Your information. A clear explanation.

Who looks after your information?

Dini AI Inc., Waterloo, Ontario, Canada, operates Dini Health Intelligence and this website. This policy covers the Dini app and this website, including its early-access, recruitment and partner pages.

Our Privacy Officer is the person in charge of the protection of personal information at Dini AI Inc. and is accountable for how we handle it. Contact the Privacy Officer at privacy@diniapp.com for privacy questions, complaints, or requests to access, correct or delete your information.

What we collect and why

Account details let you sign in and manage your profile. Dini stores the biomarkers, medication records, allergies, goals, assessments and other information you choose to record so those features work. Chat messages and the relevant context you allow help generate AI responses. Optional device permissions support the features you enable, such as reminders and scanning. Records from earlier app versions remain covered by this policy even when those features are not highlighted on this website.

Some features send limited information to Dini’s servers to work. Product scores and food–medicine checks receive the product details you scan; your medication names stay on your phone. To rank your next step, Do next receives visit dates and times, whether you checked in today, your weekly focus status and refill settings, under temporary aliases and without names, notes or symptoms. These servers compute the result without saving the details you sent, apart from short-lived request records used to prevent abuse.

When you scan a barcode or search for a food, the app looks it up in Open Food Facts, a public food database, without your name or account. Medication searches look up Health Canada’s Drug Product Database the same way. Label photos you choose to scan are read by our AI provider in Montréal and are not stored.

Purchase providers process subscriptions and send us purchase status and an account identifier. We do not receive your full payment-card details. Technical information, such as device and app version, access logs and error information, helps operate and protect the service.

The app records anonymous usage events, such as which screens open and whether a scan finished. They carry no name, account or device identifier and are deleted after 89 days. Crash reports stay on your device. Messages you send through the app’s contact form are emailed to our support inbox and kept with your request.

The website’s product demonstrations use fictional information. They do not analyze your personal health records or send example questions to an AI service. Website forms collect information only when you submit them. Hosting providers may process technical access information needed to deliver and protect the website.

Early access and team applications

The early-access form requires your email and consent to early-access and launch emails. You may optionally provide your name, country or region, device preference, product interest and a message. We use these details to manage requests and contact you about availability. Joining the list does not create an app account or authorize processing of health records. Please do not include medical information.

The Join the Team form collects the application details and résumé you choose to submit. These are used to assess your application and contact you about recruitment. Early-access requests and applications are stored in Dini’s Supabase project, hosted in Canada. Public website visitors cannot read the submitted records or download stored résumés. Authorized project administrators can access them for the purposes described here.

Contact support@diniapp.com to withdraw early-access email consent or request access, correction or deletion of your submitted details. We retain form submissions as needed to manage the request or application, subject to applicable legal obligations.

Apple Health and Health Connect

Connecting Apple Health or Health Connect is optional and uses a separate system permission. You choose the available categories, such as activity, sleep and workouts. Dini only reads this data and never changes it. Declining does not stop you using manual records. Change access in your device’s health settings.

Your health-source data stays on your device. Only if you choose to share trend summaries with AI does a short summary leave your phone, and it is not stored.

Health connection permission is separate from AI processing permission. Connecting a health source does not authorize unrelated uses, advertising, selling health information or sharing it with an employer or insurer.

AI: one clear choice

Before optional AI assistance is enabled in the app, we explain that Google Cloud processes your messages and relevant Dini records, in Montréal, Canada, through our Supabase backend. Relevant context can include goals, allergies, medications, recorded readings and other information you authorize for the feature. We save your choice, including a decision to keep AI off. We do not ask before every message. The website’s prepared examples do not make live AI requests.

You can review or turn off AI processing in Settings. Turning it off prevents new AI requests; it does not recall information already processed or automatically delete saved chat history. A material change in the purpose or recipients requires a new choice. AI can make mistakes and does not replace medical care.

Who can process your data?

We do not sell health data, disclose it for targeted advertising, or automatically give it to employers, insurers, pharmacies or other family members. The account owner can view the household profiles they manage. Your own sharing or exports can disclose information to a recipient you choose.

Service providers process information only to run Dini: Supabase (accounts, records and server functions; Montréal, Canada); Google Cloud (optional AI; Montréal, Canada); Apple (App Store purchases, notification delivery and app integrity checks; United States); RevenueCat (subscription status; United States); Expo (notification delivery and app updates; United States); Resend (account-deletion codes and messages to support; United States); Apple iCloud Mail (our email inboxes; United States); Vercel (website hosting; United States); Bunny.net (food images in the app, which sees your device’s internet address; worldwide network); and Open Food Facts (barcode and food lookups; France).

Authorized support or security personnel may access information when necessary to resolve a request or protect the service. We may disclose information when legally required.

Your account and health records are stored in Montréal, and optional AI runs there too. Some providers are outside Québec and outside Canada, mainly in the United States, so some information may be communicated outside Québec. We do not claim that every service or backup remains in Canada. Contact us for details about a provider.

How we protect it

We use encrypted connections, encrypted storage and account access controls. Some app records have additional encryption with keys stored on the device. Cloud features necessarily process the information needed for their function; the entire service is not end-to-end encrypted.

No system can promise perfect security. Protect your account and device. Device-bound encrypted records may be unavailable after device loss or reinstall if their keys are lost. See Security for practical details.

Age and Max family profiles

Independent Dini accounts are for people aged 19 or older at launch. This is our product eligibility policy. Max lets an adult owner manage household profiles; these are not separate logins and do not grant access to another adult’s personal account.

Add someone only with their permission or lawful authority. For a child, you must be their parent or legal guardian. Use a nickname where possible; birth year is optional. Children’s profiles are for household organization, not a child’s independent health account. Do not add another person’s medical records to household notes. Contact us to correct or remove information about a child or a person added without authority.

Keeping and deleting information

We keep your account and health records while your account is open, so your features and history work. You can edit or delete supported records at any time. Deleting your account in Settings deletes the account and the health records in it. We may verify ownership before acting. Deleting the app alone does not delete your account or cancel a subscription.

A few limited records are kept after deletion: a record that the account was deleted, with a scrambled form of the email address, as proof that we completed the request, and support and security records where needed to resolve disputes, prevent fraud or meet legal obligations. Anonymous usage events are deleted after 89 days. Backups expire on our provider’s schedule. We review retained records at least once a year and delete what we no longer need.

Information you shared outside Dini is controlled by its recipient.

Your choices and questions

You can request access, correction or deletion, withdraw optional consent, or make a privacy complaint by emailing privacy@diniapp.com. We reply within 30 days and explain any limits on a request. Download my data, in the app’s Privacy & Security screen, gives you a copy of your account records in a structured, commonly used format (JSON). Turning off a permission may make the related feature unavailable.

Dini’s scores, matches and rankings are information for you. Dini does not make decisions about you, such as eligibility for a service, based only on automated processing.

If you aren’t satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, or the privacy commissioner in your province.

We date and version this policy. We will explain material changes and request additional permission where needed. Accepting the Terms does not silently turn on health connections or optional AI processing.

How we govern personal information

Our Privacy Officer approves how personal information is collected, used, kept and destroyed at Dini, and handles requests and complaints. Only people who need access to do their work can reach personal information, and they must keep it confidential.

Before we build a new system that handles personal information, or send it to a provider outside Québec, we assess the privacy risks and how to reduce them. We keep a register of confidentiality incidents. If an incident creates a risk of serious harm, we notify the people affected, the Commission d’accès à l’information du Québec and the Office of the Privacy Commissioner of Canada, as the law requires.

To make a complaint, email privacy@diniapp.com. We confirm that we received it, look into it, and send you our answer within 30 days.