Consumer Health Data Privacy Policy
Effective Date: October 26, 2026
Last updated: October 26, 2026.
This policy explains, in one place, how Oivana handles information about your health. It is written for the Washington My Health My Data Act (RCW 19.373), Nevada Senate Bill 370 (NRS 603A.400 to 603A.550) and Connecticut’s consumer health data rules (Conn. Gen. Stat. §42-526). It adds to our Privacy Policy, which covers everything else. We handle your health data the same way wherever you live.
Oivana Oy, Ruskontie 6, 33710 Tampere, Finland (Business ID 3627055-5), is the company responsible for your data. Contact: hello@oivana.com, with “Privacy” in the subject.
1. The short version
- We use your health data to run the App you asked for. We do not sell it.
- We do not share it with advertisers. If you allow ad measurement, the only thing an ad network can learn is that one of our ads led to an install, a trial or a subscription.
- Anything beyond running the App needs your permission, asked on its own screen: AI analysis of your photos, answers, health-platform data and cycle data, and ad measurement. Each one can be withdrawn at any time in the App.
- You can see, correct and delete your data in the App, or ask us by email. You can appeal a refusal.
- We do not keep where you are (the optional outdoor walk test turns your location into a distance on your phone and keeps no route), and we never draw a boundary around a clinic or other health-care place to reach you.
2. Health data we collect, and why
| What we collect | Why |
|---|---|
| Your body profile and measurements: height, weight, age, sex, body fat %, body measurements, goals, and your estimated daily calorie burn | To build your plan and targets, and to show your progress |
| What you log: meals and nutrients, water, supplements and medications, symptoms, health notes, custom trackers, lab results you enter | To keep your diary, calculate your nutrition, and explain your lab results |
| Workouts and exercise history, including heart-rate readings recorded during a workout, and the result of the optional outdoor walk test (a walked distance and its duration) | To log training, show your heart-rate zones and recovery, and estimate your fitness |
| Sleep, resting heart rate, heart-rate variability, blood-oxygen level, steps, active energy, VO2 max, workouts, and weight or body fat from a scale, from the health apps and devices you connect | To calculate your health scores, energy curve, sleep and recovery, and to send you useful reminders |
| Photos of your face and body that you take or upload | To track your progress and, with your permission, to analyze them with AI (for example a body-fat estimate or a weekly comparison) |
| Cycle tracking, if you turn it on: periods, flow, symptoms, moods, skin, life stage, and whether you are pregnant or breastfeeding if you tell us | To predict your cycle and adapt your plan |
| Your chats with the Oivana coach | To answer you, using the data above |
| Figures we work out from the above, such as health scores, recovery, calorie estimates and predictions | To show them to you |
| That you installed Oivana, started a trial or subscribed, together with a device identifier — only if you allow ad measurement | To learn which of our ads worked. Because Oivana is a health app, we treat even this as health data |
3. Where it comes from
- You: what you enter, answer, photograph or say in a chat.
- Your phone’s health apps, with your permission: Apple Health on iPhone and Health Connect on Android.
- Services you connect yourself: Oura, WHOOP and Google Health (Fitbit). We never see your passwords there; each service gives us a sign-in key, which we keep encrypted.
- A Bluetooth heart-rate sensor you pair during a workout.
- A smart scale, through your phone’s health app.
- Our own calculations: scores and predictions made from the data above.
4. How we use it, and your permission
We collect and use your health data to provide the features you ask for. That covers storing it in your account, calculating your plan, targets, scores and predictions, and sending you the reminders you set up.
Some uses need your separate permission. We ask on a dedicated screen, you can say no, and you can withdraw at any time:
| What | Where you withdraw |
|---|---|
| Sending your photos to our AI provider for analysis | Settings → Privacy → “AI photo analysis” |
| Sending your onboarding answers to our AI provider | Settings → Privacy → “AI personalization from your answers” |
| Sending health-platform, scale and sensor data to our AI provider | Settings → Privacy → “AI health insights” |
| Sending your cycle data to our AI provider | Cycle drawer → “AI insights” |
| Sharing the fact of an install, trial or subscription with ad networks (ad measurement) | Settings → Privacy → “Which ad brought you here” |
Permission to collect and permission to share are separate. Allowing one never switches on another. We will not collect more kinds of health data, or use it for new purposes, without telling you first and asking for your permission.
5. Who receives your health data
Affiliates: none. Oivana Oy has no affiliate companies that receive your data.
Companies that work for us (processors), bound by contract to act only on our instructions:
| Company | What it receives | Why |
|---|---|---|
| Amazon Web Services (EU) | Everything stored in your account | Hosting and storage |
| OpenAI (United States) | Only what the AI feature in use needs, and only with your permission for photos, answers, health-platform data and cycle data | AI analysis. Kept up to 30 days to detect abuse, never used for training |
| Google Gemini (EU) | The same, for a request OpenAI could not answer | AI analysis (backup). Never used for training |
| RevenueCat (United States) | Your account ID and subscription status. No health data | Managing your subscription |
| PostHog (EU) | Which screens and features you use, tied to a random account ID. Never health values | Product analytics |
| Singular Labs (United States) | Only if you allow ad measurement: device identifiers and install, trial and subscription events. No health data other than the fact that you use Oivana | Measuring which ads worked |
Companies that receive data for their own purposes (third parties): only if you allow ad measurement, Apple, Meta, TikTok and Google, where we run our ads. Each can learn that one of its ads led to an install, a trial or a subscription, matched by the identifier Singular holds for your device. We share it for one purpose: to measure which of our ads worked. Nothing else about you and nothing from your health data is passed on. Without your permission, nothing is sent to them.
We may also disclose data where the law requires it, for example to answer a valid court order.
We do not sell consumer health data, and we do not receive any payment or other value for it.
Collection over time and across services. No outside company collects your health data from the App over time or across other websites and apps. The one exception is the ad measurement service described above, if you allow it; it sees identifiers and install signals, not health data.
6. Your rights, and how to use them
You can:
- Confirm and access. Ask whether we collect, share or sell your health data, and get a copy of it, together with the list of companies in Section 5 and how to contact them.
- Withdraw your permission to collect or share it.
- Delete it. In the App, use Delete Account. It removes your data from our systems, and we tell our processors to delete theirs. Copies in database backups are overwritten within 35 days, well inside the six months the law allows. RevenueCat and PostHog carry out the deletion in the background, and Singular finishes within 30 days. The ad networks in Section 5 are separate companies; if one of them received a signal about you, you can ask it directly to delete it.
- Correct and review most of your information yourself in the App. For anything you cannot change there, ask us.
- Export it from the App. We email you a download link.
How to ask. Use the App: Settings → Privacy for your permissions, Delete Account for deletion, and the data export. Or email hello@oivana.com from the address on your account, with “Privacy” in the subject. We may reply to that address to confirm it is you. You do not need a new account.
How long we take. We answer without undue delay and within 45 days. If we need more time, we tell you why within those 45 days and take up to 45 more. You can ask twice a year at no cost.
Appeal. If we refuse or only partly do what you asked, reply to our answer, or email hello@oivana.com with “Appeal” in the subject. We will give you our decision in writing, with reasons, within 45 days. If we deny your appeal, you can file a complaint with your state attorney general: Washington, Nevada or Connecticut.
7. How we protect it
Your data is encrypted when it travels and when it is stored. Access is limited to the systems and people that need it. We keep only what a feature needs, and we delete temporary files automatically. See Section 11 of our Privacy Policy.
8. Changes to this policy
If we change this policy in a way that matters, we tell you in the App and update the dates above. If a change needs your permission, such as a new kind of health data or a new purpose, the App asks you first and nothing changes until you agree.
9. Contact
Oivana Oy
Ruskontie 6, 33710 Tampere, Finland
Email: hello@oivana.com (put “Privacy” in the subject)
Back to the Privacy Policy.