Privacy Policy &
Our Methodology

Akrolimb Ltd operates this website and the Akrolimb app and is the data controller for your personal data. Akrolimb Ltd is registered in England & Wales, company number 17066080; our registered office address is held on the public register at Companies House and available on request. If a clinic refers you, your clinic is the controller for your clinical data and we act as its processor (see below). We're launching delivery to India soon; when we do, orders there will be sold by our group company Akrolimb Private Limited (CIN U32506GJ2025PTC171426), which will be a joint controller of that order information. For anything in this policy, contact info@akrolimb.com.

What we hold depends on how you use Akrolimb:

• If you scan with the app — your email address and the 3D scans of your feet you choose to send. Scanning needs no account, no name, no payment details.
• If you order insoles — your name, email, delivery address, phone number (for delivery), shoe size, your order history, and anything you send us in reviews, scan feedback, or support and refund requests. Payment is handled entirely by Stripe — your card details never touch our servers; we see only that payment succeeded and the last digits Stripe shows us.
• If you create an account — your sign-in email and password (stored only as a salted hash), and the scans and foot information you choose to save to it.
• If a clinic refers you — the foot photos, scans, and symptom details you upload through their secure link, with your explicit consent captured on the upload page. For clinic-managed patients, your clinic is the data controller and Akrolimb processes the data on its behalf.
• If you book a call or request a demo — your name, email, and any message, so we can hold your slot and get in touch. Video consultations are hosted on Microsoft Teams.
• If you just browse — almost nothing. We run no analytics and no advertising trackers. Our servers see your IP address transiently to protect against abuse (rate-limiting), and security logs record sign-ins and sensitive actions.

A scan is a 3D model of your foot's shape, captured by your phone's depth camera and uploaded to us over an encrypted connection. We use it for exactly one thing: designing and making your insoles. We never use scans to identify you, never sell them, and never share them except with the people making your pair (and your clinic, if they referred you).

• If you don't order — unclaimed scans are deleted automatically 7 days after your latest scan, files included. The app also has a "delete my scans" option that removes them immediately.
• If you order or save them to an account — your scan stays on file so future pairs can be designed without re-scanning. Account scans can be deleted by you at any time from your account; otherwise just ask us.
• Symptom details shared through a clinic's upload link are health information — we collect them only with your explicit consent, which you can withdraw at any time.

• To make and deliver your order (performance of our contract with you) — designing from your scan, printing, shipping, and the emails that keep you informed along the way.
• With your consent — clinic-referral uploads of photos, scans, and symptom details.
• Our legitimate interests — keeping the service secure (rate-limiting, security logs), answering your messages, and improving our design and manufacturing from order outcomes.
• Legal obligations — keeping order and payment records for tax and accounting law.

We don't run marketing email lists and we never sell, rent, or share your personal data with anyone for their own marketing. The emails you get from us are about your scans, your order, or your account. Two of them carry an offer: the email after you first send scans tells you your scans arrived and that they unlock a limited-time discount, and if you use our refer-a-friend feature we send a one-off invite to the friend's address you give us, naming you as the referrer. You can opt out of the scan offer email by deleting your scans, and we only email a friend an address you enter yourself.

• Unclaimed scans (you scanned but didn't order) — deleted automatically once the 7-day window after your latest scan has passed.
• Scans behind an order or saved to an account — kept so future pairs fit without re-scanning, until you delete them or ask us to.
• Clinic-referral photos — deleted automatically after 24 months. The intake details linked to them are kept while your referral is active and removed when it's no longer needed for your care, or on request.
• Security and audit logs — kept for 12 months, then deleted automatically.
• Order and payment records — kept for as long as tax and accounting law requires (typically six years), then deleted.

Only the services that make Akrolimb work, each under a data-processing agreement, and each receiving only what it needs:

• Stripe — payment processing. Your card details go directly to Stripe, never to us.
• Microsoft Azure — hosting, our database, and encrypted private file storage for scans and photos.
• Resend — sends our transactional emails (order confirmations, scan-received, account emails).
• Upstash — the rate-limiter that protects our public endpoints from abuse; it briefly processes request identifiers such as your email or IP.
• Microsoft (Teams) — if you book a video consultation, to create and host your meeting link.
• Akrolimb Private Limited — our Indian group company, once we begin delivering to India.

Beyond these: your clinic, if they referred you; and authorities, if the law genuinely requires it. Nobody else, and never for advertising.

We're a UK company and store scan and patient files in Microsoft Azure. Some of our providers (such as Stripe, Resend, and Upstash) may process data outside the UK — where they do, we rely on UK-recognised safeguards such as adequacy decisions or the UK International Data Transfer Addendum to standard contractual clauses. Once we begin delivering to India, order data for Indian deliveries will be shared with Akrolimb Private Limited in India to fulfil your order, under the same safeguards.

You may have noticed there's no cookie banner here. That's because we use no analytics, advertising, or tracking cookies at all. The complete list of what we set:

• Sign-in & security cookies — keep you signed in to your account or dashboard and protect our forms against cross-site forgery. Set by our authentication system; essential to how the site works.
• akro_audience — remembers which version of the site you chose (for example customer or clinic) so return visits open the right one. Set only when you make that choice; lasts 180 days; contains just that one choice and nothing else.

Your light/dark theme preference is stored in your browser's local storage and never sent to us.

• Everything travels over encrypted connections (TLS), and files are held in private, access-controlled storage — never public.
• Role-based access: staff see only what their role needs, and sensitive admin actions are audit-logged.
• Passwords are stored only as salted hashes; payment details never touch our systems.
• Public endpoints are rate-limited, and photo location/device metadata is stripped on upload.

Under UK GDPR and the Data Protection Act 2018 you can:

• Access a copy of the personal data we hold about you.
• Correct anything inaccurate or incomplete.
• Delete your data — scans can be deleted directly (the app's "delete my scans", or your account's foot-info page); for everything else, one email does it, subject only to records the law makes us keep.
• Restrict or object to processing, and take your data with you (portability).
• Withdraw any consent at any time, without affecting what happened before.

To exercise any of these, email info@akrolimb.com — we'll respond within a month. If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk — though we'd appreciate the chance to sort it out first. If you're in India, you also keep any rights your local data protection law gives you.

Our store and app are intended for adults. If insoles are for someone under 18, a parent or guardian should place the order and manage the scans — or a clinic should, through the clinician-referral flow with its explicit consent step.

Our workflow begins with a precise 3D scan of the patient's anatomy. This data is processed through our proprietary design software, which assists clinicians in generating a custom device model tailored to the individual's biomechanical needs.

The software incorporates clinical parameters and design rules developed through iterative testing with practising clinicians and rehabilitation professionals. This digital-first approach eliminates the need for traditional plaster casting, significantly reducing turnaround time and material waste.

Before manufacturing, each device design undergoes computational analysis to verify structural integrity under expected loading conditions. This simulation step identifies potential weak points and ensures the design meets our durability and safety thresholds.

Our pre-production validation protocol was developed through extensive testing and refined during clinical deployments where devices were fitted and evaluated by real users in everyday conditions. The combination of computational checks and field-validated design rules gives us confidence in the performance of every device before it is printed.

Devices are produced using additive manufacturing (3D printing) with process parameters that have been carefully calibrated to achieve the right balance of strength, flexibility, weight, and surface finish for clinical use.

Our manufacturing profiles are the result of systematic material and parameter optimisation, ensuring consistent quality across production runs. This controlled process is what enables us to deliver clinical-grade devices at a fraction of traditional manufacturing costs, with significantly faster turnaround times.

All cost savings and performance claims presented on this website are informed by real-world deployments across clinical and humanitarian settings. We have fitted devices to users through partner clinics and organisations, collecting feedback on comfort, functionality, and durability.

These deployments serve as the foundation for our pricing models and production estimates. We continuously refine our process based on user outcomes and clinician feedback.