Skip to main content

Privacy Policy

Last updated:

Who we are

Achey is operated by Styr På (CVR: 40620184, styrpaa.dk). Contact: [email protected].

Your data is yours

Achey is designed with privacy at its core. We collect only what's necessary to provide the service, and we never sell your data.

We follow the principles of GDPR: data minimisation, purpose limitation, and transparency. You are always in control of your information.

What we collect

  • Email address: Used for authentication only
  • Health data you enter: Pain entries, medications, and any notes you choose to add
  • Preferences: Your timezone, locale, and display settings - so the app works as you'd expect

When we generate summaries using AI, no additional personal data is created or stored beyond the summary itself. The AI does not retain or learn from your data.

The health data you enter (pain entries, medications, notes) constitutes special category data under GDPR Article 9 and is subject to additional protections.

Legal basis for processing

We process your data on the following legal bases:

  • Your email and preferences are processed to provide the service (GDPR Art. 6(1)(b) - contractual necessity).
  • Your health data is processed based on your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)). You give this consent when you create your account and begin entering data.

You may withdraw your consent at any time by deleting your account. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

What we don't do

  • We don't track you across the web - no third-party analytics, no pixel tracking, no fingerprinting
  • We don't sell, rent, or trade your data to third parties - not now, not ever
  • We don't use advertising or third-party cookies - only essential session cookies to keep you signed in
  • We don't share your health information with anyone - not insurers, not employers, not advertisers
  • We don't build profiles about you or categorize you based on your health data
  • We don't make automated decisions that affect you - your data is for your benefit only

Website analytics

We use Matomo, a privacy-focused analytics tool, to understand how people use Achey. Here's what makes it different from typical analytics:

  • Self-hosted in Denmark - Matomo runs on our own servers in the same Danish datacenter as your data. No data is sent to Google, Facebook, or any third party.
  • No cookies - we don't use tracking cookies. Your browser isn't tagged or followed.
  • Fully anonymized - IP addresses are masked, and we cannot identify individual users. We see aggregated patterns (which pages are popular, which features are used), not personal behavior.
  • Do Not Track respected - if your browser sends a Do Not Track signal, we honor it completely.
  • Your health data is never included - analytics only covers basic page visits, not your migraine entries, medications, or any personal information.

This approach is fully GDPR-compliant and does not require cookie consent, as no personal data is collected or stored.

Where your data is stored

Your data is stored in a Danish datacenter, subject to both GDPR and Danish data protection law (Databeskyttelsesloven).

All data is encrypted with TLS 1.2+ in transit and AES-256 at rest. Database access is strictly restricted and all access is logged.

AI processing

When you request a summary, we use a locally hosted AI model to identify patterns in your data. The AI runs in the same Danish datacenter where your data is stored.

  • Your data is never sent to external AI providers - no OpenAI, no Google, no third-party AI services.
  • Your data never leaves the datacenter for AI processing. Everything happens on our own servers.
  • The AI does not learn from your data. Your entries are processed on demand and are not used to train or improve any model.

International data transfers

Your data is not transferred to any country outside the EU/EEA. All processing, including AI processing, takes place within Denmark.

Your rights

Under GDPR, you have specific rights regarding your personal data. You can exercise these at any time:

  • Right of access (indsigtsret) - request a copy of all your data
  • Right to rectification - correct any inaccurate data
  • Right to erasure - delete your account and all associated data
  • Right to data portability - export your data in a standard format (PDF or CSV)
  • Right to object - object to specific processing of your data
  • Right to restriction - request that we limit the processing of your data in certain circumstances
  • Right to withdraw consent - you can withdraw your consent at any time. This does not affect the lawfulness of processing before withdrawal.

You can export your data as PDF or CSV at any time from your settings. No need to ask - it's built right in.

If you have questions about your data or wish to exercise any of these rights, contact us. We respond within 30 days.

You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark. Website: datatilsynet.dk.

How long we keep your data

While your account is active, we keep your data so you can access your full history and patterns.

When you delete your account, all your personal data - entries, medications, settings, and your email address - is permanently removed within 30 days.

Encrypted backups may retain data for up to 90 days after deletion, after which it is permanently erased.

Data breaches

In the unlikely event of a data breach that poses a risk to your rights, we will notify you without undue delay, as required by GDPR.

Children's privacy

Achey is not intended for children under the age of 13. We do not knowingly collect personal data from children. If you are between 13 and 16, you may need a parent or guardian's consent depending on your country's rules. If you believe a child under 13 has created an account, please contact us and we will remove it.

Changes to this policy

If we make meaningful changes to this policy, we will notify you by email before the changes take effect.

Contact

Questions about your privacy or your data? Reach out to [email protected]