change affects what you consented to, we ask for your consent again.

Arkalife is a record-keeping tool, not a source of medical advice. Its screens show values, the reference ranges your lab printed, and trends. Chat can explain what a result commonly means, as general education, but it does not diagnose, prescribe or replace a doctor. Consult a physician about your health, results and care.