vivoveri · Privacy

Privacy statement

DRAFT — NOT READY FOR PUBLICATION. The operating entity is [OPERATING ENTITY PLACEHOLDER]. Launch countries, contact details, retention periods, and applicable legal obligations have not been supplied. Replace the placeholder and obtain jurisdiction-specific legal review before release.

This draft describes the intended handling for a wellness tracking service. It is not a final privacy notice.

Information and purposes

The service processes supplement schedules and intake records, product photos you submit, test-result records, areas of interest, selected wearable readings (steps, active calories, sleep, heart rate, heart-rate variability, blood pressure, weight, and body-fat measurements), an opaque account identifier, and your consent choices. Wearable data is read-only, synced only when you request it, limited to the preceding 30 days, and restricted to the types you select. Turning off wearable access prevents future sync and hides those readings in the app; previously stored records are retained until account deletion. The final retention schedule remains undecided. Do not enter another person's information.

Identity and account

Apple or Google sign-in is used to authenticate an account. The server verifies provider tokens and derives a stable opaque Firebase user ID. Provider subjects, email addresses, and names are not stored in the application database; Apple and Google sign-ins create separate accounts unless account linking is added. Authentication providers may process information under their own privacy notices.

When you request account deletion, the account is marked deleted, health-data access is disabled, and application APIs stop returning its data. Health records, uploaded files, and the Firebase Auth account are retained for now; they are not erased immediately. The eventual retention and permanent-deletion process has not been decided.

Storage and service providers

The initial regional configuration is Singapore (`asia-southeast1`) for Firebase Functions. Cloud SQL health records and Firebase Storage photos must be provisioned in Singapore before deployment. This does not make all Firebase services region-bound: Firebase Analytics data processing is not guaranteed to remain in its reporting location, Firebase Hosting is globally distributed, and Firebase Authentication/provider metadata can be processed separately. Confirm and disclose actual deployed locations and transfer arrangements before launch.

Health data and analytics choices

Wellness-data processing, AI processing, analytics, and wearable access are separately consented. Wearable access is scoped to selected data types and is not read in the background. Optional analytics is off by default. On iOS, analytics remains disabled unless analytics consent is given and the user allows the applicable App Tracking Transparency request. ATT permission does not replace privacy consent.

Gemini processing and uploaded reports

If you separately enable AI processing, selected test and wearable measurements, areas of interest, supplement product labels and schedules, all-time recorded intake totals, and monthly intake aggregates for the most recent 90 days may be sent to Gemini through Vertex AI in the configured Google Cloud region to generate an informational wellness overview. Supplement free-text details and product photos are not sent for this overview. If you upload a laboratory report, you must first confirm that personal details have been masked. The report is sent to Gemini to extract a date and numeric results; the extracted information is shown to you for review and is not saved until you confirm it. The server attempts to delete the temporary source after extraction; an interrupted upload or failed cleanup may require a separate cleanup process, which must be configured before launch. Do not upload unmasked personal details. AI output is not medical advice, diagnosis, or treatment. The configured model and region must be verified before deployment.

Subscriptions and billing

AI features (laboratory report extraction and AI wellness overview generation) require an active vivoveri Pro subscription in addition to separate AI-processing consent. In-app subscriptions are billed through Apple App Store or Google Play and managed via RevenueCat using only your opaque application account identifier (`app_user_id`). Payment card details and billing names/addresses are processed by Apple or Google and are never stored in the vivoveri database. Subscription status and webhook event metadata are stored under your opaque account ID to verify access and are included when you export your data.

External store and affiliate links

The app may display links to purchase supplements or healthy foods from external merchants or a separate direct storefront. Clicking a product link records the selected product identifier and placement under your opaque account ID to measure product interest, and then opens the external merchant website. Orders, payment details, names, and shipping addresses are collected directly by the external merchant under its own privacy notice and are not stored in the vivoveri database.

Your rights and contact

Rights, response timelines, legal bases, complaint routes, and contact details depend on the launch jurisdiction and must be completed here before publication. Replace this draft with counsel-reviewed, translated terms for every market.