Privacy Policy
In plain words
- OlaWell is an organizer for health information you choose to add. It is not a medical service.
- We hold your account details and whatever you add: notes, questions, follow-ups, medication entries, readings and uploaded documents.
- We do not sell your information, show ads, or use analytics or advertising trackers.
- Voice entry is off until you turn it on. OlaWell never receives your audio and uses no transcription service of its own. It asks your browser to use its own on-device recognizer, and only starts if your browser says it can work locally. We cannot inspect what each browser does internally, and we have not tested this on every device.
- You can export your data and delete your account in Settings. Copies in backups are not erased on request. Section 11 explains this.
- Where your data is physically stored, and the exact backup periods, are not yet confirmed. We say so below instead of guessing.
1. Who runs OlaWell and how to reach us
OlaWell is operated by AFOLAOLA ("we", "us"). AFOLAOLA presents itself publicly as "Global Digital Solutions". We have not published a postal address or a corporate registration number, and this policy does not state one.
For privacy questions and requests, email privacy@afolaola.com. Other addresses: support@afolaola.com (help with the app), legal@afolaola.com (legal questions), security@afolaola.com (security concerns) and hello@afolaola.com (general). Please do not email passwords, reset links or health records.
2. What OlaWell is, and who it is for
OlaWell helps adults organize health information they add themselves, prepare for appointments and keep track of follow-ups. It does not diagnose, treat or give medical advice, it does not connect to hospitals or health-record systems, and it is not for emergencies. In an emergency, contact your local emergency services.
3. Information we collect and hold
| What | Where it comes from | Why we hold it |
|---|---|---|
| Account details: email address, display name, time zone, language, display preferences | You, when you register or change settings | To run your account and show dates, times and units the way you chose |
| Password (stored only as a salted one-way hash, never in readable form) | You | To let you sign in |
| Health-related information: appointments, preparation notes and questions, follow-ups, reminders, medication entries, health readings | You | To provide the organizer you asked for. This is sensitive information. Add only what you are comfortable storing. |
| Uploaded documents: PDF, PNG, JPEG and plain-text files, with the date, title and source you give them | You | To keep them in one private place and let you download them again |
| Sessions: a record that you are signed in (kept as a hash), when it was created, last used and when it expires | Created when you sign in | To keep you signed in and let you sign out other devices |
| Activity record: the names and times of account events such as sign-in, password change, export, deletion and accepting these documents | Created by OlaWell | So you can see what happened on your account, and for security. It holds no health content. |
| Privacy Policy and Terms acceptance: which version, when, and whether it was at registration or later | You, when you accept | To show which wording you agreed to. No IP address or device details are stored with it. |
| Voice settings: whether voice entry is off or on-device | You | To remember your choice |
| Request counters used to slow down abuse: a one-way hash of the route and the network address, with a count | Created by OlaWell | To limit repeated sign-in attempts. No readable network address is kept in this table. Rows are deleted after about a day. A hash of a network address is pseudonymous, not anonymous: someone who can try every possible address could work backwards from it. |
We do not ask for, and you do not need to provide, a health card number, home address, date of birth or phone number.
4. Health information is sensitive
Information about your health is among the most sensitive information there is. OlaWell stores what you add so that you can find it again. We do not read it to build profiles, and we do not use it for advertising or for any purpose other than running OlaWell for you. We do not interpret it: OlaWell does not score, diagnose or draw medical conclusions from what you record.
5. Where information is kept on our side and on your device
- Server and database. Your account, notes and records are stored in a database run for us by a hosting provider (see section 8). Uploaded documents are stored in object storage that we configure.
- Your browser. OlaWell sets one cookie,
ow_session, to keep you signed in. It is HttpOnly (page scripts cannot read it), SameSite=Lax, and marked Secure when the site is served over HTTPS. If you use voice entry, your browser's local storage keeps one small setting, the language you last chose for dictation. OlaWell does not otherwise keep your health information in local storage. - Installing OlaWell. If you add OlaWell to your home screen or install it, your browser keeps the app's files and one small offline page. The service worker only serves that offline page when you have no connection. It does not keep your records, API responses or documents for offline use, so OlaWell needs an internet connection to show your information.
6. Voice entry (optional)
Voice entry is off until you turn it on in Settings. Recording starts only when you press Start, never in the background. You always see and can edit the text before it is used, and nothing is saved until you press Save. You can discard it, or type instead.
- What this version does. The only option is "On this device only". OlaWell asks your browser to use its own speech recognizer in local-processing mode, and it refuses to start recognition unless the browser reports that local processing is available for your language. OlaWell never falls back to a server-based recognizer. OlaWell does not receive, transmit or store your audio. The text appears in your browser, and it reaches our servers only if you press Save, in which case it is stored like any other note.
- What we do not control. The recognizer is part of your browser. We rely on the browser's local-processing mode and on its report that the mode is available. We cannot inspect what the browser does internally. Language packs may be downloaded by your browser the first time. On-device recognition is currently offered only by recent desktop versions of Chrome and Edge. Many phones and other browsers do not offer it, and then the option is not available.
- Your phone's keyboard microphone. If you tap the microphone on your own keyboard, your phone or keyboard maker handles that audio under its own terms. That is outside OlaWell, and it may be processed in the cloud.
- Cloud transcription. This version of OlaWell does not use any cloud transcription service. Software for one exists but is switched off and cannot be turned on from the app. Before any cloud service is ever used, we will update this policy and ask for your separate agreement.
- Accuracy. Automatic transcription can get names, medicines, numbers, dates and times wrong. OlaWell highlights numbers, dates, times and medicine-like words so you can check them, but it cannot catch every error and never corrects them for you. You are responsible for checking the text before you save it.
7. Logs, diagnostics, analytics and error reports
- OlaWell has no analytics, advertising or tracking scripts. All pages, scripts and fonts are served by OlaWell itself, and the browser is told to connect only to OlaWell.
- Server logs record technical request details such as the request path, status code, time and network address. Request bodies, cookies and authorization headers are not logged. Notes, questions, documents and voice text are not placed in web addresses and are not written to our logs.
- When you delete your account, we log one line that contains only a random account number (no name, email address or health information). We keep it so that, if a database backup is ever restored, we can delete your account again. It is subject to the same log retention as other logs (section 8).
- OlaWell has no error-reporting service that sends data to third parties.
- Our hosting provider also keeps its own logs, under its own retention settings (section 8).
8. Service providers who handle data for us
| Provider | What it does | What it can see |
|---|---|---|
| Vercel | Runs the OlaWell website and application | Everything sent to or from OlaWell passes through its network, including request logs |
| Supabase | Hosts the database, and may host file storage | The stored account data, notes and records, and uploaded files in the form they are stored |
| Email delivery service | Sends welcome, email-confirmation and password-reset messages, only when email delivery has been set up | Your email address, first name and the message. Messages never contain your password or health information. |
These providers act for us in running OlaWell. They are not given your information for their own marketing. We do not control their systems, and their own terms and privacy notices apply to what they do. Whether email delivery is switched on at a given time is shown by whether the "Forgot password" feature works. The email service we plan to use is Resend; we will keep this table current when it is switched on.
9. Where data is processed
We have not yet confirmed and published the regions where our hosting provider and database provider store and process OlaWell data. Providers may use servers in countries other than yours, including outside Canada, and data may be accessible from those countries. We do not claim that your data stays in Canada or in any particular country.
10. How we protect information
- The site is served over HTTPS, and browsers are told to keep using HTTPS.
- Passwords are stored as salted one-way hashes (scrypt). Sign-in attempts are rate limited.
- Every request is checked against your account. Automated tests confirm that one account cannot read another account's records or files by changing identifiers.
- Uploaded files are not served from a public address. They can be downloaded only while you are signed in as the owner.
- When a file-encryption key is configured, which production deployments are set up to require unless the operator explicitly overrides it, OlaWell encrypts each uploaded file with AES-256-GCM before it is written to storage. The key is held in our server configuration. If the key were lost, the files could not be read. Health notes and records kept in database tables are not separately encrypted by OlaWell. Your database provider may encrypt its storage, but we have not independently verified that.
- OlaWell is not end-to-end encrypted. The people who operate OlaWell's systems could technically access stored data, so we limit who has that access to AFOLAOLA, and we do not routinely look at your records.
- OlaWell is new. It has not had an independent security review. No system is perfectly secure, and we cannot promise that unauthorized access will never happen.
11. Keeping and deleting information
| Information | How long we keep it | How it is removed |
|---|---|---|
| Account, notes, records, medication entries, readings | Until you delete them or your account | Delete individual items, or delete your account in Settings (password and typing DELETE required). The rest of your data is removed from our live database in the same step. Stored files are removed right after. If any file cannot be removed, the app tells you how many, and the failure is logged for manual cleanup. |
| Uploaded documents | Until you delete the document or your account | The stored file is deleted when you delete it. If a file cannot be removed at that moment, the failure is logged for manual cleanup. |
| Sessions | Up to 14 days by default, or until you sign out | Expired sessions are purged automatically. Changing your password signs out your other devices. |
| Activity record | While your account exists | Removed with your account |
| Privacy and Terms acceptance record | While your account exists | Removed with your account |
| Server and provider logs | Set by our hosting provider's settings. We have not set a shorter period. | Not removable on request. They hold no notes or documents. |
| Backups | Set by our database and storage providers' plans. We have not yet fixed or published a backup period. | Backups are not edited when you delete your data. Deleted data can remain in older backups until they expire. If a backup were ever restored, deletions made after it was taken would not automatically be re-applied, and we would need to repeat them. |
Copies you export or download, and anything you printed or shared yourself, are outside OlaWell's control once they leave it. We do not delete inactive accounts automatically.
12. Sharing and disclosure
We do not sell your information, rent it, use it for advertising, or send it to your doctor or to any AI service. We share it only with the providers in section 8 as needed to run OlaWell, with someone you ask us to share it with, or where the law requires or allows us to, for example to respond to a valid legal demand or to protect people from serious harm. Where lawful and practical, we will tell you before disclosing your information in response to a legal demand.
13. Your choices and controls
- See and change: your notes, records and settings, including your name, time zone, language and units.
- Export: Settings has an export of what you added, with or without your uploaded files (very large collections must be downloaded file by file).
- Delete: items one by one, or your whole account.
- Sign out other devices and change your password in Settings.
- Voice: turn voice entry off at any time in Settings.
- Read these documents again in Settings, where you can also see which versions you accepted.
14. Security incidents
If we learn of a security incident affecting your information, we will investigate and, where the law requires, tell affected people and the appropriate authorities. We can only reach you by email if email delivery is set up, so please also check our website for notices. To report a vulnerability or concern, email security@afolaola.com.
15. Children
OlaWell is for adults. You must be at least the age of majority where you live to create an account. OlaWell is not designed for children and does not knowingly collect information from them. If you believe a child has created an account, email privacy@afolaola.com and we will close it and delete the data.
16. Your privacy rights and complaints
Depending on where you live, privacy law may give you rights to see the personal information we hold about you, correct it, withdraw consent, have it deleted, and complain to a privacy regulator. Many of these you can do yourself in Settings. For anything else, or if you are unhappy with our response, email privacy@afolaola.com. We aim to reply within 30 days. You may also contact your privacy regulator. In Canada, that can be the Office of the Privacy Commissioner of Canada or a provincial regulator. We have not concluded which specific privacy laws apply to OlaWell, and this policy does not say that OlaWell complies with any particular law. OlaWell is not a healthcare provider, and we do not claim compliance with HIPAA or any other health-privacy regime.
17. Changes to this policy and version history
When we change this policy in a way that matters, we update the version number below and show a notice in the app the next time you sign in, asking you to read and accept the new version. The notice does not block access to your own records or your export. Existing accounts are never treated as having accepted a version they have not seen.
| Version | Date | Summary |
|---|---|---|
| 1 | 27 October 2026 | First complete version, written from how OlaWell actually works. Review version until an effective date is shown at the top of this page. |