Privacy Policy

1. Introduction

Technefide Labs ("we", "us", "our") develops and operates Altheru ("the App"). This Privacy Policy explains how information is collected, used, processed, and protected when you use our mobile application and related services.

We believe sensitive personal documents—such as passports, national IDs, health lab panels, and contracts—belong strictly under your control. Our architecture enforces data minimization and on-device processing by default.

2. Architecture & Data Storage

2.1 On-Device Storage and Encryption

All scanned documents, imported PDFs, extracted metadata, custom notes, holder profiles, reminders, and relation links are stored in your device's local application sandbox.

Files are encrypted using AES-GCM cryptography with encryption keys secured on your iOS device. We do not operate a remote file storage service for your documents. If you delete the app without an unencrypted manual export or device backup, your data is permanently removed.

2.2 On-Device Processing

The following operations are performed entirely on your device without transmitting data over the internet:

• On-Device OCR: Text recognition performed via Apple's native Vision framework.
• Vault Search: Full-text keyword and filter searches executed locally.
• Similar Document Matching: On-device 128-dimensional vector embeddings and cosine similarity scoring.
• Relationship Engine: Chronological renewal sequencing, entity matching, and individual holder linking.
• Local Notifications: Expiry and follow-up alert scheduling using the iOS UserNotifications framework.

3. Optional Cloud Features & AI Processing

Cloud AI is optional and off until you allow it in the app. Altheru does not send a document, Ask question, or document excerpt to an AI service until you tap Allow on the in-app permission screen (or turn on Cloud AI in Settings after reviewing the same disclosure). Privacy Policy text alone is not used as consent. You can turn cloud AI off in Settings at any time.

3.1 What is sent, who receives it, and how it is used

• AI document scan: a copy of the document image or PDF you chose is sent so the model can suggest title, type, dates, holder, and similar fields. The original file remains in your on-device vault.
• Ask: your question and short text excerpts from matching documents are sent — not the original files.
• Who: Technefide Labs, the developer of Altheru, processes the request at altheru.com over HTTPS. A cloud AI infrastructure provider runs the model for that request only.
• Use: payloads are used only to return extracted details or an answer to your question. They are held only for that request, are not stored as a cloud document vault, and are not used to train AI models.

3.2 Transient AI Metadata Extraction

After you have allowed cloud AI, when an AI scan or re-extraction runs:

• The document image or PDF is transmitted over an encrypted HTTPS connection to our backend processing API.
• Our AI model parses key metadata (e.g., document type, title, issue date, expiration date, holder name, extracted fields, lab metrics).
• The parsed metadata is returned to your device and saved into your local database.
• Zero File Retention: The uploaded document payload is held only in ephemeral memory for the duration of the API call and is never saved to disk or stored in a persistent database on our servers.

3.3 Vault Query (Natural Language Q&A)

After you have allowed cloud AI, when you use the "Ask" feature to query your vault:

• Your question and relevant text excerpts from your documents are transmitted to our AI inference API to generate a summarized, cited answer.
• Neither your question nor your document excerpts are stored persistently or used to train foundation models.

4. Account & Authentication Information

Altheru supports two tiers of user access:

5. Device Permissions Requested

Altheru requests only the minimum iOS permissions necessary to deliver core features:

• Camera: Used exclusively to scan paper documents in real time. We do not access the camera in the background.
• Photo Library: Used only when you select photos or document scans to import into your vault.
• Notifications: Used to schedule local alerts for upcoming document expiration dates and follow-ups. No push notification tracking server is used.

6. Third-Party Services

We use service providers to operate optional cloud features. We do not sell your personal data. Any third party that receives personal data from Altheru must provide the same or equal protection of that data as this Privacy Policy requires.

• Altheru (Technefide Labs / altheru.com): Our API receives optional AI requests after in-app consent and stores the identifiers needed for monthly usage limits.
• Authentication provider: Issues and validates session tokens for guest users and optional email accounts. It receives an anonymous user ID and, if you add one, your email address.
• Cloud AI infrastructure provider: Runs the optional AI model. After you allow cloud AI, it receives a copy of a document for a scan, or your question and short document excerpts for Ask. Payloads are used only to complete that request and are not used to train AI models.
• Apple: App distribution and on-device system services (camera, photos, files, and local notifications).

7. Your Rights (GDPR & CCPA / CPRA)

Depending on your location, you may have the following rights regarding your personal data:

• Right of Access & Portability: You can export all your decrypted documents and metadata at any time using the built-in iOS Share Sheet.
• Right to Erasure (Deletion): You can delete any document from your local vault immediately. If you have an email account, you can delete your account and associated server records in the app settings or by contacting us.
• Right to Rectification: You can manually edit any metadata field, date, holder name, or relationship directly within the app.
• Right to Withdraw Consent: You can turn off cloud AI in Settings. After that, Altheru will not send documents or Ask excerpts to the AI processor.
• Right to Non-Discrimination: We do not discriminate against users who exercise their privacy rights.

8. Children's Privacy

Altheru does not knowingly collect personal information directly from children under the age of 13 (or under 16 in certain jurisdictions). Parents and legal guardians may store family documents (such as birth certificates or immunization records) under designated holder profiles for household management.

9. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements in our app or regulatory changes. When updates occur, the "Effective Date" at the top will be updated. We encourage you to review this page periodically.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data privacy, please contact us at:

Support & Inquiries
Email: contactus@altheru.com
Website: https://www.altheru.com/