Data Protection Impact Assessment (DPIA)

1. Description of Processing

Aletheia is a user-side accessibility tool. It converts documents, images, and web content into accessible forms: optical character recognition, image description, content restructuring, and form labeling, with the result saved to a local library on the user's own device. This assessment covers the personal data processed to provide that service, to bill for it, and to maintain the audit records the service depends on.

• Nature: educational and general content translation into accessible formats, accessibility conversion, and audit logging of administrative and privileged actions.
• Scope: institutional deployments (Campus and Enterprise) and consumer users (Free, Student, Personal, Family, and Professional).
• Context: user-uploaded documents and images processed for translation, aggregate usage telemetry needed to apply plan limits, and institutional administrator identity.
• Purposes: providing the accessibility translation service, billing, and audit compliance.

2. Data Flows and Processing Paths

Aletheia has three processing paths. Which paths are available depends on the tier, and the cloud paths are off by default until the user turns them on.

• On-device (MobileVLM): processing happens entirely in the user's browser. No content leaves the device and there is no cloud data flow. This path is available on every tier (Free, Student, Personal, Family, Professional, Campus, and Enterprise) and is the always-available baseline.
• Enhanced AI (Personal and Family only): a Lonia-mediated cloud path. When the user opts in, the image they choose flows from the browser to a Lonia Cloudflare Worker, then to OpenRouter (United States hosted), and the description returns along the same path. Lonia pays OpenRouter using a Lonia-controlled API key. The image is not stored server-side beyond the synchronous request and response cycle. Enhanced AI is off by default and is capped server-side by an atomic procedure: 500 descriptions per month for Personal, and 1,000 per month shared across the family group for Family.
• Bring-your-own-key Enhanced AI (Professional): a user-invoked, browser-direct path. The user's image and the user's own API key flow from the browser to the AI provider (Anthropic, OpenAI, or OpenRouter) directly. Lonia never sees the API key or the image content on this path. This path is off until the user configures a key.
• Institution-managed bring-your-own-key Enhanced AI (Enterprise): an institution-managed, Lonia-mediated path. The institution's administrator enrolls one API key with Lonia's Enterprise Worker, which holds the key envelope-encrypted at rest and decrypts it in memory at request time to call the AI provider (Anthropic, OpenAI, or OpenRouter) on the institution's behalf. Seats never handle the key, and the key material is never returned to any client. The institution is billed by the AI provider under the institution's own account. On this path the request content transits Lonia's Enterprise Worker to the provider. This path is off until the administrator enrolls a key.

Healthcare Mode. The same three paths apply to medical documents. Recognition and reading of intake, consent, insurance and history forms, medication labels and guides, patient-portal pages, appointment and visit summaries, and bills or Explanations of Benefits happen on the device, on every tier. The account profile Lonia holds has no medical field: a form fill copies each value the user confirms into the user's clipboard, never a medical question or a signature, and leaves the profile unchanged, so no medical data enters the personal data Lonia processes. The Enhanced AI path is gated for these documents by a consent prompt that names the kind of document before anything is sent. Two audit actions record the mode without content: autofill_applied, one row per confirmed field naming the profile field and never its value, and patient_portal_scan_consented, written when the user accepts the consent prompt.

3. Necessity and Proportionality Assessment

The processing is limited to what each purpose requires, consistent with the data minimisation principle. User documents are processed on the device and are not stored on Lonia infrastructure; the personal data Lonia holds is limited to account identity, plan and billing status, the usage counts needed to enforce plan limits, and audit records of administrative and privileged actions. Retention is time-limited: institutional data defaults to 365 days per institution and is configurable per institution. The processing supports the full set of data subject rights: access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20), and objection (Article 21).

4. Risks to Data Subject Rights and Mitigations

The risks below are assessed against the processing described above, with the measure that mitigates each.

5. Right of Erasure (GDPR Article 17)

Users delete their own account in the app, and may also request deletion by writing to privacy@lonia.ai. Aletheia commits to fulfilling erasure requests within 30 days, consistent with GDPR Article 12(3).

Deletion cancels the subscriptions first. Every Aletheia subscription held for that person is found, on the account record and on every Stripe customer carrying that person's email address, cancelled, and read back from Stripe as cancelled. If any of those steps fails the deletion does not proceed: nothing is removed, and the person is told the account could not be closed because the cancellation was not confirmed. This is the assessed mitigation for the risk that a deletion leaves a live subscription billing a person who believes their account is gone. A Campus or Enterprise subscription is not cancelled by a personal deletion, because it belongs to the institution.

Two records survive an erasure, and only two, which is what makes the erasure assessable rather than open-ended. The first is a billing record for each cancelled subscription, holding the Stripe customer and subscription reference numbers, the plan, the billing period and the cancellation date, and no name, email address or account identifier; it is deleted automatically seven years after the cancellation. Its basis is GDPR Article 17(3)(b), a legal obligation for tax and accounting records, and Article 17(3)(e), the establishment or defence of legal claims. Lonia's assessment is that this record is pseudonymous and not anonymous, because Lonia and Stripe can link the reference numbers to a person; it is therefore treated as personal data for the whole seven years, and Recital 26 is not relied on for it. The second is the security log, retained with the person's identity replaced by a one-way code and identifying details removed.

In addition, Aletheia's Data Processing Addendum commits to cascade deletion on termination of an institutional subscription, with a 30-day export window for the Customer to retrieve data before final deletion. The behaviour that carries out that deletion is documented in the Security Whitepaper. It is enforced at the database level by foreign-key cascade constraints, applied to the Supabase schema by migration on August 24, 2026; it is a control in force, not a planned change. What this assessment does not claim is operational history: the end-to-end termination flow is confirmed by smoke testing in workstream B29 prior to first customer deployment, and no institutional termination has yet been exercised in production.

Write-once, read-many audit records are preserved where retention is required by applicable law, even after user deletion. These records hold metadata about actions that occurred, not user-generated content.

6. Right of Data Portability (GDPR Article 20)

Users export their personal data in the app as JSON: every record Lonia holds for their account, from every table, in a structured, commonly used, machine-readable format. The export is served by the application's GET /export/portable endpoint, recorded in the audit log as data_export_completed, on the basis of GDPR Article 20. The local library, which lives on the device, is exported from the product separately. The in-product path is described in the Privacy Policy.

7. Consultation

Aletheia's assessment is that residual risk is LOW to MODERATE after the mitigations described above. On that basis, prior consultation with a supervisory authority under GDPR Article 36 is not required. This position is reassessed on each review.

8. Review Cadence

This DPIA is reviewed annually, or on material change, whichever comes first. Material changes include an architecture change, a sub-processor change, a regulatory change, and any future migration of the Supabase primary data store to an EU region. On each review this page and the tagged PDF are regenerated together from the same source.

Change history

9. Related Documentation

• Security Whitepaper
• Data Processing Agreement (DPA) template
• Sub-processor list. For the Personal and Family Enhanced AI path, OpenRouter acts as a Lonia sub-processor. On the Enterprise institution-managed bring-your-own-key path, the institution-selected AI provider is invoked by Lonia's Enterprise Worker and is a Lonia sub-processor for that path. On the Professional browser-direct bring-your-own-key path, the AI provider the user configures is the user's own counterparty and is not a Lonia sub-processor.
• Scoped Standard Contractual Clauses (SCCs)
• Transfer Impact Assessment (TIA)
• Privacy Policy

10. Preparation of this DPIA

This DPIA is a description of Aletheia's processing and risk assessment. It is not legal advice and is not a signed agreement.