Privacy Policy

Orkadu is a performance and health tracking app operated by Vinicius de França Alves Graciano Consultoria em Tecnologia da Informação Ltda. (H.Tech Consultoria), registered under Brazilian company ID (CNPJ) 51.312.657/0001-25, responsible for processing your personal data (the controller), under Brazilian Law 13.709/2018 (LGPD). For any privacy matter, reach our data protection officer at orkadu@htech.ltd.

We collect only what the app needs to work:

• Sign-up: name and e-mail (stored encrypted).
• Date of birth: to verify the minimum age of 18 and to calculate indicators that depend on age.
• Physical and health data: weight, height, body measurements, resting heart rate, activity level, health conditions you report and stress level.
• Lab tests: the files (PDF) you upload and the markers extracted from them.
• Body progress photos: images you choose to upload in check-ins.
• Prescriptions and supplements: medications, doses and supplements you record.
• Training and progress: workouts, loads, per-exercise effort, check-ins, periodization and goals.
• Body composition and measurements: values you record or upload.
• App usage (first-party telemetry): navigation and funnel events (e.g. sign-up completed, workout logged) — processed on OUR servers, with no third-party tracking tools and no health content.
• Minimal technical data: IP address and timestamp for security and consent records (audit logs).
• Kadu conversations: the questions you ask the assistant and its answers, stored encrypted so the conversation picks up where it left off. Deleting your account deletes them too.
• Habit journal: what you report about sleep, stress, pain, alcohol and water, day by day. It is self-reported, has no free text, and does not feed the training indicators.
• Public profile (only if you turn it on): nickname, profile photo, join month, level, achievements and four indicators (fitness age, peak load, best readiness, best self-reported sleep). Visible to other members of the app while it is on. Your name and e-mail never appear.
• Communities (only if you join): nickname, level, weekly streak and the ranking metric are visible to that community's members, and what you post on its wall is visible to them. Leaving undoes it.
• Guide waitlist (only if you opt in): the email you leave to get ONE heads-up when the app opens outside Android, stored encrypted. It never becomes a newsletter; to leave the list before the notice, write to the contact above.

Health data is sensitive personal data (art. 11 of the LGPD) and receives reinforced protection.

We process your health data based on your explicit and specific consent (art. 7, I and art. 11, I of the LGPD). Consent is granular and independent for each purpose:

• Terms of use and general account operation.
• Processing of lab tests by artificial intelligence.
• Storage of body photos.
• Processing of medical prescriptions.
• Photo progress analysis by artificial intelligence (optional).
• Calculation of estimated fitness indicators, such as Fitness Age (optional, off by default).

You can withdraw any consent at any time in Settings, without prejudice to processing already carried out. Withdrawing a consent disables the corresponding purpose.

We use your data solely to provide the service: organizing your history, generating test analyses, training and nutrition plans, recommendations, estimated indicators and progress tracking. Every AI output is informational and does not replace professional medical assessment. We do not use your health data or your photos for advertising, and we do not track you across apps.

To generate analyses, content you upload (test text and — when you opt into it — progress photos) is processed by the Anthropic API (Claude). That processing happens on servers in the United States, which constitutes an international transfer of data (art. 33 of the LGPD). Data is sent over an encrypted connection, on a one-off basis (no retention for model training by default) and only to produce the result you requested.

Fitness Age is calculated on our servers, with a published formula (HUNT study, Norway), from your age, sex, waist circumference, resting heart rate and logged workouts. About this processing:

• Legal basis: specific consent, optional, off by default. Without it, the indicator is neither calculated nor displayed.
• No data is sent to artificial intelligence in this calculation.
• The result is NOT stored: it is recalculated on each visit from your source data.
• Your resting heart rate and the indicator are NOT sent to the app usage telemetry.
• To withdraw, turn off “Estimated fitness indicators” in Settings; the indicator disappears immediately and stops being calculated. Your source data stays where it is.

We do not sell your data. We share the minimum necessary with providers that run the infrastructure, under confidentiality and security obligations:

• Anthropic — AI processing (test, training, nutrition and optional photo analyses).
• Railway — application and database hosting.
• Resend — transactional e-mail delivery (e.g. password reset, data export).
• H.Tech own support desk — when you open a ticket under Help, your first name, contact e-mail and the text of the ticket are forwarded to our internal support system.
• Stripe — when paid plans take effect, it will process payments; Orkadu does not store your card data.

We apply AES-256-GCM encryption at rest to sensitive data (name, e-mail, tests, analyses, prescriptions and photos) and TLS in transit. Photos have their metadata (including location/GPS) stripped before storage and are served only to you, through an authenticated session. Access to your data is restricted to your account.

• While your account is active, we keep your data to provide the service.
• When you delete your account, your data becomes inaccessible and is permanently erased after 30 days (including photos and files).
• Consent records and audit logs are kept for up to 5 years as legal evidence, without exposing the content of your sensitive data.
• Kadu conversations: for as long as the account exists; deleted with it.

At any time, you can:

• Confirm that processing exists and access your data.
• Request portability of your data (export in Settings).
• Correct incomplete or outdated data in your profile.
• Withdraw specific consents.
• Request erasure of your data (account deletion in Settings).

Most of these rights are exercised directly in the app, under Settings. For the others, write to orkadu@htech.ltd.

We use only essential cookies for authentication (keeping you securely signed in). We do not use advertising or third-party tracking cookies.

Orkadu is not intended for people under 18, and we do not intentionally collect data from children or adolescents.

We may update this policy. Relevant changes will be communicated in the app and, when the purpose requires it, we will ask for new consent. The effective date above indicates the latest update.

You can delete your account and your data at any time, straight from the app, under Settings. If you would like to read first what happens to each kind of data and how long it takes, the page /excluir-conta explains everything and can be opened without signing in.