Peri-Lens Privacy Policy
Effective and last updated: October 14, 2026
Scope
This policy explains how Focalward LLC handles information in Peri-Lens. Peri-Lens is a personal observation and appointment-preparation tool. It does not diagnose, recommend treatment, interpret tests, or monitor emergencies. Feature availability depends on your installed build, access, and service environment. This policy describes the data handling of enabled features; it does not mean every feature is publicly released.
Local-first record
Your complete Peri-Lens record is stored on your device by default. It can include profile preferences, custom symptoms and tags, check-ins and notes, care-plan entries, personal trials, imported health information, symptom episodes, changes, appointment snapshots, weekly reviews, and summary drafts. No account is required to use the local record. The native local journal is not app-encrypted at rest. App lock is an additional device-access check, not database encryption. Native builds request exclusion from automatic device backup/transfer; this is not a guarantee or deletion of older platform copies.
Store access and previously issued eligibility
Apple or Google starts an eligible one-calendar-month Plus trial only after you choose monthly or annual Plus and confirm the subscription, its renewal and future charge in the store. Downloading, onboarding or restoring a journal does not start a trial. Local journaling and store billing do not require a Peri-Lens account. Previously issued complimentary access retains its original terms and expiry; no new app-managed complimentary trial is issued. Legacy protected eligibility keys, original deadlines, installation/access bindings and aggregate accounting/security records may remain while their policy operates to prevent resetting previously issued access or allowances. Account-owned links are removed on account deletion. Raw receipts, attestation tokens and device identifiers are not diagnostic log content. These pseudonymous records are not a promise of anonymity. After access ends, new logging and uploads stop; saved-record reading, export, deletion and authenticated recovery remain available.
Subscription billing and AI access
Apple or Google processes the selected auto-renewing subscription; the store displays current localized pricing, trial eligibility, renewal period and future charge. RevenueCat supports subscription status and restoration and may process an anonymous app-user billing identifier or a connected account identifier, purchase, subscription, entitlement and transaction information and applicable SDK technical metadata. Signing in may associate billing information with the account. RevenueCat does not receive the health journal, imported health measurements, check-ins, notes, audio, AI content, sync phrase/key or encrypted journal document. The Peri-Lens service retains normalized access dates/status, safe source identifiers and aggregate monthly AI/transcription usage. Public store trials include non-AI Plus; transcription, appointment-summary drafting and weekly-insight drafting require verified paid access for public customers. Independently approved beta/reviewer/owner grants can enable those features in their authorized environment without starting billing. Each transfer still needs separate consent and metered limits apply. Previously issued grants/access retain their terms. Restore purchases restores subscription access, not journal contents.
Exports and sharing
Peri-Lens exports information only after you choose an export or copy action. Files or text you share with another person, clinician, app, or service are then handled by that recipient or service.
Connected health
Apple Health and Health Connect access is optional and read-only. You choose the individual sleep and activity measures to import. Cycle access is a separate choice and permission request. Peri-Lens does not write to either health store and does not treat missing permission or missing measurements as zero. Imported measurements become part of your journal and are included in an encrypted backup if you upload it. You can revoke access in Apple Health or Health Connect settings; revocation stops future reads but does not remove measurements already imported into Peri-Lens.
Optional encrypted sync
Encrypted sync requires a Peri-Lens account and a separate sync passphrase. The app encrypts the complete record on your device using AES-256-GCM before upload to Amazon Web Services. Focalward stores the encrypted envelope, account owner identifier, update time, device identifier, and revision used to prevent conflicting updates. The service does not receive your passphrase, derived encryption key, or plaintext journal through sync; native apps keep the derived key in secure device storage. Uploads and downloads are explicit. Signing in alone does not upload or replace a journal. Recovery restores only the last successfully uploaded revision after you confirm Download and replace; export first if you want to preserve newer local edits. Losing the passphrase makes the encrypted remote record unrecoverable. A local-only journal can be permanently lost if the device is lost or the app is deleted. JSON exports are archives and cannot currently be imported into Peri-Lens.
Optional AI drafting
AI-assisted features are off by default. Each request presents a disclosure naming OpenAI and asks for confirmation before selected plaintext is sent through Focalward’s authenticated service. Appointment drafting sends visible brief facts, selected questions, and optional notes only when included. Weekly-insight drafting sends the visible calculated facts, evidence IDs, data gaps, and suggested questions; private notes, the complete journal, account details, and encrypted sync data are excluded. Appointment and weekly-insight drafting requests use OpenAI with store:false; that is not a zero-retention guarantee. Provider abuse-monitoring records may remain for up to 30 days, subject to provider exceptions or legal requirements. Generated text remains a draft until you review and explicitly save it; review again before sharing.
Optional voice check-ins
Voice capture requires microphone permission and an additional disclosure before audio is sent through Focalward to OpenAI for transcription. Recording alone does not send audio. Clips remain in app cache until discarded or approved for processing and are not added to encrypted sync. The app attempts cache cleanup after processing or discard; if cleanup fails, use Retry audio cleanup before recording or sending another clip. You review and correct proposed fields before saving them to your record. Transcription uses a separate OpenAI audio endpoint; the store:false setting described for drafting does not apply to that endpoint. Audio and provider records are governed by the applicable OpenAI service configuration and retention terms.
Accounts and service records
Optional account sign-in uses Amazon Cognito and, when offered, Apple or Google. These services process sign-in information such as your email, account identifier, and session/security information under their applicable terms. Focalward uses Amazon Web Services for its account, encrypted-sync, access, and operational services. Service metadata can include IP address, request identifier, route, status, request timing, technical errors, and security events. Application code does not intentionally log journal contents, ciphertext, audio, passwords, or authorization tokens; platform and error records can still contain technical metadata. Authorized support and operations staff can use an audited tool to look up limited account state, subscription/access status, aggregate allowances, and encrypted-sync availability/revision. That tool cannot retrieve your health journal, encrypted document, encryption keys, notes, or audio. Privileged infrastructure operators have broader access to service metadata and stored encrypted envelopes, but sync does not provide them the key needed to decrypt your journal.
Reminders and device permissions
Daily reminders are scheduled locally with your device notification service and use discreet text without symptom or note contents. Notification, microphone, connected-health, and biometric/passcode permissions are controlled through the app and operating-system settings. App lock relies on the device authentication service and does not give Focalward your biometric template.
Advertising and tracking
Peri-Lens has no advertising or session replay. Focalward does not sell your personal or health information or use it for cross-app advertising or tracking. Optional billing, sign-in, operational security, and support processing still involve the information described in this policy.
Retention and support correspondence
Your local journal remains until you delete it or the app/device removes its storage. The current encrypted cloud record has no automatic expiry and remains until account deletion or replacement by an explicit upload. Peri-Lens API access logs are configured for 14 days and service-function logs for 30 days. DynamoDB recovery history is configured for 35 days; account deletion does not immediately remove historical recovery copies. Protected staff audit records have a 365-day retention policy. Expiry and cleanup are asynchronous. Minimal account deletion markers have no automatic expiry and retain an owner identifier/key, not health content, to prevent delayed work recreating deleted data. These periods are not a universal purge deadline: historical/manual backups, retained archives, store/provider records, and copies you export have separate retention. Support email is handled in Google Workspace Gmail and retained under operator control without a fixed automatic deletion schedule. Contact support@focalward.com for help with access or deletion requests; the separate beta-report schedule is described below.
Deletion
Settings separates device deletion from authenticated account deletion. Device deletion removes the local journal, secure sync key, reminders and temporary exports. Account deletion fences delayed billing/provider work, removes account-owned access links/records, replaces sync ciphertext with a minimal deletion tombstone and deletes the sign-in identity before device cleanup. Minimal deletion markers and previously issued eligibility/accounting markers remain to prevent recreation or reset. Deletion does not cancel store subscriptions or erase independent store/provider retention, downloaded exports or shared copies. Device deletion does not remove the separate account or cloud record. Required cleanup failures are shown for retry; deletion is not reported complete while a required step remains incomplete. Temporary audio cleanup may need its separate Retry audio cleanup action.
Children
Peri-Lens is not designed or directed for children. Contact support@focalward.com if you believe a child has provided personal information through an account service.
Website and private beta guide
Visiting the website sends ordinary connection information, including your IP address and requested page, to the hosting service. The private beta guide uses a signed, secure access cookie containing your self-reported first name and an eight-hour expiry; it is separate from your Peri-Lens app account. You can remove it by clearing this site’s cookies. The guide includes an embedded YouTube video using youtube-nocookie.com. Loading the embed or following its YouTube link connects your browser to Google/YouTube, which can receive connection and playback information under its own privacy terms. The privacy policy and deletion instructions do not require beta-guide sign-in.
Optional beta website feedback
If you choose to send feedback through the invited beta website, Focalward receives your self-reported name, device and build details, checklist answers and comments, plus any screenshots with their comments and optional voice note you attach. Files stay in your browser until you send the report. Feedback is stored separately from your app journal and account in private Amazon Web Services storage for troubleshooting by authorized staff. Beta voice notes are not transcribed or sent to an AI provider. Reports and attachments become unavailable after 180 days; temporary staged uploads are scheduled for removal after one day. Database and object-storage cleanup is asynchronous, and protected backups may retain copies longer. In-app account or device deletion does not identify or delete a separate beta report; contact support@focalward.com for help requesting its deletion. Use fictional information and remove health details, names, messages, passwords and other sensitive information before sending.
Contact
For privacy questions or requests, email support@focalward.com. We may ask you to verify ownership before acting on an account request. Never send a password, sync passphrase, health export, or other sensitive information by email unless support specifically provides a secure method.