Rachèta Privacy Policy

This Privacy Policy describes how LumenPath Trading and Services and Contracting (“LumenPath”, “we”, “us”, or “our”) collects, uses, processes, and protects your information when you use the Rachèta mobile application, backend API services, and associated websites (collectively, the “Service”).

LumenPath is a private business entity registered in Doha, State of Qatar. We are committed to transparency and respect for your health information and personal privacy.

Rachèta is a personal health and medication management application. We collect only the information necessary to provide, secure, and improve our services to you:

A. Authentication & Account Information

• Phone Number: Used as your primary account identifier and to send secure one-time password (OTP) verification codes via SMS.
• Authentication Tokens: Secure cryptographic access tokens (JWT) generated upon successful OTP verification to keep your session authenticated on your device.

B. User Profile Data

• Personal Details: Name, phone number, and preferred language (Arabic, English, or Kurdish).
• Family & Dependent Profiles: Information about dependents or family members (e.g., children or elderly parents) that you voluntarily add to manage their health records within your account.

C. Personal Health Information

When you create and maintain your personal health record, you may enter:

• Medical Conditions: Chronic or acute diagnoses, onset dates, and status.
• Past Medical History: Hospitalizations, major illnesses, and clinical background.
• Surgical Procedures: Operations, dates, and surgical notes.
• Allergies: Known drug, food, or environmental allergies and reaction severity.
• Vaccinations: Immunization history, vaccine types, and dates received.
• Disabilities & Obstetric History: Physical or sensory impairments, pregnancy history, or obstetric details you choose to record.
• Family Health History: Hereditary or family health conditions.

D. Medications & Appointments

• Medication Schedules: Medication names, dosages, dosage forms, schedule frequencies, and reminder notification times.
• Appointments: Clinic or hospital names, doctor names, medical specialties, appointment dates, times, and preparation notes.

E. Uploaded Medical Documents & Prescriptions

• Images & Files: Photographs or PDF files of prescriptions, laboratory test reports, radiology summaries, and doctor discharge notes that you upload using your device camera or file picker.
• Extracted Clinical Data: Text, medication names, dosages, and test results extracted via automated document optical character recognition (OCR) and analysis.

F. Chat & Assistant Interactions

• Ask Rachèta Queries: Questions, symptoms, medication queries, and conversational messages you submit to the AI assistant, along with the assistant’s generated responses.

G. Speech & Voice Input

• When you use the microphone feature to dictate messages or notes, audio is processed through the speech recognition service on your mobile device (e.g., Google Speech Services on Android, Apple Speech on iOS) to transcribe your voice into text.
• Rachèta does not retain or archive raw voice audio recordings on its application servers.

H. In-App Purchase & Subscription Information

• If you purchase a Rachèta subscription, transaction receipts, store product identifiers, and entitlement statuses are processed and verified through Apple App Store or Google Play.
• No Payment Card Storage: Rachèta does not receive, process, or store your credit card or banking credentials. All financial transactions are handled exclusively by Apple or Google.

I. Technical & Diagnostic Information

• Standard network request logs (client IP address, timestamp, HTTP request headers, and user-agent string) collected automatically for network security, rate limiting, and DDoS prevention.
• Rachèta does not embed third-party advertising SDKs, cross-app tracking beacons, or commercial data broker trackers.

We process your information strictly for the following operational and health-management purposes:

• Account Authentication: Verifying your identity via phone number and one-time password (OTP) without requiring passwords that can be compromised.
• Health Record Management: Storing, organizing, and displaying your personal and family medical history in a structured, accessible interface.
• Medication & Appointment Alerts: Generating local on-device reminder notifications for scheduled medication doses and upcoming clinic visits.
• Medical Document Extraction: Analyzing uploaded prescription images and lab reports to help you read and catalog medical information.
• AI Health Assistance: Powering the “Ask Rachèta” conversational assistant to provide educational health information, medication guidance, and answers to your wellness queries.
• Subscription Management: Validating store purchases and granting active subscription features.
• Security & Fraud Prevention: Monitoring server request rates, mitigating abusive traffic, and protecting user accounts against unauthorized access.
• Customer Support: Responding to user inquiries and resolving technical issues sent to our official support email.

To provide advanced document extraction, optical character recognition (OCR), and conversational health assistance, Rachèta utilizes external infrastructure and computational providers. We are transparent about these processors:

Our Commitments Regarding AI Processing

• No Unauthorized Processors: Rachèta does not send user data to OpenAI or Anthropic/Claude. Only the confirmed production processors listed above are configured.
• Encrypted Transport: All data transmitted to external processing endpoints is secured in transit using TLS 1.2+ HTTPS encryption.
• Purpose Limitation: User data transmitted to external computational infrastructure is transferred solely to execute the requested feature (e.g., reading a prescription or answering a query) on developer instructions.
• Provider Terms & Privacy Commitments: External infrastructure and AI service providers process and handle user data in accordance with their applicable commercial agreements, developer API terms, and enterprise privacy commitments. We do not sell user health records to data brokers or advertising networks.

Rachèta provides an optional speech-to-text feature allowing you to dictate messages to the AI assistant using your device microphone:

• Operating System Speech Engine: Dictation is processed through the speech recognition service built into your mobile operating system (e.g., Google Speech Services on Android, Apple Speech on iOS).
• Network Processing: Depending on your device capabilities, operating system version, and device settings, voice recognition may be processed locally on-device or transmitted by your operating system to platform cloud servers for transcription.
• No Audio Storage on Rachèta Servers: Rachèta receives only the resulting transcribed text string. We do not store, record, or retain your raw voice recordings on our application servers.

We implement technical and operational safeguards to protect your personal and medical information:

• Encryption in Transit: All communications between the Rachèta mobile app, our backend servers (mediai.lumen-path.com), and external service APIs are strictly transmitted over HTTPS using Transport Layer Security (TLS 1.2 and TLS 1.3).
• Server Isolation: Our production application database (PostgreSQL) and document storage repositories are hosted on dedicated infrastructure with strict firewall rules, access controls, and parameterized query execution to guard against injection.
• Credential Security: Authentication relies on short-lived cryptographic bearer tokens and one-time SMS verification codes, reducing the risk of compromised passwords.
• Isolated Reviewer Account: A whitelisted, isolated test account mechanism is maintained strictly for Apple and Google app review teams to inspect application functionality without live SMS dependencies. This mechanism is isolated to designated review credentials and does not affect normal user accounts.

You have full ownership of your data and can permanently delete your account and associated health records at any time:

Option 1: In-App Deletion

1. Open the Rachèta mobile app.
2. Navigate to Settings.
3. Select Delete Account.
4. Confirm the deletion prompt. Your account and records are permanently removed immediately.

Option 2: Dedicated Public Deletion Portal

If you have uninstalled the app, lost your device, or cannot log in, visit our public Account & Data Deletion page:

Option 3: Email Request

You may also email our support team at info@lumen-path.com from your registered contact address or specifying your registered phone number with the subject line “Account Deletion Request”.

What Happens When You Delete Your Account

• Permanently Erased: Your user profile, phone number, patient record, medical conditions, surgical history, allergies, medications, appointments, uploaded prescription/lab documents, chat conversations, and sole dependent profiles are permanently erased from our active database and file storage.
• Limited Retained Records: In accordance with legal, accounting, and anti-fraud obligations, pseudonymous consent confirmation logs (with user identifiers decoupled) and store purchase transaction tokens may be retained in isolated audit tables for the minimum duration required by applicable statutory rules. These records cannot be linked to active medical profiles.

We retain your personal and health information only as long as necessary to provide the Rachèta service to you:

• Active Accounts: Your health records, profile information, and uploaded documents are retained as long as you maintain an active account so you can access your medical history.
• Account Deletion: When you delete your account, your personal and health records are purged immediately from our active application databases and document storage.
• Ephemeral Processing: AI prompts and speech recognition transcriptions are processed ephemerally in real-time to generate responses to your active session.

Rachèta is designed and intended strictly for adults aged 18 and older. It is not directed to, marketed to, or intended for direct independent use by children under the age of 18.

Adult parents, legal guardians, and authorized caregivers may create and manage health profiles for their minor children or dependent family members within their own account under their direct supervision and responsibility.

Depending on your location and applicable privacy laws, you may have the right to:

• Access: Request confirmation of whether we process your personal data and obtain a copy of your records.
• Correction: Update or rectify incomplete or inaccurate personal or health information directly within the app.
• Deletion: Request permanent erasure of your account and health data as described in Section 7.
• Objection / Restriction: Request restrictions on specific processing activities.

To exercise any of these rights, please contact our privacy team at info@lumen-path.com.

LumenPath is based in the State of Qatar. Depending on the external cloud infrastructure, AI model hosting facilities, and telecommunications providers utilized (e.g., Google Cloud and RunPod GPU infrastructure), your data may be transferred to, processed, and stored on servers located outside your country of residence.

Where international processing occurs, we ensure that data is transmitted exclusively over encrypted channels (HTTPS/TLS) and subject to standard technical and organizational security controls.

We may update this Privacy Policy from time to time to reflect modifications to our application, changes in infrastructure, or evolving legal and regulatory requirements.

When changes occur, we will post the revised policy on this page with an updated “Effective Date”. We encourage you to review this policy periodically. Your continued use of Rachèta following the posting of changes constitutes your acknowledgment and acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us: