Privacy Policy

This policy applies to anyone using our website, platform, or services, including:

• Corporate website visitors
• Akara Cloud users and account holders
• Customers purchasing our products or services

Akara collects different types of data depending on how you interact with our website and services.

For Corporate Website Visitors

• Contact details (e.g., name, email address, phone number) if you submit a contact form or subscribe to our newsletter.
• Technical information (e.g., IP address, browser type, pages visited) collected via cookies and analytics tools.

For Akara Cloud Users

Data necessary for platform functionality, including:

• Login details (required)
• User submitted or created data
• Timestamps around user access to the platform

We collect data in the following ways:

• Directly from users when they submit a contact form, request information, register an Akara Cloud account, or interact with the platform
• Indirectly from administrators who create or update accounts on behalf of users
• Through integrations with third-party systems, such as Electronic Health Record (EHR) platforms, where data is shared with us as part of delivering our services to customers
• Automatically through cookies
• Through analytics tooling on our corporate site (corporate site only)

Akara collects your data to:

• Provide and improve our corporate website, products, and services
• Respond to inquiries and customer service requests
• Send updates, newsletters, and promotional content (with your consent)
• Maintain accurate and up-to-date data records on the Akara Cloud platform
• Analyse corporate website traffic for improvement
• Meet our legal and regulatory obligations

We use your personal data only when we have a lawful basis to do so under the General Data Protection Regulation (GDPR). The legal bases we rely on are:

• You have given explicit consent (e.g., for marketing communications)
• Processing is necessary to fulfil a contract with you (e.g., providing Akara Cloud services)
• Processing is required to comply with a legal obligation
• Processing is in our legitimate business interests, provided those interests do not override your rights

Akara operates two regional backends hosted on Amazon Web Services (AWS) — one in the European Union (Ireland) and one in the United States. Customer data is stored in the region that corresponds to where you are based: EU customers’ data resides in our EU backend, and US customers’ data resides in our US backend. Data is not routinely transferred between regions.

We implement industry-standard security measures to protect your information from unauthorised access, alteration, disclosure, or destruction. Access to personal data is limited to employees and contractors on a need-to-know basis, and we regularly test our systems to ensure they remain secure.

We retain Akara Cloud user data for as long as the account remains active. Website visitor data collected through contact forms is retained for as long as necessary to fulfil inquiries and legal obligations. When data is no longer needed, we delete or anonymise it.

Data Breaches

In the event of a personal data breach, we will notify the relevant supervisory authority and affected individuals where required by applicable law. Under GDPR we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach. Where Protected Health Information (PHI) is involved, we will notify affected individuals and relevant authorities in accordance with HIPAA requirements, within 60 days of discovery. In practice, we aim to act significantly faster than these regulatory deadlines in all cases.

Akara stores customer data in the region where you are located. EU customer data is held in AWS infrastructure in Ireland, and US customer data is held in AWS infrastructure in the United States. Akara staff may access data across regions where necessary to provide our services and support. In such cases, we ensure that appropriate safeguards are in place to protect your data, and that access is limited to authorised personnel on a need-to-know basis. Where any cross-border transfer of personal data is required, we take all necessary measures to ensure your data is protected to an equivalent standard, including Standard Contractual Clauses approved by the European Commission where applicable.

Akara does not sell your personal data. We may share your data with trusted third parties under the following circumstances:

• Service providers assisting in website hosting, analytics, and communication
• Professional advisors such as lawyers, auditors, or consultants
• Legal and regulatory authorities when required by law or to prevent fraud
• In the event of a business transfer (e.g., merger, acquisition)

Under the General Data Protection Regulation (GDPR) every user is entitled to the following:

The right to access — You have the right to request copies of your personal data. We may charge a small fee for this service.

The right to rectification — You have the right to request that we correct inaccurate or incomplete information.

The right to erasure — You have the right to request that we erase your personal data, under certain conditions.

The right to restrict processing — You have the right to request that we restrict the processing of your personal data, under certain conditions.

The right to object to processing — You have the right to object to our processing of your personal data, under certain conditions.

The right to data portability — You have the right to request that we transfer your data to another organisation, or directly to you, under certain conditions.

The right to withdraw consent — Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

If you make a request, we have one month to respond. To exercise any of these rights, please contact us at info@akara.ai.

Akara’s platform may process a limited amount of Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA). Specifically, this arises where our operating room analytics systems integrate with Electronic Health Records (EHRs) using Medical Record Numbers (MRNs) to link non-sensitive operational data generated by our systems with patient records. We handle PHI only to the extent strictly necessary for this purpose.

Business Associate Agreements

Where Akara processes PHI on behalf of a healthcare organisation (a HIPAA Covered Entity), we act as a Business Associate under HIPAA. We enter into a Business Associate Agreement (BAA) with each such customer prior to processing any PHI. These agreements govern how PHI may be used, disclosed, and protected.

How We Protect PHI

PHI is subject to the same regional storage controls described in the International Data Transfers section above. In addition, we apply the following safeguards specific to health data:

• Access to PHI is strictly limited to personnel who require it to deliver the relevant service
• PHI is handled in accordance with the HIPAA minimum necessary standard — we collect and use only the minimum amount of PHI required for the stated purpose
• PHI is stored and transmitted using encryption at rest and in transit
• Our systems handling PHI are included in our regular security testing and audit programmes

PHI and Breach Notification

In the event of a breach involving PHI, we will comply with the HIPAA Breach Notification Rule. This includes notifying affected individuals, the relevant Covered Entity customer, and the U.S. Department of Health and Human Services (HHS) within the timeframes required by law (no later than 60 days from discovery). Where a breach involves both PHI and personal data subject to GDPR, the stricter 72-hour notification requirement to the supervisory authority will apply concurrently.

Patient Rights Under HIPAA

Where Akara processes PHI as a Business Associate, requests from individuals to exercise rights over their PHI (such as access or amendment) should be directed to the relevant healthcare provider (Covered Entity). Akara will cooperate with Covered Entities in fulfilling such requests as required under our BAAs and applicable law.

Akara maintains a formal Information Security Management System (ISMS) aligned with ISO 27001. Our approach to information security governs how all personal data — including PHI — is classified, handled, stored, and disposed of. Key elements of our security programme include:

• Data classification: data is categorised by sensitivity and handled according to corresponding controls
• Access controls: access to personal data is granted on a least-privilege, need-to-know basis and reviewed regularly
• Encryption: personal data is encrypted at rest and in transit using industry-standard protocols
• Vulnerability management: we conduct regular security testing, including penetration testing and vulnerability assessments
• Incident response: we maintain a formal incident response programme to detect, contain, and recover from security incidents
• Subprocessors: we maintain a register of third-party subprocessors who may handle personal data on our behalf, and conduct due diligence to ensure they meet our security standards. A list of subprocessors is available upon request

Our security controls are assessed as part of our SOC 2 audit programme. Akara pursues SOC 2 Type II certification to provide independent assurance of the effectiveness of our security, availability, and confidentiality controls.

Cookies are text files placed on your device to collect standard internet log information and visitor behaviour information. When you visit our website or platform, we may collect information from you automatically through cookies or similar technology.

Akara uses cookies to:

• Keep you signed in to Akara Cloud
• Remember language preferences
• Analyse corporate website traffic for improvement

We use two types of cookies: Functionality Cookies that recognise returning users and store preferences, and Analytics Cookies that track corporate website usage for insights and improvements. We do not use third-party marketing cookies.

You can set your browser to refuse cookies or remove them at any time. Some features of the platform may not function correctly without certain cookies enabled.

Our website may contain links to external websites. We are not responsible for their privacy practices, and we encourage you to review their policies before sharing any personal data with them.

Akara regularly reviews and updates its privacy policy. Any significant changes will be communicated via our website or by email. Any changes will be posted on this page and on our Akara Cloud web portals. This policy was last updated on 1st May 2026.

For any questions or requests regarding this policy, or to exercise your data protection rights, please contact our Data Protection Officer at info@akara.ai.

If you believe we have not addressed your concerns satisfactorily, you may contact the relevant supervisory authority for your region.

EU Customers — Information Commissioner’s Office (Ireland)

• Email: info@oic.ie
• Phone: +353-1-639 5689
• Address: 6 Earlsfort Terrace, Dublin 2, D02 W773

US Customers — HIPAA Complaints (HHS Office for Civil Rights)

For complaints relating to the handling of Protected Health Information (PHI) under HIPAA, US customers may contact the U.S. Department of Health and Human Services Office for Civil Rights (HHS OCR):

• Phone: 1-800-368-1019

US Customers — State Privacy Authorities

Depending on your state of residence, you may also have the right to lodge a complaint with a state-level privacy authority. California residents may contact the California Privacy Protection Agency (CPPA). Customers in other US states with applicable privacy laws should refer to their relevant state authority. We will endeavour to assist you in identifying the appropriate body upon request.