Core Architectural Philosophy: Local-First and Privacy by Design
Your health data is deeply personal and belongs exclusively to you. Cana·Med AI stores your biometric data and medical cannabis logs locally on your device by default, requires no account registration, and contains zero third-party advertising SDKs or tracking pixels.
1. Introduction & Core Privacy Principles
Cana·Med AI ("we", "our", or "the application") is committed to protecting the privacy, confidentiality, and autonomy of your personal health data.
On-Device Data Storage by Default: Your raw biometric measurements, medical cannabis logs, notes, and derived scores are stored locally in the app's private Android storage sandbox. The Room SQLite database file is not encrypted at the application layer (no SQLCipher or custom database encryption is employed). App-private storage sandboxing prevents access by other installed applications, but sandbox isolation alone is not encryption; protection of data at rest depends on Android OS File-Based Encryption (FBE) provided by device hardware when lock screen credentials are active.
No Mandatory Accounts: Cana·Med AI does not require you to create an account, register an email address, or provide personal identifying information to use the application.
No Commercial Data Sales or Advertising: We do not sell, rent, monetize, or broker your personal or health data to advertisers, insurance providers, pharmaceutical companies, or third-party data brokers. Zero advertising SDKs are included in the application.
Purpose-Limited External Data Flows: Network access is used solely for features you explicitly configure or initiate: Oura sync, cloud-AI requests, food-product lookup, and nutrition-database search. The app does not include advertising or cross-app tracking SDKs.
Transparent Intelligence: You have complete visibility and control over what the intelligent companion (Lerox) remembers and uses to generate observations.
2. Categories of Data Processed
Cana·Med AI processes data solely to provide personal wellness insights and observational learning:
A. Health & Biometric Data (Via Android Health Connect)
With your explicit runtime permission, Cana·Med AI reads biometric records via the Google Health Connect API:
Storage & Boundaries: Health Connect data is cached locally on your device and is not transmitted to advertising or analytics services. If you deliberately use a cloud-AI feature, relevant health context may be included in the request after minimization; review provider terms before sending.
B. Medical Cannabis & Therapy Information (User-Entered)
Therapeutic Observations: Self-reported symptom relief (pain, anxiety, insomnia, nausea), observed side effects, and subjective wellness ratings.
Storage & Boundaries: Stored strictly on-device in application-private storage.
C. Connected Device Telemetry (Direct Bluetooth Low Energy)
When paired with compatible therapy devices (e.g., Dr. Dabber Switch 2, Puffco Peak Pro), the app reads device battery levels, heating chamber temperatures, session durations, and cycle counts locally via Bluetooth Low Energy.
Storage & Boundaries: Processed and stored 100% locally on-device.
D. Intelligent Companion Memory (Lerox Context)
User preferences, personal health baselines, goals, and conversational context with the Lerox assistant.
Storage & Boundaries: Stored locally on-device in the knowledge memory table.
3. How Data is Used & Processed
Personal Baseline Computation: Rolling statistical models (mean, standard deviation, variance) are computed directly on your device to establish your personal physiological baselines.
Observational Association (Study Me AI): Within-person statistical algorithms analyze logged medical cannabis sessions against subsequent changes in HRV, sleep quality, and recovery. These represent observational associations and do not establish clinical causation.
Proactive Intelligence: The app evaluates local data to generate daily summaries ("What Matters Now") and recovery recommendations.
4. Third-Party Integrations & Network Boundaries
Health Connect: Governed by Android system permissions. Data retrieved from Health Connect is processed on-device and is never transmitted to external advertising networks.
Oura Ring API (Optional): If connected, OAuth tokens authenticate sessions via OAuth 2.0 PKCE. Biometric summaries are cached locally. Tokens are secured in Android KeyStore with AES-256-GCM.
External AI & Cloud Processing (Optional): Core calculations and rule engines operate 100% offline. If you interact with cloud AI via Lerox Advisor, queries and selected context are sent to the provider you configured. Free-text inputs cannot be guaranteed de-identified.
Food and Nutrition Services: Barcode values and food search queries are sent to Open Food Facts and USDA FoodData Central. Label OCR executes locally on-device.
5. Security & Encryption Standards
On-Device Database Storage & Encryption Status: The Room SQLite database file (lerox.db) is stored within the application's internal private storage sandbox (/data/user/0/com.lerox.ai/databases/), inaccessible to other installed applications. The SQLite database file itself is not encrypted at the application level (no SQLCipher or application-layer database encryption is implemented). Protection of database contents at rest relies entirely on device-level hardware encryption (Android File-Based Encryption / FBE) active when the device has lock screen credentials (PIN, pattern, password, or biometrics) configured. Application-private storage sandboxing enforces process isolation, but app-private storage alone does not constitute cryptographic database encryption.
Application Cryptographic Encryption (Credentials & Backups): Sensitive third-party API credentials and OAuth tokens (such as Oura tokens) are encrypted at rest using AES-256-GCM with keys managed by the Android KeyStore. Hardware-backed security (TEE/StrongBox) depends on device capabilities. User-initiated exported backup archives are encrypted using AES-256-GCM authenticated envelopes with PBKDF2/KeyStore key derivation.
Network Security: Outbound services use HTTPS/TLS with Android certificate validation. The negotiated TLS version depends on the device and service.
Backups: Android application backup is explicitly disabled (android:allowBackup="false") in the application manifest to prevent unencrypted database replication to Google Drive or external backup providers.
6. User Control, Export & Deletion
Cana·Med AI provides an authoritative Privacy & Data Control Center within the application:
Structured Data Export: Export supported categories (preferences, sessions, prescriptions, Study Me records, personal memories, baselines) as JSON.
Granular Deletion: Selectively delete individual sessions, specific health metric categories, or connected device history.
All Local Data Wipe: Clear the Room database completely with a single tap from the Privacy & Data Control screen.
Memory Inspection: View and manage every discrete memory item stored by Lerox.
7. Children's Privacy
Cana·Med AI is intended strictly for adults (ages 18 and older, or the legal age of majority in your jurisdiction for medical cannabis participation). We do not knowingly collect or process data from children under 18.
8. Medical & Legal Disclaimer
Cana·Med AI is not a medical device. It is not intended to diagnose, treat, cure, or prevent any disease, condition, or physiological disorder.
Cana·Med AI does not provide clinical medical advice, prescribe treatments, or alter medication regimens. Always consult your prescribing physician, clinical cannabis specialist, or qualified healthcare professional. Cana·Med AI does not sell, dispense, or deliver cannabis, prescription medications, or controlled substances.
9. Contact & Data Protection Inquiries
If you have questions, concerns, or requests regarding this Privacy Policy or your personal health data: