Privacy Policy

1. Who We Are

Akaiin Software Development Services is the personal information controller responsible for the Akaiin platform. We develop and operate the Akaiin web application and related services for users in the Philippines: the free Akaiin app that helps families coordinate the care of a loved one (Family Mode), an invite-only paid service for care homes and home-care agencies (Organization Mode), and Akaiin Companion, a paid, in-person, non-medical companion service for seniors. Akaiin is not a medical provider.

Contact us at any time at hello@akaiin.com.

2. Data We Collect

We collect only the data necessary to provide our services. Some data is provided directly by you; some is generated as you use the platform.

2.1 Account Data

• Email address
• Password (stored as a cryptographic hash by Firebase Authentication - we never see your plain-text password)
• Display name (optional)
• Your role in a Care Circle (Primary Caregiver, Caregiver, Buyer, or Viewer) or, in Organization Mode, your staff role (Owner, Leadership, Editor, or Viewer)
• Date and time of account creation

2.2 Sensitive Personal Health Information

The following data is classified as sensitive personal information under RA 10173, Section 3(l). We collect it only when you (or another member of your Care Circle) enter or upload it:

• Scanned or uploaded medical documents - prescriptions, laboratory results, discharge summaries, doctor's notes, and advance directives; these are processed by an AI service (Google Gemini, through Google Cloud / Vertex AI) to extract medicine lists and build a daily care plan
• Medicine lists and the daily care plan - medicine names, dosage, and schedules extracted from documents or entered by you
• Today's Care task records - which tasks were done, by whom, and when
• Care updates and notes shared within the Care Circle
• Care Vault contents - the Emergency Card, Records, and Care Reports
• Timeline / History - a record of care activity and who performed each action within a Care Circle and when

2.3 Organization Mode Data

When a care home, nursing home, home for the aged, assisted living facility, or home-care agency uses Organization Mode, its authorized staff may enter:

• Resident records, including health information about residents
• Daily charting and notes, tasks, and scanned documents
• Care reports (PDF) generated from those records
• Staff account details and staff roles (Owner, Leadership, Editor, Viewer)
• Organization agreement and package details

2.4 Akaiin Companion Data

When you book an Akaiin Companion session, we collect:

• Booking and contact details you send us through Facebook Messenger - your name, contact details, the senior's name, the session date, time, place, and the kind of help needed
• Payment records for the 50% deposit and the balance paid through GCash (such as amount, date, and reference number)
• The family email address we use to create the senior's Care Circle on your behalf
• Session photos taken by the companion and shared with the Care Circle
• Session logs - meals, medicines taken, mood, tasks completed, and any requests for extra time and your approval of them
• The companion's notes and the Session Summary (photo album, logs, companion's note, and care report)
• The senior's live location during an active session (see Section 2.7)

2.5 Public Dedication Wall (Blue Lotus)

If you post a message on the public dedication wall ("Blue Lotus" / Dedicate), the message and any name you choose to show with it are public and can be seen by anyone. Please do not include health information or other sensitive details in a public dedication.

2.6 Device & Notification Data

• Firebase Cloud Messaging (FCM) registration token - generated by your browser to enable push notifications; does not identify you personally
• Notification preferences per Care Circle

2.7 Location Data (Companion Sessions Only)

During an active Akaiin Companion session, the companion's device may share the senior's live GPS location with the family's Care Circle so the family knows where the senior is. Location sharing and tracking are tied to the active session and stop when the session ends. The route taken during the session is kept with the Session Summary so the family can look back on where the senior went. We do not collect location data from the Family Mode app outside of Companion sessions.

2.8 Data We Do NOT Collect

• Government-issued ID numbers (Philippine National ID, SSS, PhilHealth, TIN)
• Your GCash login, PIN, or one-time passwords, or your card or bank account numbers
• Biometric data
• Race, ethnicity, or religious beliefs

3. How We Use Your Data

3.1 To Provide the Service

• Authenticate your identity and maintain your session
• Store and display the Care Circle data you enter (care updates, Today's Care tasks, medicine lists, records, Care Vault, Timeline)
• Enable role-based access for Primary Caregiver, Caregiver, Buyer, and Viewer members within a Care Circle, and for Owner, Leadership, Editor, and Viewer staff within an organization
• Process scanned medical documents using AI to extract medicine lists and build a daily care plan
• Generate the Emergency Card and Care Reports
• Provide Organization Mode to care organizations under their agreement with us
• Book, schedule, and deliver Akaiin Companion sessions, confirm deposits and payments, share session photos, logs, and location with the Care Circle, and prepare the Session Summary
• Send notifications about care updates, tasks, and Companion sessions
• Display messages posted on the public dedication wall

3.2 To Improve the Platform

• Understand which features are most used (based on aggregated, anonymized data)
• Diagnose technical errors and improve system reliability

3.3 To Comply with the Law

• Respond to lawful requests from Philippine government authorities
• Meet our obligations under RA 10173
• Keep payment records as required for accounting and tax purposes

We do not sell, rent, or trade your personal data to third parties for marketing. We do not use your health data for advertising purposes. Companion session photos are shared only with the Care Circle and are never used in public posts or marketing without the family's written consent.

4. Legal Basis for Processing

Under RA 10173, we process your data on the following bases:

• Consent - you provide explicit consent at signup or booking by agreeing to this policy. For sensitive personal health information, this consent is required before you can use Care Circle features or book a Companion session.
• Consent for the senior (Companion sessions) - before the first session, a family member signs a digital consent on the senior's behalf, confirming that the senior agrees to the companion visit, session photos, and location sharing, or that the family member is authorized to decide for the senior. The senior may also sign. We keep a record of which account signed, for whom, the consent wording, and the date and time.
• Contractual necessity - to fulfill our service agreement with you (e.g., storing your Care Circle data so you can access it, delivering a Companion session you booked, or providing Organization Mode under an organization agreement).
• Legitimate interests - to detect abuse, prevent fraud, maintain service security, and improve product quality, in ways that do not override your rights.
• Legal obligation - where required by Philippine law.

In Organization Mode, the organization is responsible for having the authority and, where required, the consent to enter its residents' information into Akaiin.

You may withdraw your consent at any time by deleting your account (see Section 8). Withdrawal of consent does not affect the lawfulness of processing prior to the withdrawal.

5. Who We Share Data With

We do not share your personal data with any third party except the infrastructure and processor partners listed below, who are contractually required to protect your data and process it only on our instructions:

5.1 Infrastructure Processors

• Google Firebase (Firebase Authentication, Cloud Firestore, Cloud Storage, Firebase Cloud Messaging, Firebase Hosting) - provides user authentication, database and file storage, push notifications, and web hosting. Data is stored in Google-operated data centers. See Google's Privacy Policy at policies.google.com/privacy.
• Google Gemini (through Google Cloud / Vertex AI) - processes images of medical documents you upload to extract medicine lists and build a daily care plan. Google Cloud's data processing terms apply.
• Google Cloud (including Cloud Run) - hosts the Akaiin backend server. Operated by Google.

5.2 Within a Care Circle

Health data you enter into a Care Circle is visible to the members of that circle, subject to their role (Primary Caregiver, Caregiver, Buyer, or Viewer). The Primary Caregiver controls who is invited and what role they are assigned. Never share your Care Circle invite link with people you do not trust with your loved one's health information.

5.3 Companions and Organizations

When you book an Akaiin Companion session, the companion assigned to your session receives the information needed to care for the senior during that session, and the session photos, logs, notes, and live location are shared with your Care Circle. In Organization Mode, resident data is visible to the organization's staff according to their roles; it is not shared with families or other organizations through Akaiin.

5.4 Law Enforcement and Emergencies

We may disclose your data to government authorities or law enforcement if required by a valid court order, subpoena, or applicable Philippine law, or if necessary to protect the rights, property, or safety of Akaiin, our users, or the public. In a life-threatening emergency during a Companion session, the companion will call emergency services (911) first and then the family, and may share information needed to protect the senior's life and health.

5.5 Business Transfers

If Akaiin is acquired, merged, or substantially reorganized, your data may be transferred as part of that transaction. We will notify you by email and update this policy before any such transfer occurs.

6. Data Retention

• Account data (email, name) - retained for the lifetime of your account, then deleted within 30 days of account deletion.
• Care Circle health data (care updates, tasks, medicine lists, care plans, records, Care Vault, Timeline) - retained for the lifetime of the Care Circle. When you delete a circle or your account, all associated health data is permanently deleted within 30 days.
• Scanned documents - uploaded documents and the information extracted from them are kept as part of the Care Circle's records until you delete them or the circle.
• Companion Session Summaries and routes - a Session Summary that the family does not save, including the route taken during the session, is deleted after 30 days. A saved Session Summary and its route become part of the senior's records and are retained like other Care Circle health data.
• Consent records - the record of each digital consent (which account signed, for whom, the wording, and the date and time) is retained for as long as the senior's Care Circle exists and as needed to meet legal obligations.
• Companion booking and payment records - retained for as long as needed to provide the service and to meet accounting, tax, and other legal obligations.
• Organization Mode data - retained according to the organization's agreement with Akaiin and the organization's instructions.
• Public dedications - remain on the dedication wall until removed by you (on request) or by us.
• Push notification tokens (FCM) - retained until you log out of all devices or delete your account.
• Server logs - system-level access logs are retained for up to 90 days for security and debugging purposes.

7. Security

We implement reasonable organizational and technical safeguards to protect your personal data, including:

• Passwords are hashed by Firebase Authentication using industry-standard algorithms - we never store or see plain-text passwords.
• All data in transit is encrypted using TLS (HTTPS).
• Firebase security rules restrict access so users can only read data they are authorized to see.
• Access to backend services is protected by Firebase ID token verification.
• Sensitive credentials (database keys, API keys) are stored in environment variables, not in source code.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

In the event of a personal data breach that is likely to harm your rights and interests, we will notify the National Privacy Commission (NPC) within 72 hours of discovery, and affected users as soon as reasonably practicable, in compliance with NPC Circular 16-03.

8. Your Rights Under RA 10173

As a data subject under the Data Privacy Act of 2012, you have the following rights:

To exercise any of these rights, email us at hello@akaiin.com. We will respond within 15 business days. If you are a resident of an organization that uses Organization Mode, you may also direct your request to that organization.

9. Minors

Akaiin accounts are intended for individuals who are 18 years of age or older. We do not knowingly collect personal data from children under 18 as account holders.

However, a Care Circle allows adult caregivers to keep care records for a loved one of any age. In this case, the adult caregiver provides consent on behalf of the person being cared for, where legally authorized to do so, and is responsible for ensuring that data entry and sharing is appropriate.

If you believe we have inadvertently collected personal data from a minor as an account holder without appropriate parental consent, please contact us immediately at hello@akaiin.com and we will delete the data promptly.

10. Third-Party Services

Akaiin Companion bookings are made through Facebook Messenger, and deposits and payments are made through GCash. When you use Messenger or GCash, you are also subject to Meta's and GCash's own privacy policies. We are not responsible for the privacy practices of these third-party services.

Akaiin does not currently offer partner pharmacy, medicine delivery, transport, or other partner services. We may introduce partner services in the future; if we do, we will update this policy before they launch.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will:

• Update the effective date at the top of this page.
• Notify registered users by email at least 7 days before the changes take effect.
• For changes involving new types of sensitive personal information, request fresh consent before the new processing begins.

Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

12. Contact & Data Protection Officer

For any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact our Data Protection Officer (DPO):

• Organization: Akaiin Software Development Services
• Email: hello@akaiin.com
• Response time: Within 15 business days

We are committed to working with you to achieve a fair resolution of any complaint or concern about privacy. If you are not satisfied with our response, you have the right to contact the National Privacy Commission (see Section 8).