Privacy Policy

Effective Date: October 15, 2026

1. Introduction

Oivana Oy, a private limited company organised under the laws of Finland (Business ID / Y-tunnus: 3627055-5, registered office at Ruskontie 6, 33710 Tampere, Finland) (“Oivana”, “we”, “us”, “our”) operates the Oivana mobile application (“the App”).

This Privacy Policy explains how we collect, use, disclose, and safeguard your information, and is intended to comply with the EU General Data Protection Regulation 2016/679 (“GDPR”), the Finnish Data Protection Act (Tietosuojalaki 1050/2018), and other applicable data-protection laws. Where you are resident in another jurisdiction (for example California), additional rights described in Section 10 may also apply.

Oivana runs on a secure cloud backend in the European Union. Your wellness data is stored in your private account on our servers, and an encrypted copy is kept on your device so the App stays fast and keeps working when you are offline. Data is encrypted in transit and at rest. When you use an AI feature, the parts of your data it needs are sent to our AI providers for processing, and that processing can take place outside the EU/EEA — see Sections 3e, 7 and 12.

2. Data Controller and Contact

For the purposes of the GDPR, Oivana Oy is the data controller of personal data processed through the App.

Oivana Oy
Ruskontie 6, 33710 Tampere, Finland
Business ID (Y-tunnus): 3627055-5
Email: hello@oivana.com

For any questions about this Privacy Policy or to exercise your rights, please contact us using the email above. We will appoint a formal Data Protection Officer (DPO) if and when we cross the thresholds set out in GDPR Article 37.

3. Information We Collect

3a. Account Information (required for sign-in)

When you sign in via Google, Microsoft, or LinkedIn (through AWS Cognito), we receive:

• Email address
• Full name
• Cognito subject identifier

This information is stored in AWS Cognito and is used for authentication and to link your use of AI features to your account. We do not store your password.

We also store a one-way hash of your email address together with your display name, so that another Oivana user who already knows your email address can find your account and share an item with you. That lookup returns only your display name; we do not disclose your email address to another user.

3b. Device Identifiers

We do not generate or store a device or installation identifier. Requests from the App are associated with your account, and push notifications are addressed to the token your device’s operating system issues (see Section 3g). We do not use advertising identifiers.

3c. Your Wellness Data

The following data is stored in your private Oivana account, with an encrypted copy kept on your device for speed and offline access:

• Health profile (height, weight, age, sex, body fat %, TDEE)
• Meal logs with full nutritional detail (macros, micronutrients)
• Weight and body measurement logs
• Workout logs and exercise history
• Sleep data and analysis
• Supplement and medication logs
• Chat messages with AI coach
• Custom tracker entries
• Progress photos (face and body)
• Onboarding questionnaire answers (goals, activity level, diet type, lifestyle factors, lab values, symptoms)

This data is stored in your private account. Some of it is also sent to our AI provider when a feature needs it — see Section 3e. You can delete it at any time using Delete Account (see Section 9).

3d. Backup and Restore

Because your data is stored in your account rather than only on your phone, it is available again automatically when you sign in on a new device. There is no separate backup product to turn on or off.

Your journey is part of your account and is kept for as long as you have an account — there is no in-App feature to reset or archive it. To delete your data, use Delete Account (see Section 9).

3e. Data Transmitted for AI-Powered Features

Some Oivana features are powered by AI. When you use one — coaching, food scanning, body analysis, plan generation — and when the App prepares the insights on your Health screen, the relevant parts of your account data are sent from our servers to our AI provider for processing. Our AI provider is OpenAI (OpenAI, L.L.C. / OpenAI Ireland Ltd.); if OpenAI is temporarily unavailable, the same request is sent to Google Cloud (Vertex AI, EU region) instead. Depending on the feature, this may include:

• Photos you submit for analysis (food, face, body composition) — including a progress photo already saved in your account, when a feature (such as your weekly comparison or a routine review) re-reads it for a fresh AI analysis
• Health profile and plan context needed to personalise AI responses (e.g., your nutrition targets, dietary preferences, recent meals, activity data)
• Recent chat messages to maintain conversation context with your AI coach
• Onboarding answers used to generate your initial wellness plan

This data is:

• Sent to our AI provider only with your explicit consent, where a photo is involved — before we send the first photo of you (face or body) to our AI provider, we show you a dedicated in-app prompt naming the provider and what it does with the photo. You can withdraw this consent at any time in the App under Settings → Privacy → “AI photo analysis”; declining or withdrawing simply skips that AI step (some features, like the body-fat estimate, offer a manual alternative instead)
• Sent to our AI provider only with your explicit consent, where data read from a connected health platform is involved — we ask for this on its own dedicated screen during onboarding, and you can withdraw it at any time in the App under Settings → Privacy → “AI health insights”. While it is withdrawn, those features omit the AI-written text and everything else keeps working. See Section 6
• Encrypted in transit using TLS
• Encrypted at rest using AES-256
• Processed through our secure server infrastructure — your data is proxied through our own servers to the AI provider; it is never sent directly from your device to third-party AI services
• Processed outside the EU/EEA — OpenAI processes our requests on its global infrastructure, which includes the United States, so the data in an AI request can leave the EU/EEA. See Section 12 for the safeguards that apply
• Not used to train AI models — OpenAI does not use data sent through its API to train or improve its models by default, and we have not opted in. OpenAI keeps API requests for up to 30 days solely to detect abuse and then deletes them. Our main requests also ask it not to store the response (store: false); the small classification calls that decide, for example, what kind of request a chat message is use an OpenAI endpoint with no such setting, so OpenAI holds those only for that same abuse-monitoring period. Images are checked automatically for illegal content, and an image flagged by that check can be retained by OpenAI for manual review. Google Cloud does not use this data to train its models either
• Short-lived processing files are purged automatically — a photo you submit for a one-off AI analysis (food scan, body-fat estimate) is deleted as soon as the analysis finishes, and in any case within 24 hours
• AI job records — which hold the request we sent and the result we got back — are deleted shortly after your device collects the result. If a result is never collected, the record is kept for up to 30 days so you can still receive it, and is then deleted automatically

Photos you save as part of your progress tracking are different from the one-off files above: those are kept in your account so the App can compare week to week, until you delete them or delete your account. See Section 9.

3f. Health Metrics for Notifications and Insights

To provide personalised notifications, insights and health scores, the App sends your health data to our servers. This includes both daily summaries and the detailed readings behind them:

• Resting heart rate, HRV, SpO2, sleep, activity, and workout data (from Apple HealthKit, Google Health Connect, Google Health, Oura Ring, or WHOOP with your permission)
• The individual readings behind those summaries — for example heart-rate points and activity points through the day — which we store so we can show you a complete day
• Recent nutrition summaries for coaching notifications

This data is encrypted in transit and at rest, associated with your account identifier, and used to generate your personalised notifications, insights and health scores, and to give your AI coach the context it needs.

3g. Push Notification Data

If you enable notifications, we store:

• Push notification token (issued by Apple, Google or Expo)
• Device platform (iOS/Android)
• Your account identifier
• Timezone (for scheduling reminders)

3h. Health Platform Data

With your explicit permission, the App reads data from:

• Apple HealthKit (iOS): steps, active energy, resting heart rate, HRV, VO2 max, SpO2, sleep analysis, workouts
• Google Health Connect (Android): equivalent health metrics
• Google Health (optional): Fitbit and Google Health data such as steps, workouts, active energy, sleep, and heart metrics

The App reads this data on your device with your permission and sends it to our servers, where your notifications, insights and health scores are calculated. It is stored in your account and deleted when you delete your account.

3i. Oura Ring and WHOOP Data (optional)

If you connect an Oura Ring or a WHOOP band via OAuth, we access heart rate, sleep, readiness or recovery, SpO2, and activity data from that service. The connection uses OAuth 2.0, so your Oura or WHOOP password never passes through us. The access and refresh tokens are encrypted with AWS KMS and stored on our backend, so we can keep your data up to date without your phone being open. You can disconnect at any time in the App, and deleting your account removes the connection and the encrypted tokens.

3j. Google Health Data (optional)

If you connect Google Health via OAuth, we access only the Google Health scopes you approve. OAuth refresh tokens are encrypted with AWS KMS and stored on our backend so we can refresh your Fitbit and Google Health data after you connect. You can disconnect Google Health in the App, and account deletion removes the stored connection and encrypted token.

3k. Bluetooth Heart Rate Sensor Data (optional, workout only)

If you connect a Bluetooth heart-rate chest strap or sensor, this is different from the platforms above: it is not a continuous background integration. The App reads from the sensor only while you have an active workout open, and you pair it yourself, from within that workout. After you connect a sensor once, the App reconnects to it automatically the next time you start a workout, without reading or using anything from it in between workouts.

Your live reading is shown to you on your device and is not sent anywhere. What reaches our servers is a workout-level summary (average, peak, and end-of-workout heart rate, and how quickly your heart rate recovered between sets), stored as part of that workout’s record. We do not store the moment-by-moment reading itself. With your consent (see Section 6), this summary may also be sent to our AI provider to estimate the calories burned in that workout. You can disconnect or forget a paired sensor at any time in the App.

4. Information We Do NOT Collect

• Location data
• Contact lists
• Advertising identifiers
• Browsing history
• Data from other apps
• Financial information (payments handled by Apple App Store / Google Play Store)
• Microphone or camera data, beyond the photos you choose to take in the App (see Sections 3c and 3e for how those are stored and used)

5. How We Use Your Information

• Deliver the Service: Process AI analyses, provide personalised coaching, generate wellness plans, deliver notifications and insights
• Authentication: Verify your identity and securely link AI usage to your account
• Push Notifications: Send reminders, coaching check-ins, and alerts you’ve configured
• Service Reliability: Monitor application health and diagnose errors using privacy-respecting analytics and error monitoring tools
• Legal Compliance: Respond to legal requests and enforce our Terms

We do not use your data for advertising, marketing to third parties, profiling for advertising purposes, or training AI models.

6. Legal Basis for Processing (GDPR Article 6)

Health data is special-category data under GDPR Article 9, and Article 9 has no “performance of a contract” basis. So each of the three ways we process it relies on your explicit consent:

• Sending a photograph to our AI provider requires your explicit, revocable consent, which you give through a dedicated in-app prompt before we send your first photo for AI analysis, and can withdraw at any time under Settings → Privacy → “AI photo analysis”.
• Connecting a health platform, or pairing a Bluetooth heart-rate sensor (Section 3h–3k) is itself the explicit action by which you authorise us to read and process that data, and you can disconnect at any time.
• Sending that connected health platform or Bluetooth sensor data to our AI provider requires your separate explicit, revocable consent. Because the App’s core purpose is AI-personalised health guidance, we ask for this during onboarding, on its own dedicated screen, before you answer any questions — it is not bundled into your acceptance of these terms. Your choice is saved to our servers before you can continue; if we cannot confirm it was saved, we ask you to try again rather than treating an unconfirmed choice as consent. We ask separately so the choice is a real one, but we should be equally plain that it is required in order to complete onboarding and use the App: if you decline, you can sign out, and you will not be able to continue. Consent given before this notice is never assumed — an account that has not made this choice is treated as not having consented, and the features listed above stay silent until it does. You can withdraw it at any time under Settings → Privacy → “AI health insights”. While it is withdrawn, the features listed in the table above simply omit the AI-written text; your health charts, numbers, diary, workouts and coach continue to work. This is enforced on our servers: if your saved choice cannot be read for any reason, we treat that the same as not having consented and do not send your data — never the reverse.

Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it (see Section 10). Other AI-powered features process the data you enter yourself only to deliver the App feature you have chosen to use.

7. Third-Party Data Processors (Recipients)

We use a limited number of trusted third-party processors, each bound by a data processing agreement (Art. 28 GDPR). This table names our AI providers. The App’s consent screens name them too (currently OpenAI, with Google Cloud as the fallback if OpenAI is temporarily unavailable), and point here: if we ever change providers, this page names the current ones first.

We do NOT sell, rent, or share your personal data with advertisers, data brokers, or any third parties for their own purposes.

8. Advertising

We do NOT display advertisements in the App. We do NOT sell, rent, or share your personal data with advertisers or ad networks. We do NOT use your data for targeted advertising. We do NOT use advertising identifiers.

9. Data Retention

You can delete your account and its data at any time using the “Delete Account” feature in the App. This removes your wellness data, photos, health metrics, connected-service tokens, and your sign-in account. A small number of short-lived technical records — such as the record of a recent AI request — are deleted automatically within 30 days rather than immediately.

10. Your Rights Under GDPR

If you are located in the EU/EEA, you have the following rights under the GDPR in relation to your personal data:

• Right of access (Art. 15) — obtain a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — have inaccurate or incomplete data corrected.
• Right to erasure / “right to be forgotten” (Art. 17) — delete your personal data, subject to limited statutory exceptions.
• Right to restriction of processing (Art. 18) — restrict how we process your data in certain circumstances.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format and transmit it to another controller. The App’s in-app export feature is designed to support this right.
• Right to object (Art. 21) — object to processing based on our legitimate interests.
• Right to withdraw consent (Art. 7) — withdraw consent at any time, without affecting the lawfulness of prior processing. For AI photo analysis and for AI use of your connected health platform data, these are single switches in the App under Settings → Privacy — “AI photo analysis” and “AI health insights” (see Section 6).
• Rights related to automated decision-making (Art. 22) — we do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

To exercise any of these rights, contact us at hello@oivana.com or use the in-app data management features. We will respond within one month (extendable by two further months for complex requests, in accordance with Art. 12(3) GDPR).

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular in your country of residence, place of work, or place of the alleged infringement.

In Finland, the supervisory authority is the Data Protection Ombudsman (Tietosuojavaltuutettu):

• Website: tietosuoja.fi
• Address: Lintulahdenkuja 4, FI-00530 Helsinki, Finland
• Postal address: PO Box 800, FI-00531 Helsinki, Finland

Additional rights for California residents (CCPA / CPRA)

If you are a California resident, you also have the right to:

• Know what personal information we collect and how we use it
• Delete personal information (subject to legal exceptions)
• Correct inaccurate personal information
• Opt-out of “sale” or “sharing” — we do NOT sell or share personal information for cross-context behavioural advertising
• Limit the use of sensitive personal information — we already limit this to providing the Service
• Non-discrimination for exercising your rights

To exercise CCPA/CPRA rights, contact us at hello@oivana.com.

11. Data Security

We implement multiple layers of security to protect your data:

• Encryption in transit: All data transmitted between your device and our servers is protected with TLS encryption.
• Encryption at rest: All server-side data is encrypted with AES-256.
• Secure authentication: OAuth 2.0 with PKCE flow; tokens stored in device secure storage (iOS Keychain / Android Keystore).
• No stored passwords: Social sign-in only — we never handle or store your password.
• Secure AI proxy: AI requests are routed through our own servers — API keys and credentials are never exposed to the client.
• Automatic data purging: Temporary uploads and processing artifacts are automatically deleted on schedule.
• API protection: Rate limiting, request throttling, and concurrency controls on all server endpoints.
• Minimal data collection: We only transmit the minimum data necessary to deliver the feature you’re using.

Personal data breaches

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Finnish Data Protection Ombudsman within 72 hours of becoming aware of it, in accordance with GDPR Article 33, and notify affected users without undue delay where required by GDPR Article 34.

12. Where Your Data Is Processed

Our primary infrastructure is hosted on Amazon Web Services in Stockholm, Sweden, within the European Union. This includes authentication, your account’s wellness data, your photos, your health metrics and the individual sensor readings behind them, and the serverless functions that orchestrate AI requests.

AI processing is different, and we want to be plain about it. Our primary AI provider, OpenAI, processes the requests we send it on its global infrastructure, which includes the United States. When you use an AI feature, the data in that request — which can include photos, health data and conversation text — is therefore transferred outside the EU/EEA. Where OpenAI cannot answer a request, it is processed instead on Google Cloud’s EU region, inside the European Union. Everything else — your stored account, photos and health data, authentication and the serverless functions that orchestrate AI requests — stays on AWS in Stockholm.

A limited set of operational metadata may, depending on each vendor’s own routing, be processed outside the EEA — specifically by PostHog (product analytics), RevenueCat (subscription status), and certain social identity providers used at sign-in. This category does not include the health, photo, or conversation data described in Section 3e.

For any transfer of personal data outside the EEA, we rely on appropriate safeguards under Chapter V of the GDPR, including:

• The EU Standard Contractual Clauses (SCCs) approved by the European Commission (Decision (EU) 2021/914), which are part of the data processing addendum we have with OpenAI
• Certification under the EU–U.S. Data Privacy Framework where the recipient is so certified
• A data processing agreement with each AI provider under which it may process the data only on our instructions, and — for OpenAI — does not use API data to train its models
• Additional technical safeguards including end-to-end TLS, AES-256 encryption at rest, and short retention periods for AI processing artifacts (one-off upload files deleted within 24 hours; AI job records deleted shortly after collection, and in any case within 30 days)

You may request a copy of the safeguards in place by contacting hello@oivana.com.

13. Children’s Privacy

The App is intended only for adults aged 18 and over and is not directed at anyone under 18. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe a person under 18 has provided us with personal information, please contact us at hello@oivana.com and we will delete it.

14. Cookies and Tracking

• The App does not use cookies.
• This website does not use analytics cookies or tracking technologies.
• We do not engage in cross-app or cross-site tracking.
• We do not use advertising identifiers.
• Our iOS privacy manifest declares NSPrivacyTracking as false.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the App and by updating the “Effective Date” above. If a policy change requires your re-consent, you will be prompted within the App. Your continued use of the App after changes constitutes acceptance of the updated policy.

16. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights:

Oivana Oy
Ruskontie 6, 33710 Tampere, Finland
Business ID (Y-tunnus): 3627055-5
Email: hello@oivana.com

For data-protection questions in particular, please put “Privacy” in the subject line.

For EU/EEA data-protection inquiries, you may also contact your local Data Protection Authority. The Finnish supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutettu), tietosuoja.fi.