Your lab results,
finally understood

1. Introduction and Scope

Welcome to Aather | آثر ("Aather", "we", "our", or "us"). Aather is a digital health information platform designed to help individuals securely organize laboratory reports, monitor health measurements over time, manage medical information, and access AI-assisted explanations and insights.

This Privacy Policy describes the categories of personal information we collect, how we use and process that information, when information may be shared with service providers, how it is stored and retained, and the choices and rights available to users. It applies to the Aather website at aather.life, its associated applications, and related services.

Medical information is sensitive personal data. You should upload only records belonging to you or individuals whose information you are legally authorized to manage. By using Aather, you acknowledge the data practices described in this policy. Where applicable law requires consent or another legal basis for processing, Aather must obtain or establish that basis separately.

2. Information We Collect

Depending on the features you use, Aather may collect and process the following categories of information:

• Account information: Your name, email address, account identifiers, profile image where available, authentication records, and account preferences.
• Personal and demographic information: Date of birth, sex, and other profile information you choose to provide.
• Health and medical information: Medical conditions, medications, allergies, symptoms, medical and surgical history, family history, vaccinations, and related information entered into the platform.
• Laboratory and diagnostic information: Uploaded laboratory reports, PDF documents, medical images, test names, numerical values, units, reference ranges, collection dates, and extracted or interpreted results.
• User-generated information: Notes, conversations, questions, uploaded materials, generated summaries, and saved health insights.
• Technical information: IP addresses, browser characteristics, device information, authentication sessions, diagnostic records, and technical logs needed to operate, protect, and maintain the service.

The information collected depends on the features you access and the information you voluntarily provide. Aather does not require every category of medical information for every feature.

3. Google Sign-In and Google User Data

Aather supports authentication through Google Sign-In. When you choose to sign in using Google, the authentication service may provide basic account information, including your name, email address, Google account identifier, and profile picture, depending on the permissions granted.

This information is used to authenticate your identity, establish and maintain your Aather account, associate your records with the correct account, manage sessions, and support account-related functionality.

Google Sign-In does not give Aather access to your Google password. Aather does not request access to your Gmail messages, Google Drive files, Google Calendar events, or Google Contacts for basic authentication.

Aather does not sell information obtained through Google Sign-In or use that information for targeted advertising. Information received from Google APIs is used for the purposes described in this policy and in accordance with the Google API Services User Data Policy, including applicable Limited Use requirements.

Medical records uploaded directly to Aather are separate from the basic Google account information used for authentication. You may review or revoke Aather's access to your Google account through your Google Account connection settings. Revoking access does not automatically delete information already stored within Aather.

4. How We Use Your Information

Aather processes personal and health information for purposes connected to providing and maintaining the services you request. These purposes may include:

• Creating, authenticating, and managing user accounts.
• Uploading, storing, organizing, and retrieving medical records.
• Extracting laboratory values and other relevant information from uploaded reports.
• Displaying laboratory trends, historical comparisons, and health measurements.
• Generating requested explanations, summaries, and AI-assisted insights.
• Supporting authorized record sharing, clinician access, and data exports.
• Maintaining application functionality, security, and reliability.
• Investigating technical failures, misuse, and security incidents.
• Meeting applicable legal and regulatory obligations.

Processing of sensitive health information is subject to applicable legal requirements, including any necessary consent, authorization, or other lawful basis. Information should not be used for unrelated purposes without an appropriate legal basis and, where required, additional notice or consent.

5. Artificial Intelligence and Medical Document Processing

Aather provides document extraction and AI-assisted health information features. Depending on the feature requested, relevant content may be processed by external AI services through Anything platform integrations, including services provided by OpenAI and Google Gemini.

Information submitted for processing may include uploaded laboratory reports, document images, extracted test results, medical history, relevant profile details, user questions, and conversation content. The categories and amount of information transferred depend on the requested feature and its technical implementation.

External AI providers may process information on their infrastructure under applicable service agreements, processing terms, and privacy policies. Their data retention, storage locations, and processing practices may differ from those of Aather.

Aather does not represent that all AI processing occurs locally on your device, that providers never retain submitted content, or that all external processing has undergone independent security auditing. Any statements regarding AI model training or provider retention must reflect the actual provider configuration and applicable contractual terms.

AI-generated medical explanations may contain errors, omissions, or inaccuracies. Aather is an informational tool and does not replace professional medical evaluation, diagnosis, or treatment. Users should consult qualified healthcare professionals when making medical decisions.

6. Service Providers and Third-Party Processing

Aather relies on external technology providers to support application infrastructure, authentication, document processing, file storage, email delivery, and AI functionality.

These may include Anything for application infrastructure and integrations; Google for authentication and applicable AI services; OpenAI for AI-assisted processing; Uploadcare for file storage and delivery where integrated; and Resend for transactional email when configured.

Providers receive or process information relevant to the services they perform. Depending on the integration, this may include account identifiers, uploaded files, medical content, email addresses, technical logs, and network information. Providers may have separate contractual, operational, and legal obligations governing their processing activities.

Aather may also disclose information where required by applicable law, valid legal process, or when reasonably necessary to investigate security incidents, protect users, or prevent misuse of the service.

7. Sharing Medical Information

Aather may provide features that allow users to share selected health information, reports, or summaries with healthcare professionals or other recipients they choose.

When you create or distribute a sharing link, individuals who obtain access to that link may be able to view the information it exposes, subject to any applicable access restrictions. You are responsible for selecting appropriate recipients and protecting sharing links from unauthorized disclosure.

Where available, sharing permissions and links may be managed or revoked through the application. Revocation does not necessarily remove information previously downloaded or independently retained by recipients.

8. Data Storage and Security

Personal information, medical records, uploaded documents, extracted results, and generated content may be stored in application databases, platform storage systems, and associated infrastructure services.

Security protections depend on the systems and providers involved. Aather aims to protect personal information through appropriate technical and organizational safeguards, including access management and security practices supported by its infrastructure.

Because some functionality requires server-side document extraction and AI processing, relevant content must be accessible to authorized processing systems. Aather does not claim that all stored information uses end-to-end encryption or zero-knowledge encryption.

No internet-based system can guarantee complete protection against every security risk. Users should protect their account credentials, maintain device security, and avoid distributing private medical records or sharing links unnecessarily.

9. International Data Processing

Aather's infrastructure and third-party providers may store, access, or process information in countries other than the country where you reside.

Cross-border processing may occur when using cloud infrastructure, document storage, authentication services, or external AI providers. Such processing is subject to applicable privacy and data protection requirements, including relevant restrictions on international transfers of personal and sensitive health information.

Where Saudi Arabian data protection requirements apply, international transfers must satisfy applicable provisions of the Personal Data Protection Law and related regulations. The availability of a third-party integration does not itself establish that a transfer is legally permitted.

10. Cookies, Sessions, and Technical Information

Aather may use cookies, browser storage, device storage, and similar technologies to maintain authenticated sessions, remember preferences, support application functionality, and improve reliability.

Technical records may include IP addresses, device or browser characteristics, request timestamps, application errors, and security-related events. Such information may be processed by Aather's infrastructure providers as necessary to deliver and protect the service.

Disabling essential cookies or storage mechanisms may prevent authentication or certain application features from functioning correctly.

11. Data Retention

Aather retains account information and user-provided records for as long as reasonably necessary to provide requested services, maintain the account, and fulfill applicable operational or legal obligations.

Retention depends on the type of information, the purpose of processing, the status of the account, user deletion requests, applicable legal requirements, and the retention practices of relevant service providers.

Uploaded files, database records, backup copies, technical logs, and provider-held information may have different retention and deletion lifecycles. Aather does not represent that every copy is deleted immediately when an individual record or account is removed.

Information no longer needed for its original purpose should be deleted, anonymized, or otherwise handled according to applicable legal obligations and operational requirements.

12. Account and Data Deletion

Users may request deletion of their Aather account and associated personal information through the account deletion functionality provided by the application or by contacting the service operator.

Aather may require reasonable identity or account ownership verification before processing a deletion request to prevent unauthorized removal of sensitive medical records.

Deletion of active account records does not necessarily result in immediate removal of all backup copies, provider-held records, or technical and security logs. Certain information may need to be retained where required or permitted by applicable law.

Revoking Google Sign-In permissions prevents the associated authorization from continuing but does not independently delete your Aather account or its previously stored records.

13. Your Privacy Rights and Choices

Depending on applicable law and the circumstances of processing, you may have rights concerning your personal information, including the ability to:

• Request information about how your personal data is processed.
• Request access to personal information held about you.
• Request correction or updating of inaccurate or incomplete records.
• Request a copy of your personal information in an available format.
• Request deletion or destruction of information where legally applicable.
• Withdraw consent where processing is based on consent, subject to applicable limitations.
• Raise a privacy concern or complaint with the appropriate authority where permitted by law.

Some rights may be exercised directly through Aather's profile, records, export, sharing, and account management features. Other requests may require contacting the service operator and verifying account ownership.

14. Children's Privacy

Aather is intended primarily for adults managing their own medical information or records they are legally authorized to manage. The service is not directed toward independent use by children.

Where an authorized adult manages another individual's medical information, that adult is responsible for ensuring that they have the appropriate authority and legal basis to provide and manage those records.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in Aather's functionality, service providers, data processing practices, legal obligations, or security arrangements.

The latest version will be published on the Aather website with an updated revision date. Where legally required, material changes will be communicated through appropriate channels and additional consent obtained before new processing begins.

16. Contact and Privacy Requests

If you have questions about this Privacy Policy, the processing of your personal information, or wish to exercise applicable privacy rights, you may contact Aather's service operator using the official privacy contact information published by the service.

Privacy contact email: [INSERT VERIFIED PRIVACY EMAIL]

Service website: https://aather.life

When submitting a request, please use the email address associated with your Aather account where possible. Do not include passwords or complete medical reports in an initial privacy inquiry.