Privacy Policy
Arrow Health handles blood glucose readings, medication records and consultation history — some of the most sensitive information a person has. This policy sets out exactly what we collect, where it goes, and how you remove it.
Who we are
Arrow Health is operated by the organisation below, which is the data controller for all information described in this policy.
DIABETES, THYROID, HORMONE CARE
20/A, 0020, Niltuly, Faridpur Sadar
Faridpur 7800, Bangladesh
privacy@arrowhealth.app
What we collect
We collect only what a given feature needs to work. If you never use a feature, we never collect the data behind it.
| Category | Examples | Why |
|---|---|---|
| Account identifiers | Name, email address, phone number, password (stored hashed, never in readable form) | To create and secure your account |
| Health measurements | Blood glucose readings, vitals, weight, growth statistics | Tracking and trend analysis |
| Meal images & analyses | Photographs you submit to the food scanner and the nutritional estimates returned | Meal estimation |
| Medicine scans | Images of medicine packaging submitted to the scanner | Medication identification |
| Activity data | Step counts and movement data from your device's sensors | Activity tracking |
| Location | Precise device location, only while a feature that needs it is in use | See Location below |
| Consultation records | Bookings, appointment history, feedback you submit about a consultation | Arranging and managing consultations |
| Documents | Reports and files you choose to upload | Storing your own records |
| AI conversations | Messages you send to the in-app health assistant | Producing responses and conversation history |
| Payment records | Transaction reference, plan, amount and status for paid features | Processing payments and providing receipts |
We do not collect data for advertising, and we do not sell personal information to anyone, in any circumstance.
What stays on your device
Arrow Health is built local-first. By default your readings, medicine logs and growth statistics are stored only on your device, in encrypted Hive database boxes. In that default state the information never reaches our servers, and we cannot access it.
Uninstalling the app removes locally stored data. If you have not enabled cloud sync, uninstalling removes it permanently, and we hold no copy.
AI processing
Two features require server-side processing: the food scanner and medicine scanning. When you submit an image, it is sent over an encrypted connection to our own servers running on Google Cloud Run.
- Processing is in-memory. The image is analysed and then discarded. We do not retain submitted photographs.
- We do not train on your data. Your images and health information are never used to train or fine-tune any model.
- Processing stays within our infrastructure. Images and assistant messages are handled by models we operate ourselves; they are not sent to a third-party AI provider.
The in-app assistant produces general health information only. It does not diagnose, does not prescribe, and must never be used to decide a medication dose. Speak to a licensed clinician for any treatment decision.
Cloud sync
Cloud sync is optional and off unless you turn it on. When enabled, the data types listed above are transmitted over TLS-encrypted connections and stored on our infrastructure, with uploaded files held in Google Cloud Storage. Sync exists so your history survives a lost or replaced phone and so it is available if you consult a clinician through the app.
Who we share information with
We share personal information in four situations, and no others.
- Clinicians you book. When you book a consultation, the clinician receives the information needed to provide care — see Consultations.
- Infrastructure providers. Google Cloud provides the hosting, compute and file storage on which the service runs. They process data on our instructions and do not use it for their own purposes.
- Payment processing. If you buy a paid plan, the transaction is handled by a third-party payment gateway. Card and mobile-wallet details are entered with that provider and are never seen or stored by Arrow Health.
- Legal obligation. Where we are required to disclose information by law or valid legal process.
We do not share health data with advertisers, data brokers, insurers or employers, and we do not permit it to be used to assess anyone's eligibility for insurance or employment.
Consultations with clinicians
Booking a consultation is a separate act from using the app's tracking tools, and it involves sharing information with a third party — the clinician.
When you book, the consulting clinician receives your name, contact details, the reason for the consultation, and the health records relevant to it, so they can advise you safely. Anything you discuss during a consultation forms part of a clinical record and is handled by that clinician under their own professional and legal obligations, including the standards of the Bangladesh Medical and Dental Council.
Consultation notes made by a clinician may be retained by them independently of your Arrow Health account. Deleting your account removes our copy; it does not compel a clinician to destroy records they are professionally required to keep.
Location
Arrow Health requests precise location only when you use a feature that needs it, and only while that feature is in use. We do not track your location in the background, and we do not build a location history or movement profile.
You can refuse the location permission, or withdraw it at any time in your device settings. Features that depend on it will stop working; nothing else in the app is affected.
Retention and deletion
Where cloud sync is enabled, we keep your data for as long as your account exists. We do not impose a fixed expiry, because a glucose history is only useful over a long period — but you can end that retention at any moment, and we act on it immediately.
Deleting your account
Account deletion is available inside the app and is confirmed with your password. When you confirm it, we permanently and immediately delete:
- your profile and account identifiers;
- all glucose readings, vitals and growth statistics;
- meal records, medicine records and every uploaded image or document;
- consultation bookings and feedback held by us;
- your AI assistant conversation history.
Uploaded files are removed from storage before the database records are erased. This is a hard deletion, not a deactivation — there is no recovery period, and we cannot restore a deleted account. If you cannot access the app, you can request deletion at arrowhealth.app/delete-account.
Anonymous, aggregated statistics that cannot identify you, and records we are required by law to retain such as payment transaction records, may survive deletion.
Your rights
- Access — ask what we hold about you.
- Correction — fix anything inaccurate, in the app or by writing to us.
- Deletion — remove your account and data, as described above.
- Withdraw consent — turn off cloud sync, or revoke camera, location or activity permissions, at any time.
- Object — raise a concern about any processing described here.
Write to privacy@arrowhealth.app and we will respond within 30 days.
Security
On-device data sits in encrypted Hive boxes. Data in transit is protected with TLS. Passwords are stored only as cryptographic hashes and are never readable by us or recoverable in plain form. Access to production systems is restricted to personnel who need it.
No system is perfectly secure. If a breach affects your personal information, we will notify affected users and the relevant authorities without undue delay.
Age
Arrow Health is intended for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
Changes to this policy
We update this policy when the product changes. The effective date at the top always reflects the current version. Where a change materially affects how we handle your health data, we will tell you in the app before it takes effect.
Contact
Questions about this policy, or about how your data is handled:
privacy@arrowhealth.app
Diabetes, Thyroid, Hormone Care
20/A, 0020, Niltuly, Faridpur Sadar, Faridpur 7800, Bangladesh
Arrow Health provides health information and tools. It is not a substitute for professional medical advice, diagnosis or treatment.
© 2026 Arrow Health — a service of Diabetes, Thyroid, Hormone Care.