Privacy Policy - MyLabStory

1. Introduction

MyLabStory is a personal health data management platform operated under the brand Kritr, which is owned and operated by AI Brainiacs ("we," "us," or "our"). We understand that your health information is deeply personal, and we take your privacy seriously.

This Privacy Policy describes our practices regarding the collection, use, storage, and sharing of your Personal Data when you use the MyLabStory mobile application (the "App"), our website, and related services (collectively, the "Service").

This Privacy Policy applies to:

• People who use our Service ("Users," "you," or "your")
• People on whose behalf Users provide information, such as family members, children, or other dependents whose health records are managed through the Service by an authorized User

Some terms we use in this policy:

• "Personal Data" means any information that identifies or relates to you as an individual
• "Health Data" means personally identifiable information about your health, lab results, biomarkers, and medical records that you upload or that is extracted through the Service
• "Anonymized Data" means data from which personally identifiable information has been removed such that it can no longer be used to identify an individual
• "Aggregated Data" means data combined across multiple individuals in summary form. Aggregated Data is considered anonymized and is no longer Personal Data

2. How We Collect Personal Data

We may collect Personal Data from:

• You directly, when you create an account, upload lab reports, enter health information, complete your profile, send messages through the AI chat assistant, or contact us
• Automated processing, when AI systems extract biomarker data from documents you upload or retrieve relevant health data to answer your chat questions
• Automatic data collection through device identifiers, analytics events, and similar technologies when you use the App
• Third-party platforms, if you sign in through a third-party service such as Google or Apple, or when you subscribe through an app store

3. What Personal Data We Collect

We may collect the following types of Personal Data:

• Account information such as your name, email address, and password
• Profile data such as date of birth, gender, and family member profiles
• Health Data including lab report files such as PDFs, JPEGs, and PNG images, extracted biomarker values, health summaries, trend data, and notes you add to your records
• AI chat data including your chat messages and conversation history within the App
• Payment and transaction data necessary to process your subscription, including billing information and transaction history. We do not have direct access to your payment card numbers. Payments are processed by app stores such as Apple or Google, or by third-party payment processors
• Communications that you send to us, including support messages, feedback, and reviews
• Device data such as your device type, operating system, app version, and general location information such as country or region
• Usage data such as features you use, screens you view, session duration, and interaction patterns within the App

4. How We Use Personal Data

We use Personal Data for the following purposes:

Service Delivery

• Provide, operate, and improve the Service
• Process your lab report uploads and extract biomarker data using AI
• Generate health summaries, insights, and trend visualizations
• Power the AI chat assistant and respond to your questions about your health data
• Create and manage your account and profiles
• Provide customer support and respond to your inquiries
• Customize your experience based on your usage and preferences

AI and Automated Processing

The Service uses artificial intelligence and automated systems to:

• Extract data from uploaded documents through OCR and AI processing
• Classify document type and date
• Generate summaries, insights, and trend analysis
• Identify patterns and anomalies in your biomarker data
• Retrieve relevant health data and generate AI assistant responses to your chat messages

You acknowledge that AI outputs may not always be accurate or complete. Results should be independently verified with a qualified healthcare provider. AI is used as a support tool, not a medical decision-maker.

Analytics and Improvement

• Understand how Users interact with the Service
• Analyze usage patterns to improve features and reliability
• Conduct research and development to enhance the product experience
• Create Aggregated Data or Anonymized Data for internal analysis

Marketing and Communications

• Send you Service-related announcements, updates, and important notifications
• Send promotional communications where permitted by law
• Measure the effectiveness of our communications

We do not use personally identifiable Health Data for marketing or advertising purposes.

Compliance and Protection

• Protect against fraudulent, illegal, or harmful activity
• Maintain the safety, security, and integrity of the Service
• Comply with legal obligations, resolve disputes, and enforce our Terms of Use
• Respond to law enforcement requests as required by applicable law

5. Who We Share Personal Data With

We may share your Personal Data with the following categories of recipients:

• Cloud infrastructure providers that host and process data on our behalf using secure servers. These providers do not use your Personal Data for any purpose other than providing their services to us
• Analytics providers that help us understand how the Service is used, in aggregated and anonymized form
• Payment processors and app stores such as Apple and Google that handle billing and subscription management. We do not share your Health Data with payment providers
• Customer support platforms that help us manage and respond to support requests. We limit the data shared with these platforms to what is necessary to resolve your inquiry
• Marketing communications providers that help us deliver email and other communications. We will never share your Health Data with marketing providers
• Government authorities where required to comply with the law, enforce agreements, or protect rights, property, or safety
• Business transferees in connection with a merger, acquisition, restructuring, or sale of assets

We will never sell your Personal Data to anyone.

We may share Aggregated Data or Anonymized Data derived from your usage of the Service with partners, researchers, or other third parties. Such data is no longer Personal Data and cannot be used to identify you.

OpenAI (AI Processing)

MyLabStory uses OpenAI, LLC ("OpenAI"), a third-party AI provider, to power document analysis and the AI chat assistant. Data is sent to OpenAI using OpenAI's API when you use these features.

#### Document upload

What we send to OpenAI

• Your uploaded lab report files (PDF, JPEG, or PNG)
• Text extracted from those documents during processing

Why we send it

• To extract biomarker values and other health data from your documents
• To classify document type and date
• To generate document summaries

#### AI chat

What we send to OpenAI

• Your chat messages
• Relevant health data retrieved to answer your questions, such as biomarker values, biomarker history, and document metadata (for example, document names, types, and dates). This may include health data from family member profiles you manage through the Service when relevant to your question

Why we send it

• To generate AI assistant responses to your questions about your health data

#### How OpenAI uses your data

OpenAI processes this data only to provide the features you request. Under OpenAI's API data usage policies at the time of processing, content submitted through the API is not used to train OpenAI's models unless otherwise disclosed by OpenAI. OpenAI does not use your Health Data for advertising.

For more information, see OpenAI's Privacy Policy at https://openai.com/policies/privacy-policy/

By using document analysis or AI chat features, you consent to MyLabStory sharing the data described above with OpenAI for these purposes, as also described in our Terms of Use.

6. Data Storage, Security, and Retention

Storage

We store your data using secure cloud infrastructure with encryption in transit and at rest. We employ administrative, technical, and organizational security measures designed to protect your Personal Data, including access controls, audit logging, and secure data processing pipelines.

However, no system can be guaranteed to be completely secure. You are responsible for maintaining the confidentiality of your account credentials.

Retention

We retain Personal Data only for as long as reasonably necessary to:

• Provide the Service and fulfill the purposes described in this policy
• Meet legal, tax, accounting, and regulatory obligations
• Resolve disputes and enforce agreements
• Maintain security and prevent fraud

When the retention period expires, we delete or anonymize the data. To determine the appropriate retention period, we consider the nature and sensitivity of the data, the potential risk of unauthorized use or disclosure, and applicable legal requirements.

We retain AI chat history for as long as your account is active or as needed to provide the Service. When you delete your account, we delete your chat history along with your other Personal Data, subject to any legal retention requirements.

Data sent to OpenAI for processing is handled according to OpenAI's policies and our agreements with OpenAI. We do not control OpenAI's internal retention practices for API requests.

Subscription Data

If you cancel your paid subscription but maintain a free account, we may continue to store your previously uploaded data and chat history. If you delete your account entirely, we will delete your Personal Data, subject to any legal retention requirements.

7. Your Rights

Subject to applicable law, you have the following rights regarding your Personal Data:

• Access: You may request confirmation of whether we process your Personal Data and obtain a copy of it
• Rectification: You may request correction of inaccurate Personal Data
• Erasure: You may request deletion of your Personal Data from our systems, including deletion of your account and associated Health Data and chat history. Please note that deleting certain data may prevent us from providing the Service to you
• Portability: You may request a copy of your Personal Data in a machine-readable format, or request that we transmit it to another service where technically feasible
• Objection: You may object to the processing of your Personal Data for certain purposes, including direct marketing
• Restriction: You may request that we restrict further processing of your Personal Data in certain circumstances
• Withdrawal of Consent: Where processing is based on your consent, including consent to share Health Data with OpenAI for AI features, you may withdraw that consent at any time. This may affect your ability to use certain features of the Service
• Complaint: You have the right to lodge a complaint with the relevant data protection authority in your jurisdiction

To exercise any of these rights, please contact us at mylabstory@kritr.com. We may need to verify your identity before processing your request. We will respond within a reasonable timeframe as required by applicable law.

We will not discriminate against you for exercising your privacy rights.

8. Cookies and Similar Technologies

In the App

The MyLabStory App does not use browser cookies. We may use device identifiers and analytics SDKs to collect usage data for product improvement.

On the Website

Our website may use:

• Strictly Necessary Cookies required for basic website functionality
• Analytics Cookies to understand how visitors use the website
• Marketing Cookies to measure the effectiveness of our campaigns

You can control cookies through your browser settings or through our cookie consent tool where available.

9. Personal Data of Children and Dependents

MyLabStory is not intended for independent use by individuals under 18, or the applicable age of majority in your jurisdiction. However, parents, guardians, or other authorized individuals may upload and manage records for children or dependents for whom they are legally authorized to act.

If you use the Service to manage a child's or dependent's health records, you represent that you have the legal authority to provide that information and to consent to its processing on their behalf as described in this Privacy Policy.

We do not knowingly collect Personal Data directly from children who create accounts or use the Service on their own. If we learn that a child under the applicable age has created an account or used the Service independently without appropriate authorization, we will take steps to delete that information promptly.

If you believe a child may have created an account or provided Personal Data to us without proper authorization, please contact us at mylabstory@kritr.com.

10. Third-Party Sites and Services

The Service may contain links to or integrate with third-party websites, services, or platforms, such as sign-in providers, app stores, or payment processors. We are not responsible for the privacy practices of those third parties.

OpenAI is a data processor we use to deliver AI features, as described in Section 5. Other third-party integrations are separate from OpenAI processing.

We encourage you to review the privacy policies of any third-party services you access through or in connection with MyLabStory.

11. Health Data Disclaimer

MyLabStory is a health data management tool, not a medical device.

• It does not diagnose, treat, cure, or prevent any disease
• It is not certified as a clinical decision support system
• AI-generated insights, summaries, and chat responses are for informational purposes only
• Always consult a licensed medical professional before making any health decisions

Your use of the Service does not create a doctor-patient or any other healthcare provider relationship.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting the updated policy within the App or on our website with a revised effective date.

For material changes, we may also notify you via email or through in-app notifications. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

If you do not agree with the updated policy, you should stop using the Service and may request deletion of your account and data.

13. Contact Us

If you have questions, concerns, or would like to exercise your privacy rights, please contact us at:

Product: MyLabStory

Brand: Kritr

Legal Entity: AI Brainiacs

Email: mylabstory@kritr.com

By using MyLabStory, you acknowledge that you have read, understood, and agree to this Privacy Policy.