Last updated: [insert date before publishing]. This document is a draft prepared for legal review and has not been certified by a lawyer.
OdnEndO (“OdnEndO”, “we”, “us”) is operated by The OG Labs Ltd. This policy explains what personal data we collect through the OdnEndO app, why, who we share it with, and the rights you have over it. We built this app to document symptoms, not to diagnose or treat them — the same principle applies to this policy: we tell you plainly what actually happens to your data, not what would sound reassuring.
Contact: hello@oglabs.co.uk
We do not run analytics or advertising trackers in this app, and we do not collect location data.
When you save an entry, its text (typed, or transcribed from voice) is sent to OpenAI to extract structured symptom data, and voice recordings are sent to OpenAI to be transcribed. Only the entry content itself is sent — not your email, name, or any other account field. Audio is never stored by us; it exists only for the duration of the transcription request. We configure our requests to OpenAI so they are not retained for later reuse on OpenAI's side, though OpenAI's own policies allow it to retain API input/output for a limited period (around 30 days) for abuse-monitoring purposes, separate from anything we control. If you type or say identifying details (a name, a location, a clinician's name) inside an entry, that text is not filtered or redacted before processing — it is treated the same as the rest of the entry.
Your original entries and the structured data derived from them are stored in our database, hosted by Supabase.
Supabase (database, authentication, file storage) and OpenAI (voice transcription and symptom extraction) act as our data processors, under their respective data processing terms. We do not sell your personal data, and we do not share it with advertisers or data brokers. If you granted research consent (optional, and it never affects your ability to use the app), anonymized/aggregated data derived from your entries may be used for research — you can withdraw this consent at any time in Settings without affecting anything else.
Because our processors operate infrastructure that may be located outside your own country, your data may be transferred internationally. Where this involves a transfer out of the UK or EU to a country without an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses, as provided in our processors' own data processing agreements.
We keep your account and journal data for as long as your account exists. Deleting your account (available any time in Settings) permanently and immediately deletes your profile, journal entries, structured extraction data, and consent history — this cascades through our database and cannot be undone. Consent records are the one exception kept as an append-only audit log while your account exists, for exactly the reason described above. Separately, OpenAI's own abuse-monitoring retention window (described above) applies independently of anything we control.
Your account is protected by the authentication and database security controls provided by Supabase, and all traffic between your device and our servers is encrypted in transit (HTTPS). We do not currently offer end-to-end or on-device encryption of journal content, and we won't claim otherwise. No system is perfectly secure; we take reasonable, industry-standard measures but cannot guarantee absolute security.
If you are in the UK or European Economic Area (GDPR / UK GDPR)
You have the right to access, correct, delete, or export your data, to restrict or object to certain processing, and to withdraw consent at any time. Many of these are self-service already: view your original entries and download an export in Settings, or delete your account outright. You also have the right to lodge a complaint with your national data protection authority — in the UK, the Information Commissioner's Office (ICO).
If you are in Australia
You have rights under the Australian Privacy Principles (Privacy Act 1988), including access to and correction of your personal information, and the right to complain to the Office of the Australian Information Commissioner (OAIC).
If you are a California resident (CCPA/CPRA)
You have the right to know what personal information we collect, to request its deletion, and to opt out of its sale — we do not sell personal information, so there is nothing to opt out of. You will not be discriminated against for exercising these rights.
Wherever you are, you can exercise these rights by using the tools in Settings or by emailing hello@oglabs.co.uk.
You must be at least 16 years old to create an account. We ask for your year of birth at signup specifically to enforce this, and use it for no other purpose.
If we make material changes to this policy, we will update the date at the top of this page and, where appropriate, notify you directly.