Privacy Policy (draft)
This page describes how Aro actually handles data today, including the health readings the Aro app can read from Apple Health and Health Connect and, since version 1.2, wearables, provider records and lab reports. It will be replaced by a reviewed, binding Privacy Policy before Aro is generally available.
Draft — pending legal review. This is not yet a binding policy; treat it as an honest description of current practice, not a legal document.
What Aro collects
Your account details (name and email address, held by our sign-in provider); what a caregiver enters about a senior, such as their name, phone number, medications and schedules; summaries and transcripts of companion phone calls; safety events such as an SOS press; only if the senior agrees in the app, health readings from their phone's Apple Health or Health Connect; and, only after someone in the circle gives permission for that kind of data, readings from a connected wearable, records from a health provider's patient portal, and lab reports a caregiver uploads. The Consumer Health Data policy explains the health-related items in more detail.
The Aro app
The Aro app for iPhone and Android signs in with the same account as the website and shows your family's medications, circle, readings and alerts from Aro's servers. It contains no advertising, and no analytics or tracking software. If the senior agrees, it reads the health readings described below from Apple Health (iPhone) or Health Connect (Android); it never writes anything to them. If a caregiver allows notifications, it registers the phone for push alerts. Your sign-in session is kept in the phone's secure storage.
Apple Health and Health Connect
Aro reads only the readings the senior chooses on the consent screen, from this list: steps, resting heart rate, heart rate, weight, blood pressure, blood glucose and sleep — with the time of each reading and the name of the device that recorded it. The senior agrees in the app first, on their own phone (or a helper confirms the senior has agreed), before the phone's own permission prompt ever appears, and Aro keeps a record of what was agreed and when. The readings are shown only to the senior's care circle — the people in the family circle — in the Aro app and website. They are stored on Aro's servers, not in iCloud. They are never used for advertising or marketing, never sold, never shared with data brokers or other third parties, never used to train AI, and never used for any purpose other than showing them to the care circle. Aro's use and transfer of information received from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements. Aro shows readings as they were recorded and does not interpret them: it is wellness software, not a medical device, and it does not watch readings for emergencies.
Wearables, provider records and lab reports
Each of these stays off until someone in the circle gives permission for it in the app, and that permission is recorded: who gave it, on which wording, and when. Wearables: if you connect an Oura, Fitbit (through Google) or Withings account, Aro reads readings such as steps, heart rate, resting heart rate, sleep, weight and blood pressure through that company's official connection. Garmin and Whoop are not available yet. Provider records: if you connect a health provider's patient portal through SMART on FHIR (today only Epic's public test system), Aro reads, without changing anything, a copy of what the portal releases to the patient: conditions, allergies, immunizations, medications, lab and vital-sign results, reports and basic patient details. Apple Health Records will work the same way if it is switched on; it is not available today. Lab reports: a caregiver can upload a PDF or a photo of a lab report. Aro keeps the original file so you can always see where a value came from, and values are saved only after a person checks and confirms them on screen. If optional automatic reading is switched on, the file is sent to Anthropic's AI model to suggest the values for that review; when it is off, the values are typed in by hand. Aro shows what these sources say, with where and when each item came from; it does not interpret results or give medical advice. Access tokens for connected accounts, provider records, lab files and review drafts are stored encrypted, with a key kept apart from the database.
Data isolation
Every family's data is scoped to that family's account (a Clerk Organization) and to nothing else. No page or action in Aro can be reached with another family's identifier.
We don't sell data
Aro does not sell personal data or health data, does not share it with data brokers, and has no advertising business. Health data is never used for advertising or marketing.
Who else touches your data
Aro uses a small number of providers to operate, and only to run the product for your family: sign-in (Clerk), database hosting (Neon), web hosting (Vercel), rate-limit counters (Upstash), telephony (Twilio), email alerts (Resend), push notifications (Expo, which passes them to Apple and Google to deliver), and AI providers for the voice companion (Anthropic, and ElevenLabs or AssemblyAI where configured). If automatic lab-report reading is switched on, uploaded lab files are also sent to Anthropic for that one purpose. The wearable companies and health providers you connect send data to Aro; Aro sends them nothing about your family beyond what their sign-in requires. A push notification carries only the senior's first name and what needs attention, such as a medication name, never a health reading. Readings from Apple Health, Health Connect, wearables and provider records are never sent to the AI providers.
Keeping and deleting data
Data a household keeps in Aro — medications, readings, confirmed lab reports, appointments, the care team — is kept while the household uses Aro, and can be deleted in the app at any time (Settings › Health connections for phone readings, Settings › Privacy for everything else). Some data is also deleted automatically: sign-in states for connecting an account as soon as they expire; companion call transcripts a year after the call; companion memories a year after they were last mentioned; lab reports nobody confirmed after 180 days, or after 30 days if rejected or unreadable; records from a provider connection that is no longer active a year after they were last retrieved; and copies of failed background work within 90 days. The access keys for a connected account are deleted the moment it is disconnected. The log of who viewed or changed health data is kept for 12 months, then deleted automatically. Aro set these periods on October 21, 2026; like the rest of this page, they are pending legal review. Lab values typed in by hand are not affected by deleting phone readings.
Seeing, downloading and deleting your data
In the app, Settings › Privacy shows each kind of data Aro asks permission for, lets the person who gave a permission (or a circle admin) withdraw it, which stops new data from that source at once, and offers to delete what it brought in. Anyone in the circle can download everything Aro holds for the household as one file. A circle admin can delete everything Aro holds for the household, after typing the senior's name to confirm; connected accounts are disconnected first, and only a record that the deletion happened is kept. Aro keeps a log of who viewed or changed health data, and it is included in the download. Your sign-in account itself is deleted through the account settings of our sign-in provider, or by emailing hello@arohealth.net.
Children
Aro is for adults who look after older adults. It is not directed at children under 13.
Questions
Reach us at hello@arohealth.net with any question about your data.