Privacy policy

Version of October 25 2026

Almist Personal Data Processing Policy

Version 1.0 of 25 October 2026

This is a translation for convenience. If it differs from the Russian version, the Russian version prevails.

1. General

1.1. This Policy describes how individual entrepreneur Nikita Alekseevich Lukin (TIN 532119156604, OGRNIP 326530000029242; the "Operator") processes personal data in the Almist service: the Android and iOS apps, the almistapp.com and almist.ru websites and the server they use (together, the "Service"). The Policy follows Russian Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".

1.2. Personal data requests: support@almistapp.com or support@almist.ru. Person responsible for organising personal data processing: Nikita Alekseevich Lukin.

1.3. Almist is a health self-monitoring app. It does not diagnose, prescribe or adjust treatment.

2. Whose data we process

Users — persons over 18 who have created an account. The Service is not intended for persons under 18.
Website visitors — only the technical data described in section 9; nothing needs to be entered to read the site.
Report recipients (doctors) — the doctor's report page requires no registration and no personal data.

3. Purposes, data, legal grounds and retention

Purpose	Data	Legal ground	Retention
Account and sign-in	email, password hash (bcrypt; the password itself is not stored); first name, last name (optional), date of birth (age in reports for a doctor), sex; VK ID or Yandex ID user number; time zone, language	performance of the Terms of Use (Art. 6(1)(5) of 152-FZ)	while the account exists
Self-monitoring diary: entries, charts, statistics, insights, reminders	health data: blood pressure, pulse, date and time, body position, arm, medication mark, input method, notes, tags; height, weight, hypertension, target pressure; medications, intakes, stock	written consent in electronic form (Art. 10(2)(1) of 152-FZ) — separate document "Consent to Personal Data Processing"	while the account exists or until consent is withdrawn
Entry history and recovery	previous versions of entries (up to 5 per entry) and deleted entries	the same consent	up to 12 months from the version being saved or the entry being deleted; without Pro versions are not kept and a deleted entry is kept for a day — for "Undo"
Report for a doctor by link or QR code	the fields and period you choose — an unchangeable snapshot	the same consent; shared only by your action	access — 2 hours after opening; the snapshot is deleted when no active access remains
Almist Pro and the trial	subscription details from the store (purchase number, product, term, status, auto-renewal); for the trial — a keyed hash of the device identifier; its link to the account is deleted together with the account	performance of the Offer (Art. 6(1)(5))	Pro data — 12 months after Pro ends; purchase records — 3 years after the paid period ends (handling claims); device hash — 3 years from the start of the trial
Support requests	request text, reply email, type, number, answer; email correspondence	performance of the Offer and consumer protection law (Art. 6(1)(2), (5))	3 years from the answer (handling claims), including after the account is deleted
Confirmation code emails	email, subject	performance of the Terms of Use	outgoing queue — 7 days; the text with the code is erased right after sending
Security, visit statistics and deletion of inactive accounts (clause 3.1)	days on which the account used the Service (no details of actions); failed sign-in counters	the Operator's legitimate interest in protecting the Service (Art. 6(1)(7))	while the account exists
Usage statistics and crash reports (AppMetrica)	see section 5.3	separate optional consent (Art. 6(1)(1))	until consent is withdrawn
Showing ads in the free version (without Almist Pro)	technical device and network data, IP address, App Set ID, information about ad impressions and taps — see 5.5	the Operator's legitimate interest: the free version is funded by ads (Art. 6(1)(7))	the Operator neither receives nor stores this data; Yandex LLC — under its own rules

3.1. An account without active Pro that has not been signed in to or used through the App (including automatic sync) for 24 months is deleted with all its data. If Pro has ended, deletion happens no earlier than 12 months after it ended. The Operator warns by email to the account address 30 and 7 days before deletion; an account is not deleted unless the warning has been sent. Signing in to the account cancels the deletion.

3.1a. The Almist Pro archive — previous versions of entries, deleted entries, medication stock and stock snapshots in intake marks — is kept for 12 months after Pro ends and is then deleted; the entries, medications and intake marks themselves stay. The Operator warns by email 30 and 7 days before deletion if the account has an email address; without one, the archive is deleted on schedule. If the mailbox does not accept the warning, the archive is deleted no later than 60 days after the deadline. Getting Pro again before deletion keeps the archive.

3.2. Your entries, health data and account data are not used for advertising, are not sold and are not passed to third parties for their own purposes. The ad module in the free version receives only technical device data (5.5). The Service makes no automated decisions that have legal effects for you.

4. How data is processed

4.1. Actions: collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer (in the cases in section 5), depersonalisation, blocking, deletion, destruction. Processing is automated.

4.2. Data is stored in a database in the Russian Federation, in a data centre of JSC Selectel. Personal data is not transferred across borders.

4.3. The app keeps a copy of your entries on the device to work offline; Android backup of app data is disabled. A photo of the blood pressure monitor screen is recognised on the device and is not sent to the server.

5. Who receives data

5.1. Processing on the Operator's behalf:

JSC Selectel (TIN 7810962785, Saint Petersburg) — hosting of the server, database and backups;
JSC TimeWeb (TIN 7810353960, Saint Petersburg) — email: confirmation codes and support correspondence;
Yandex LLC (TIN 7736207543, Moscow) — AppMetrica, only with your statistics consent.

5.2. Transfer by your action (these organisations process data as independent operators under their own rules):

VK LLC (OGRN 1027739850962, Moscow) — VK ID, and Yandex LLC (TIN 7736207543, Moscow) — Yandex ID, — when you sign in, register, link the service or confirm deletion on the website. The Service receives your user number and, with your permission on the service's screen, first name, last name, date of birth, sex and email address (email is the required way to contact the account; if the service does not pass it or you enter another one, the Service confirms the address with a code sent by email). Entries and health data are not passed to them; their tokens are not stored. The VK ID module in the app itself sends VK technical information about showing the button and signing in.
RuStore (Mnogo Prilozheniy LLC, OGRN 1237700094752 — payment agent) — when you pay for Pro: the account number as an internal order identifier. Card details are entered in the RuStore window; the Operator neither receives nor stores them.
A doctor or other report recipient — the data you choose: a PDF you send yourself, or a link / QR code with 2-hour access.

5.3. Statistics (AppMetrica) — only with separate consent: which screens were opened, facts of actions without their content, crash reports, technical device data and IP address. Measurement values, medications, notes, photos, questionnaire, name, email and account number are not sent. Details — in the "Consent to Data Processing for Statistics".

5.4. Data may be provided to public authorities where the law expressly requires it.

5.5. Advertising (Yandex Advertising Network) — only in the free version: one banner on the Home screen of the Android app. With Almist Pro no ads are shown and the ad module is not started; it is also not started before the app knows whether you have Pro.

The ad module of Yandex LLC (TIN 7736207543, Moscow) in the app itself sends Yandex technical device and network data (model, operating system version, language, connection type), IP address, App Set ID and information about ad impressions and taps. Yandex selects the ad and processes this data as an independent operator under its own policy (https://yandex.ru/legal/confidential/).
App Set ID is an identifier issued by Google Play services on the device. It is the same for apps of one developer on one device and is not linked to your name, email or Almist account. It is intended for statistics and fraud prevention (for example, against fake impressions and taps) and resets by itself: on a device reset, when all of the developer's apps are uninstalled, and if it has not been requested for 13 months.
Not sent: the device advertising identifier (Google Advertising ID), location, entries and health data, name, email and account number. Ads are not selected based on your interests — personalised advertising is turned off.
No ads are shown with Almist Pro.

6. Data protection

Transfer only over HTTPS. Passwords are stored as bcrypt hashes; secrets of doctor links and codes — only as HMAC. The server returns entries only to their owner. The administrator signs in with a password and a one-time code; their actions are logged. Daily database backups are encrypted (the decryption key is held only by the Operator, not on the server) and kept for no more than 7 days. Server access is by key only, and actions on the server are logged. JSC Selectel's infrastructure meets 152-FZ requirements (efficiency assessment report up to protection level 1).

7. Deleting data

7.1. You can delete your account with all data at any time: in the app ("Settings → Delete account"), on https://almistapp.com/delete-account (by email code, VK ID or Yandex ID) or by writing to support@almistapp.com. Data is deleted from the server immediately and from backups as they are replaced, within 7 days. Only purchase records (not linked to the account) and support requests with the reply email remain — for 3 years for handling claims, then they are deleted.

7.2. Withdrawing consent to health data processing equals deleting the account: without it the Service cannot keep entries. Statistics consent is withdrawn with the "Statistics and crash reports" switch in the app settings.

8. Your rights

You may: obtain information about the processing of your data and a copy of it (the app exports entries to PDF and CSV); require clarification, blocking or destruction of incomplete, inaccurate, outdated or unlawfully obtained data; withdraw consent; appeal against the Operator to Roskomnadzor or a court. Requests: support@almistapp.com; reply within 10 working days, extendable by up to 5 working days with reasons (Art. 14, 20 of 152-FZ).

9. Cookies and on-device storage

The website uses only technical cookies: page language (pd_lang, 1 year) and sign-in protection for VK ID and Yandex ID on the deletion page (pd_vk, pd_ya, 10 minutes). The theme choice is saved in the browser. There are no counters, ads or third-party scripts on the website.

10. Changes

The current version is published at https://almistapp.com/privacy and in the app ("Settings → Help and info"). The Operator announces material changes in the app. The Policy takes effect on publication.