top of page

Privacy Policy

Effective date: 10 November 2026

1. Who we are

ARKI LAB LIMITED (hereinafter "the Company", "We", "Us", "Our") develops and publishes the mobile application Painscape (hereinafter "the App"). This Privacy Policy (hereinafter "this Policy") explains what information the App processes, where it is stored, who it is shared with and what rights you, the user (hereinafter "the User", "you", "your"), have.

ARKI LAB LIMITED
Suite C, Level 7, World Trust Tower, 50 Stanley Street, Central, Hong Kong
Registry number: 76463925
E-mail: support@arkilab.tech

ARKI LAB LIMITED is the controller of the personal data described in this Policy. If you do not agree with this Policy, please do not use the App.

2. The short version

  • Your diary stays on your device. Pain records, intensity, notes, medications, triggers, symptoms, sleep, stress, mood, menstruation days, the names and birth dates of the people whose diaries you keep — all of this is stored on your iPhone (and on your Apple Watch, if you use the watch app). We do not have a server that receives it, and we cannot see it.

  • No account, no sign-in. You do not create an account with Us.

  • Optional iCloud sync. If you have a subscription and turn on "Sync via iCloud", your diary is stored in your own private iCloud database operated by Apple. We cannot access it.

  • Nothing about your health is ever sent to analytics or advertising partners. We collect anonymous usage statistics (for example, "an entry was created", "the paywall was shown") and crash reports to improve the App and to measure our advertising — never the content of your diary.

  • No ads inside the App. We do not show advertising in the App and we do not sell your data.

3. Information that stays on your device

To work as a pain diary, the App stores the information you enter:

  • pain episodes: date and time, pain type, intensity, duration, location on the body, triggers, symptoms, what helped, notes;

  • medications: names, doses, intakes and whether they helped;

  • day context: sleep, stress, mood, menstruation;

  • people (diaries): name, optional date of birth, intensity scale, colour;

  • App settings: reminders, theme, quiet mode, lock with Face ID / Touch ID / passcode.

This information is health data. It is stored locally in the App's protected storage on your device. It is shared between the App, its Home Screen widget and its Apple Watch app only on your own devices (through an App Group and Apple's WatchConnectivity). We do not receive it.

Face ID / Touch ID. If you turn on the App lock, authentication is performed by iOS. We never receive your biometric data.

Notifications. Reminders are scheduled locally on your device. Daily reminders do not contain health details. Medication reminders show the name of the medication you entered, which may be visible on your lock screen — the App warns you about this when you set one up.

4. Information that leaves your device only when you decide

  • iCloud sync (subscription). If you turn it on, your diary is synchronised through your private Apple iCloud (CloudKit) database so that it is available on your other devices. This data is processed by Apple under Apple's privacy policy, is tied to your Apple ID and is not accessible to Us. You can turn sync off at any time in the App.

  • PDF reports, CSV exports and backups. These files are created on your device. They leave your device only when you choose to share, send, print or save them (for example, e-mail them to your doctor or save them to Files). You decide who receives them; We do not receive a copy.

  • Messages to support. If you write to us, We receive your e-mail address and whatever you include in your message. Please do not send us health information unless it is necessary to resolve your request.

5. Information We collect automatically

5.1. Usage analytics (Google Firebase Analytics)

We collect anonymous information about how the App is used: which screens are opened, which features are used (for example, "entry created from the widget", "report built for a 3-month period", "paywall shown from settings"), onboarding progress, subscription events, App version, device model, operating system version, language, country/region derived from the IP address, and an app-instance identifier generated by Firebase.

We never send to analytics: pain types, intensity, notes, dates of attacks, medication names, triggers, names or birth dates of the people in your diaries, or any other content of your diary.

5.2. Crash reports (Google Firebase Crashlytics)

If the App crashes, a crash report is sent so that We can fix the error. It contains technical information (stack trace, device model, OS version, App version, an installation identifier) and does not contain the content of your diary.

5.3. Advertising measurement and App Tracking Transparency

We advertise the App (for example, through Google Ads). To understand which advertising brings people to the App, We may share with Google the fact that the App was installed and that a subscription was purchased (product, price, currency).

On first use, iOS asks whether you allow the App to track you across apps and websites owned by other companies. If you allow it, the device advertising identifier (IDFA) may be used together with the events above to attribute installs and purchases to our advertising. If you do not allow it, the IDFA is not available to Us; nothing else in the App changes. You can change your choice at any time in iOS Settings → Privacy & Security → Tracking.

5.4. Subscriptions (Apple and Adapty)

Payments are processed by Apple through the App Store; We never receive your payment card details. To check whether your subscription is active and to manage trials and offers, the App uses Adapty (Adapty Tech Inc.), which receives purchase information from Apple (product, transaction identifiers, dates, price, country) together with an anonymous user identifier generated by the App.

6. Why We process data and on what legal basis

PurposeDataLegal basis

Providing the diary, reports, reminders, widget and watch featuresDiary data on your devicePerformance of the service you requested; your explicit consent to process health data, given by entering it

Optional iCloud syncDiary data in your iCloudYour consent (you turn sync on)

Selling and maintaining subscriptionsPurchase information, anonymous user identifierPerformance of a contract

Improving the App and fixing errorsAnonymous usage analytics, crash reportsOur legitimate interest in a working and useful App

Measuring advertisingInstall and purchase events, IDFA (only if you allow tracking)Your consent (App Tracking Transparency); otherwise our legitimate interest in measuring advertising without the IDFA

Answering your requestsE-mail correspondenceOur legitimate interest / performance of a contract

Complying with the lawData required by authoritiesLegal obligation

We do not use your health data for advertising, profiling or marketing, and We do not sell or rent personal data to anyone.

7. Who We share data with

  • Apple — App Store distribution and payments, iCloud sync (if you turn it on), push notifications for sync.

  • Google (Firebase Analytics, Firebase Crashlytics, Google Ads) — anonymous usage analytics, crash reports and advertising measurement as described in section 5.

  • Adapty — subscription status and purchase information.

  • Authorities, courts and our legal advisers — only where required by law or to establish, exercise or defend legal claims.

These providers may process data outside your country, including in the United States. Where required, such transfers are protected by appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission.

Their privacy policies:

8. How long data is kept

  • Diary data stays on your device (and in your iCloud, if sync is on) until you delete it. You can delete everything at any time with More → Erase all data, or by deleting the App. iCloud data can also be removed in iOS Settings → [your name] → iCloud → Manage Account Storage.

  • Analytics data is kept by Firebase for up to 14 months and then deleted.

  • Crash reports are kept by Firebase Crashlytics for up to 90 days.

  • Subscription records are kept as long as needed to provide the subscription and to meet accounting and legal obligations.

  • Support correspondence is kept as long as needed to resolve your request and for a reasonable period afterwards.

9. Security

Your diary is protected by iOS data protection on your device. You can additionally lock the App with Face ID, Touch ID or your device passcode. iCloud data is protected by Apple. We limit the data We collect to what is described in this Policy and require our providers to protect it.

No method of storage or transmission is 100% secure. You are responsible for keeping your device, its passcode and your Apple ID secure, and for choosing whom you share exported reports with.

10. Children and diaries kept for others

The App is not intended for children under 13. A parent or legal guardian may keep a diary for their child: in this case the parent enters and controls the child's data, which stays on the parent's device as described above. We do not knowingly collect personal data directly from children. If you believe a child has provided personal data to Us (for example, by e-mail), contact us and We will delete it.

If you keep a diary for another adult, you confirm that you have their permission to record their health information.

11. Your rights

Depending on where you live (including under the EU and UK GDPR and the California Consumer Privacy Act), you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time.

  • Your diary is under your control on your device: you can view, edit, export (PDF, CSV, backup) and delete it in the App without contacting us.

  • Analytics, crash and subscription data — to exercise your rights, write to support@arkilab.tech. Because this data is not linked to your name or e-mail, we may ask for the information needed to find it (for example, the date of a purchase).

  • Tracking — you can allow or refuse tracking at any time in iOS Settings → Privacy & Security → Tracking.

We respond within one month; where a request is complex, this period may be extended by two further months, and We will tell you why.

California residents. We do not sell or share personal information for cross-context behavioural advertising as defined by the CCPA, other than install and purchase events used to measure our own advertising when you allow tracking. We do not process sensitive personal information (including health data) for any purpose other than providing the App to you, and the App does not process precise location.

You also have the right to lodge a complaint with the data protection supervisory authority in your country.

12. Medical disclaimer

Painscape is a diary, not a medical device. It does not diagnose, treat or replace a consultation with a doctor. Always discuss treatment decisions with a qualified healthcare professional.

13. Changes to this Policy

We may update this Policy when the App, the law or our providers change. The current version is always available in the App and on our website, with its effective date at the top. If changes are significant, We will tell you in the App.

bottom of page