Krates — Privacy Policy

Effective 4 November 2026

Krates is an iPhone app for adults (18+) in the United States. It reads the medical records you connect, charts them, and points out results worth a second look. Its Eat or Skip tab checks foods against what your records say. Krates is made by Lizwise Elv LLC. This policy describes exactly what stays on your phone, what leaves it, who receives it, and how long anything is kept.

In short: your records, your food log and your profiles live only on your iPhone. Nothing about your health leaves it unless you switch on an AI feature, and each AI feature asks first. Our relay keeps no content, only counts.

What stays on your iPhone

Krates has no account and no cloud sync. All of this is stored only in the app's own storage on your iPhone, protected by your passcode and Apple's file encryption, and Lizwise Elv cannot read any of it:

• Your records: lab results, vital signs, conditions, medications, allergies, immunizations, procedures and notes, from Apple Health and from any health system you connect, including records read from Epic MyChart.
• Wearable data from Polar or Withings, if you connect one, and the sign-in tokens for those connections (in the iPhone keychain).
• Your profiles: names, dates of birth, sex at birth and anything you correct, for you and any family member whose record you add.
• Eat or Skip: your food log, saved meals and products, food goals and the weight, height and food choices you enter, and a small thumbnail of each photo you analyse (kept 30 days unless you change it; the full photo is never saved).
• What you do in the app: findings you dismiss or archive, chat conversations, the thumbs you give, and your answers to the age question and each AI permission.

Like any app's data, this can be included in your own iPhone backup (iCloud Backup or a computer) if you use one. That backup is yours, under Apple's terms; Lizwise Elv has no access to it. Photo thumbnails are left out of backups.

Where your records come from

• Apple Health, with your permission per record type. Withdraw it in Settings › Privacy & Security › Health › Krates.
• Your health system, through its Epic MyChart sign-in, if you connect one. You sign in on the health system's own page; Krates never sees your password. Your iPhone then reads your record directly from the health system, read-only. Krates asks for no long-lived access, so a connection lasts about an hour and you sign in again to refresh it. The sign-in returns to the app through a static page we publish, which passes a one-time code to the app and keeps nothing.
• Polar and Withings, if you connect one. Your iPhone reads your data directly from the company. Only the sign-in step goes through our relay, because it needs a secret that cannot be shipped inside an app: the relay swaps the one-time sign-in code (and later, a refresh code) for access tokens, hands them back to your phone, and keeps none of it. No wearable data passes through the relay at sign-in. Wearable data reaches an AI model only in a general health chat you start, and only if you allow it (below).

Krates reads; it never writes anything back to Apple Health, a health system or a wearable.

What leaves your iPhone, and only if you allow it

Three features use Google's Gemini AI model. Each is off until you allow it, on a screen that shows exactly what would be sent, and each can be switched off at any time. Requests go through our relay (below), never straight from your phone to Google. Every finding is still computed on your phone either way; AI puts results into words and reads photos.

1. Insight wording and chat

When you allow it, Krates sends the facts behind a finding so Gemini can phrase it in plain English, the questions you type in a card's chat, and a general health chat you start:

• the results a finding is about (the test, value, unit, reference range and date), and, where a finding is about them, the conditions, medications and family history involved, by name, sometimes with the month they started;
• background a clinician would use to read a result, where your profile has it: your age in years, sex at birth, country of birth, work and smoking status;
• the text you type in chat, with the recent turns of that conversation, and the card with up to 12 of its results. Sources are labelled “Source A”, “Source B”; a clinic's name is sent only when a finding compares results from two clinics.
• in a general health chat you start: a summary of your data without your name, birth date, address or where you're treated (your age range, sex at birth, conditions, medications, allergies, recent results, Apple Health and wearable averages such as Polar or Withings, and your food log against your goals), plus any detail an answer asks for, such as one test's history or a month of steps. Each reply lists what it used. Data from Oura is never sent.

Never sent: your name, date of birth, address, race, ethnicity, marital status, medical record number or your doctors' names. Switch it off on the profile card, under Insight wording. AI is always off for any profile under 18, and for a family member's profile until it has a date of birth.

2. Eat or Skip food analysis

The Eat or Skip tab is on by default, but nothing is sent until you allow food photo analysis. When you do:

• Barcodes: the barcode number goes to our relay, which looks the product up in Open Food Facts. Open Food Facts gets the barcode from our relay, never your phone's address.
• Nutrition labels and meals: the photo you choose, cropped and shrunk, with location, time and camera details removed, goes to Gemini to be read. So does a meal you describe by typing, with the time of day.
• Wording a result: the food's name, its verdict and nutrition numbers, and a rough note such as "not much sodium room left today".

Never sent: your name, age, sex or profile, your health records, your food log or daily totals, your location, or any photo you didn't choose to analyse. Everything inside a photo's frame is sent, so keep people and paperwork out of it. Switch it off on the profile card, under Food photo analysis.

3. Recipe ideas ("What should I cook?")

Asked separately. It sends what you ask for (cooking time, servings, ingredients you list), the names of foods you logged today, which nutrition goals are short or nearly used, your food choices and the ingredients you avoid, and the names of any allergies in your records. It never sends your other records, your age, sex, weight or totals. Switch it off in Eat or Skip settings.

Thumbs up and down, if enabled

Krates can share a thumbs up or down as a bare count by type (for example "insight" or "recipe"), with no content and nothing that identifies you or your device. This is currently off. If we turn it on, only daily totals per type are kept.

Our relay: what it keeps

The relay is a small service run by Lizwise Elv LLC on Cloudflare. It holds the keys to Google and to the wearable companies so that no key ships inside the app, and it checks, using Apple's App Attest, that a request comes from a genuine copy of Krates. It knows your device only by the anonymous key App Attest creates, never by your name, phone number or Apple ID. It passes each request on and stores none of its content: no photos, results, questions or replies. What it does keep:

• Usage counts, for 35 days. For each day you use an AI feature: how many requests your device made and their estimated AI cost, filed under a code made from the anonymous device key by a keyed hash (HMAC-SHA256) under a secret only the relay holds. The code cannot be turned back into the key. These daily rows are deleted after 35 days. The code and the first day it appeared are kept up to 400 days, to count new users. Totals per feature are kept with no device attached. All of this is held in a database on Lizwise Elv's own Cloudflare account.
• Rate limits. A running count of requests per device key for the current minute and day (and per network address for the first set-up step), overwritten as each window rolls over, so one device cannot exhaust the service.
• A barcode cache: a product's public Open Food Facts data, for 7 days (1 day for a barcode that wasn't found), shared by everyone and not linked to who asked.
• Operational log lines recording the type of request, the device key, and its timing, size and estimated cost. They never contain content, health values or barcodes.

Who else handles your data

• Google (Gemini API), only for the AI features you allow. Krates uses Google's paid service, under which Google does not use the requests to improve its products, and keeps them for up to 55 days only to detect abuse. Google may process them outside the United States.
• Cloudflare runs our relay, the encrypted connection to it, and the database of usage counts on Lizwise Elv's own account.
• Open Food Facts, a public food database, receives barcode numbers from our relay. Nothing about you goes with them.
• Epic and your health system, only if you connect one: your iPhone signs in and reads your record from them directly.
• Polar and Withings, only if you connect one: your iPhone reads your data from them directly, and our relay completes the sign-in.
• Apple provides Apple Health, App Attest and the App Store, under its own terms.

How long things are kept

• On your iPhone: until you delete it, or delete the app. Photo thumbnails: 30 days by default.
• Content you send to an AI feature: not kept by Krates or our relay. Google keeps it up to 55 days to detect abuse.
• Usage counts: 35 days. The hashed device code and its first-seen day: up to 400 days. Totals with no device: kept.
• Rate-limit counters: the current minute and day only.
• Barcode cache: 7 days.

Deleting your data, and your choices

• A connected source: in the profile menu, tap the source, then Disconnect. Its results are removed from that profile.
• Food data: Eat or Skip settings › Delete all food data removes every scan, logged entry and photo thumbnail. You can also delete one scan at a time.
• Everything: delete the Krates app. That deletes its storage and everything in it. If you keep iPhone backups, older backups may still hold a copy until they are replaced.
• AI features: switch any of them off as described above. It takes effect at once; a food request in progress is cancelled. What already reached our relay or Google can't be recalled, and Google deletes it within 55 days.
• Apple Health: withdraw access in Settings › Privacy & Security › Health › Krates.

The usage counts can't be deleted on request: we can't tell which rows are yours, because they hold nothing that links them to you. They expire on the schedule above. You can also write to us (see Requests).

What Krates never does

• No sale of your information, to anyone
• No advertising, no analytics or tracking SDKs, and no tracking across apps or websites
• Nothing shared with advertisers or data brokers
• No use of your health data except to show it back to you
• No diagnosis or treatment advice: Krates is not a medical device

Adults only

Krates is for people 18 and over. It asks when you were born before anything else, and stops anyone under 18 there. Only the answer and the year are kept, on your iPhone. An adult may add the record of a family member they are entitled to hold, such as a child's; AI features are always off for a profile under 18.

How it is protected

Data on your iPhone is encrypted by iOS and locked behind your passcode. Every connection Krates makes is encrypted in transit. The relay serves only genuine copies of Krates, verified with Apple's App Attest.

Washington and Nevada residents

Our Consumer Health Data Privacy Policy covers Washington's My Health My Data Act and Nevada's consumer health data law: the categories, purposes, sources, sharing and your rights.

California residents

Medical information (CMIA). Krates keeps your medical information on your iPhone, and we do not hold it. It is disclosed only as you direct: each AI feature sends the information it lists to Google, through our relay, only after you allow it on that feature's permission screen, and you can withdraw that permission at any time in the app. We never sell it or use it for marketing.

Your privacy rights (CCPA). In the last 12 months, the personal information we or our service providers handled was: a pseudonymous device key and the hashed code made from it (identifiers); the counts and estimated cost of AI requests (usage information); and, only for the AI features you allow, the health and food information they list (sensitive personal information), passed to Google and not kept by us. It all comes from your device. We use it only to provide the features you ask for and to keep the service running and within budget. We disclose it only to the service providers named above. We do not sell or share personal information, and we use sensitive personal information only to provide the service. You have the right to know what we hold, to have it deleted or corrected, to limit the use of sensitive personal information, and not to be treated differently for using these rights. You may use an authorised agent.

Requests

To ask what we hold, to delete or correct it, to withdraw consent or to appeal a decision, email [email protected] with "Privacy request" in the subject, your state, and what you'd like done. Because Krates keeps your data on your iPhone and we hold nothing that names you, we will usually answer by explaining exactly what we hold and showing you how to delete the rest in the app. We answer within 45 days, and there is no charge. More help is on the support page.

Who is responsible

Lizwise Elv LLC, a California limited liability company, which makes Krates.

Contact

[email protected]

Changes

If this policy changes in a way that affects what leaves your iPhone or who handles it, the change will be described here with a new date above, and called out in the app before it takes effect.

26 October 2026: rewritten in full. It now describes Eat or Skip, recipe ideas, Polar and Withings, and Epic MyChart; names Google's Gemini paid service, Cloudflare and Open Food Facts; says every AI feature is off until you allow it; adds the relay's daily usage counts (35 days, first-seen day up to 400 days) and thumbs counts (off for now); sets 18+; and adds the California, Washington and Nevada sections.

Krates · Terms of use · Support · Consumer health data