Kidney Lens Privacy Policy

Last updated: 16 July 2026

Local-first by design. After a scan request is handled, we do not retain your meal photo or optional note in the Kidney Lens app database. Photo scanning is optional and consented. Your health information is never for sale.

Kidney Lens is a tracking and education companion for people already diagnosed with kidney disease — not a medical device, and never a source of medical advice, food verdicts, personal nutrient limits, or dosing guidance. This policy explains what data Kidney Lens handles, where it lives, and the controls you have over it.

Local-first by design

Kidney Lens is local-first: your food, fluid, medication and target logs are stored on your device. There is no cloud copy of your diary. You only need an account (Sign in with Apple) for the account-backed features — the photo scan and the Pro subscription — and you can use manual and barcode logging, day rings, and the clinician report without sending your diary anywhere. You can export your app data on-device at any time.

What we collect (only if you use account features)

• Account information. Your Sign in with Apple account identifier and refresh tokens, your subscription entitlement status, your consent history for the photo scan, and your daily scan counters.

Kidney Lens collects no advertising identifiers and no location data, and uses no third-party advertising or analytics SDKs.

AI providers and consent

Photo scanning is optional. In the current version, Kidney Lens sends your meal photo and any optional note you add to OpenAI to identify foods and estimate a rough portion. Kidney Lens does not send new scan data to DeepSeek in the current version.

We do not retain your meal photo or optional note in the Kidney Lens app database after servicing the scan request. OpenAI states that data sent to its API is not used to train or improve OpenAI models by default unless a customer opts in. Its standard abuse-monitoring logs may include customer content and related metadata and may be retained for up to 30 days, subject to OpenAI's stated legal and safety exceptions.

Earlier Kidney Lens versions may have sent recognized food names to DeepSeek under their prior disclosure. Updating the app or withdrawing scan consent blocks future requests, but cannot retrieve data already received by a third-party processor.

Nutrient values come from neither provider. Every potassium, phosphorus, sodium and protein value comes from USDA FoodData Central, the public-domain (CC0) nutrient database published by the U.S. government.

Meal photo and scan data

Kidney Lens does not retain your meal photo or optional note in its own app database after handling the scan request. The current version does not retain photo-scan corrections in its server database or use them to personalize later v2 scans.

Barcode lookup and device cache

Packaged-food barcode lookup sends only the product GTIN to USDA FoodData Central when an exact public-product lookup is needed. Product facts may be cached on your device and in a shared server cache by GTIN. These caches contain no account identifier, meal photo, food log, note, or health data.

Payments

Subscriptions are processed by Apple StoreKit. Our server verifies signed StoreKit transactions and App Store Server Notifications to keep your entitlement status current. We do not receive payment card details — Apple handles all billing.

No ads, no sale of data

Kidney Lens has no third-party advertising and no tracking for ads. We never sell your personal information or your health information, and we never share your logs, meal photos, optional notes, or consent records for advertising or data mining.

Health data and the FTC Health Breach Notification Rule

We treat everything in Kidney Lens — food, fluid, medication and target logs and scan-service records — as sensitive health information. It is encrypted in transit, server-held records are protected at rest, access is limited to what each feature needs, and it is never disclosed to advertising or analytics companies. As a consumer health app operating in the United States, we consider ourselves subject to the FTC Health Breach Notification Rule: any unauthorized acquisition or disclosure of your identifiable health information would be treated as a breach, and we would notify affected users and the FTC within the timelines the Rule requires.

Export and deletion

You can export your local app data from the app at any time, free. You can also delete your account and server-held data from inside the app: account deletion revokes refresh tokens and removes Kidney Lens server-held account and scan-service records tied to your account, including consent records, short-lived consent-dispatch leases, entitlement rows, and scan counters. It does not delete data a third-party processor may retain under its own policy. If you can't access the app, email nora@halehearth.com from the address linked to your account and we'll delete it for you.

Your rights (GDPR, CCPA and similar laws)

Depending on where you live — including under the EU/UK GDPR and the California Consumer Privacy Act — you may have the right to access, correct, export, restrict, object to the processing of, or delete your personal information, and the right not to be discriminated against for exercising those rights. We don't sell personal information, so there is nothing to opt out of. To exercise any right, use the in-app tools or email nora@halehearth.com; you may also have the right to complain to your local data protection authority.

Children

Kidney Lens is intended for adults managing their own health records. It is not directed to children, and we do not knowingly collect personal information from anyone under 13 (or the equivalent minimum age in your country). If you believe a child has provided us personal information, email us and we will delete it.

Changes

If we make material changes to this policy, we'll update this page and the date above.

Contact

Hale Hearth · nora@halehearth.com