← Back to Levamio Care Level Guide
Privacy Policy “Levamio Care Level Guide” (Levamio Pflegegrad-Lotse, app for iOS and Android)
1. Controller
NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO, Building A1, IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates (DIEZ License No. 67837), represented by Tassilo Peter Seitz. Levamio is a service of NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO (“we”).
Privacy contact and exercise of your rights: [email protected] (general support: [email protected])
EU representative (Art. 27 GDPR): We are not established in the EU. You can always contact us directly with any data protection matter. Data protection officer: none appointed at present.
2. Summary
- No account. We do not know your name or e-mail address.
- Your care diary stays on your device, encrypted. We do not receive it. Diary, overview, checklist and PDF export work offline and without AI.
- Only when you use an AI feature (more precise assignment of entries, explanation of a notice) is text sent to our server and our AI provider Anthropic (USA) – only after your explicit consent and additionally after you confirm each individual request, having seen the exact text beforehand.
- Before sending, the app replaces names and identifiers with placeholders (pseudonymisation).
- We do not store transmitted text on our server. Photos, audio or files are never sent.
- No tracking, no advertising, no analytics.
3. Overview
| Purpose | Data | Legal basis |
|---|---|---|
| Diary, overview, checklist, appointment, stored names, saved explanations (on your device only) | your entries, appointment date, checklist, names for pseudonymisation, explanations and drafts | We do not process these data; storage on your device: Sec. 25(2) no. 2 TDDDG |
| AI assignment of diary entries (optional) | pseudonymised text of selected entries (max. 40 entries of the last 30 days, excluding entries with a manually chosen assignment), entry dates, random entry IDs, consent information | Art. 6(1)(a), Art. 9(2)(a) GDPR (explicit consent incl. health data); Art. 6(1)(b) GDPR |
| Explanation of a care fund notice / assessment report (optional) | pseudonymised text you pasted (and possibly shortened), consent information | as above |
| Free quota, abuse and cost protection | random device ID (generated by the app, no hardware ID), stored only as a salted hash with counters; IP address (IPv6 truncated to /64) only as a daily re-salted hash | Art. 6(1)(f) GDPR; device ID on the device: Sec. 25(2) no. 2 TDDDG |
| Device attestation for free requests | iOS: Apple App Attest object and key ID; Android: Play Integrity token sent by our server to Google; one-time challenge | Art. 6(1)(f) GDPR |
| Reporting an AI result | reason, optional comment, technical data (prompt version, model, feature, language, app version); no content | Art. 6(1)(f) GDPR |
| Subscription check (only when needed, section 8) | random device ID as RevenueCat customer ID, subscription status, receipts, product, store country, device/app data | Art. 6(1)(b) GDPR |
| Operation and debugging | technical metrics without content, ID or IP (feature, outcome, duration, number of entries, tokens, number of replaced identifiers, rule interventions), ~10 % sample | Art. 6(1)(f) GDPR |
| Support | your message, e-mail address | Art. 6(1)(b), otherwise (f) GDPR |
You are not obliged to provide data; without consent all features except the AI features remain usable. No automated individual decisions (Art. 22 GDPR). The app does not calculate or predict a care level. We do not sell your data or use it for advertising.
4. Health data and data of the person cared for
A care diary and care fund letters contain health data (Art. 9 GDPR), usually about the person in need of care, who does not use the app.
- On your device you keep the diary for your own family purposes; we are not involved.
- For AI features we rely on explicit consent (Art. 9(2)(a) GDPR). Before first use you confirm in a separate checkbox that you are the person in need of care yourself or act with their consent, as an authorised representative or as a legal guardian. Without this confirmation our server rejects every AI request. Please inform the person cared for about this policy where possible.
- Data minimisation: Before sending, the app replaces names you stored under “More → Hide names” and detected identifiers (e.g. “Mr/Mrs …”, health insurance and pension numbers, IBAN, phone, e-mail, date of birth, street address, postcode with town, file reference) with placeholders such as “[Person 1]”. The mapping stays only in your device’s memory; the app restores names locally in the answer. Our server additionally replaces remaining direct identifiers. Detection is automated and not complete; free text may still contain indications of a person, which is why you see the text before sending and can shorten it. Pseudonymised data remain personal data.
5. AI features
Two-step consent: (1) Before first use, a dedicated screen explains what is sent to whom, that we store nothing on the server and that health data are concerned; AI features are only enabled once you tick the consent box, the representation box (section 4) and “I am at least 16 years old.” Regarding storage at Anthropic it states: “We do not store the text. According to Anthropic, it stores the request for up to 30 days for abuse detection (longer only if a violation of the usage policies is found) and does not use it for training.” (2) Before each individual request the app shows the exact text and requires another tick. Without these confirmations our server rejects the request.
Process: the app pseudonymises the text and sends it via HTTPS to our server (a Cloudflare Worker); the server checks format and length (entries max. 2,000 characters, total max. 30,000), consent data, quota/subscription and limits, attestation for free requests, replaces remaining identifiers and forwards the text to Anthropic (Anthropic PBC, USA, model “Claude”); if overloaded or unusable, the request is sent once to another Claude model of the same provider. The answer returns to your app; the server removes statements predicting a care level or assessing chances of success, and self-calculated deadline dates.
No storage by us: our server stores neither the text nor the answer; processing happens in memory only. Logs contain only metrics without content or IDs. Results are stored only by your app, encrypted on your device.
At Anthropic: Anthropic acts as our processor under its commercial terms and Data Processing Addendum. According to Anthropic, API data are not used for training and are retained for up to 30 days for abuse detection; longer only if a usage-policy violation is found (then up to 2 years according to Anthropic) or required by law. Processing location: USA (section 10).
AI labelling and limits: AI results are labelled “AI-generated” (Art. 50 AI Act). They may be wrong or incomplete. The app is not a medical device, does not diagnose, gives no therapy or care recommendations and does not replace legal advice; for your individual case, free care counselling under Sec. 7a SGB XI or a care support point (Pflegestützpunkt) can help.
Withdrawal: You can withdraw consent at any time under “More → Withdraw consent” with effect for the future (Art. 7(3) GDPR).
6. Data on your device
Diary, profile (appointment, checklist, stored names), explanations and drafts are stored in the app’s local database (IndexedDB), encrypted with AES-GCM-256; the key is in the iOS Keychain (this device only, no iCloud sync) or the Android Keystore; Android cloud backup and device transfer are disabled. If you lose or change your device, the data cannot be recovered – export important entries as PDF. Settings: language, display options, consent time/version, number of free requests used, random device ID (visible under “More → Device ID”). Dictation: the app records no audio and has no microphone permission; if you use your keyboard’s microphone, your operating system or keyboard app processes the audio under its own terms (sometimes online). Photos are never uploaded; Live Text (iOS) / Google Lens (Android) text recognition is performed by your system or that app. Sharing, copying and PDFs only on your action; PDFs stay at most 60 seconds in the app cache. Delete via the app (“More → Delete all data” removes data and key) or by uninstalling.
7. Free quota, abuse protection, attestation
Random device ID, stored server-side only as a salted hash with counters in Cloudflare Durable Objects: rate limit (currently max. 8 AI requests per 10 minutes and 40 per day) 15 minutes to 2 days; free quota (currently 3 AI requests per device) 400 days; challenge 15 minutes; cached subscription status 24 hours. Free requests at most 6 times per internet connection and day, using only a daily re-salted hash of your IP address (IPv6 /64) for 2 days; plus a global daily cap. Attestation: Apple App Attest (iOS) or Google Play Integrity (Android; our server sends the token to Google); Apple/Google process device and app data as independent controllers, possibly in the USA. Legal basis Art. 6(1)(f) GDPR. A request in which no care letter is recognised or no entry is assigned does not count.
7a. Reporting a result
Reason, optional comment (please no names or health details) and technical data; content is never sent and our server rejects it. Stored in Cloudflare Workers KV without device ID or IP, deleted automatically after 90 days; rate-limited via hashes (max. 10 per device and 30 per connection per day). Art. 6(1)(f) GDPR.
8. Subscriptions
Purchased via Apple App Store or Google Play (independent controllers for payment). We receive no payment data. RevenueCat (RevenueCat, Inc., USA) manages subscriptions as our processor (random device ID as customer ID, receipts, status, product, price, store country, technical data, IP). Only when needed: when you open the paywall, purchase/restore, or your free quota is used up or a subscription is known; a customer record may be created at RevenueCat. RevenueCat receives no health data. Art. 6(1)(b), for checking whether a subscription exists Art. 6(1)(f) GDPR.
9. Retention
Transmitted text and AI answers on our server: none. Anthropic: up to 30 days (section 5). Hashes and counters: as in section 7, then automatic deletion (possibly reconstructable at Cloudflare for up to 30 days). Reports: 90 days. Metrics/logs: max. 7 days. RevenueCat: for the subscription term and statutory retention. Device data: until you delete them. Support requests: up to 3 years.
10. Recipients and third countries
Cloudflare, Inc. (USA; server, counters, reports, logs), Anthropic PBC (USA; AI features), RevenueCat, Inc. (USA; subscriptions) as processors; Apple and Google (Ireland/USA) as independent controllers. USA: EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR) where the recipient is certified, otherwise Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary measures (pseudonymisation, encryption in transit, no storage by us). Your consent expressly covers the transfer to Anthropic in the USA (Art. 49(1)(a) GDPR as a supplement where no adequacy decision applies; risk: possible access by US authorities without equivalent legal protection). UAE: we are established in the UAE (no adequacy decision); diary and letter contents do not reach our systems there because we do not store them.
11. Your rights
Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection to processing based on legitimate interests (21) and withdrawal of consent (7(3)). We only hold hashes with counters and, for subscriptions, data at RevenueCat; please provide the device ID from “More → Device ID” (Art. 11 GDPR). These rights also apply to the person cared for; as we store no content, we generally cannot attribute data to them. You may lodge a complaint with a supervisory authority, in particular in the EU/EEA state of your habitual residence.
12. Children
AI features only from age 16 (cf. Art. 8 GDPR), confirmed by a separate checkbox; otherwise the server rejects requests.
13. Security
HTTPS, pseudonymisation before sending, preview and per-request confirmation, no content storage on the server, server-side replacement of remaining identifiers, instruction to the AI to treat content as data, schema validation and removal of predictions, salted hashes, attestation for free requests, emergency switch for AI features, encrypted on-device storage with key in Keychain/Keystore, no Android cloud backup.
14. Changes
We update this policy when features, providers or the law change; if your consent is affected, the app asks again. Current version in the app and at https://levamio.com/apps/pflege/privacy.
As of: 20 Oct 2026