Privacy Policy

Lova Health LLC (“Lova Health”, “we”, “us”) is the controller of the personal data described in this policy. We are a limited liability company formed in State of Delaware, United States.

You can reach us about anything in this policy at legal@lova.health, which is also the address for our data protection contact. We publish a role mailbox rather than an individual’s name so that your request reaches whoever is responsible at the time, rather than a person who may have moved on.

We have not currently appointed a representative in the European Union under Article 27 of the GDPR. We would rather say so than leave the question unanswered. If you are in the EEA or the UK, this does not reduce any of your rights under this policy, and it does not affect your right to complain to your national authority as described in clause 12 — write to us at the address above and we will deal with your request directly.

This policy covers two different things, which behave differently:

• The App — the Lova application on your phone. This is where your health data lives, and it is designed so that we do not receive it.
• The Website — lova.health, which you are reading now. A website is not a local-first app: it necessarily involves a server. The Website is covered by this policy and by our Cookie Policy.

Where a statement in this policy applies to only one of them, we say so. Treating them as interchangeable is the most common way a privacy claim becomes untrue, so we keep them apart throughout.

If you are a resident of Washington State, our Consumer Health Data Privacy Notice also applies to you and gives you additional rights.

It is easier to start with what never reaches us. In relation to the App:

• Your health data. Period and cycle dates, symptoms, moods, basal body temperature, fertility and pregnancy records, hormone-therapy regimens, intervention sessions and notes are written to your device and are not transmitted to us.
• Account identifiers. The App has no sign-up, no login and no user account. We do not hold your name, your phone number, or an email address tied to your use of the App. If you separately write to our support address, we necessarily have the email address you wrote from — that is described in clause 4.
• Location. The App does not request or collect location data.
• Advertising identifiers. No advertising ID, no device fingerprinting, no cross-app tracking.
• Behavioural analytics. We do not record which screens you open, how long you spend in the App, or what you tap. The App contains no advertising SDK and no third-party behavioural analytics SDK.

We also do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in United States state privacy law. See clause 13.

This clause is the counterpart of the one above, and it is deliberately specific. These are the only circumstances in which information travels from the App or the Website to us or to a provider acting for us.

4.1 Subscription validation

If you buy a subscription, the App asks our billing provider whether that subscription is valid. That request carries a randomly generated, anonymous app user ID and receipt metadata from the App Store — a transaction identifier, a product identifier and a purchase date. It carries no health data and nothing that names you.

4.2 Learn Library content

The Learn Library can draw articles from our content service at content-api.lova.health. Where that is enabled in your version of the App, each request includes a random per-installation token, your app version and platform, and any search terms you type into the Learn Library.

Some Learn Library content never involves a request at all. Certain topics — for example post-menopause education on bone health, heart health and hormone therapy — are bundled inside the App itself. Whether those topics are shown to you is decided on your device, using information you have entered. We do not record which topics you open, we store nothing about your reading, and none of it reaches our content service. If you do not use the Learn Library’s search, no search terms are sent.

4.3 Crash diagnostics

Crash reporting is off unless you turn it on. If you do, a crash sends us technical information about the failure, your device model, your operating system version and your app version. We configure crash reporting to exclude health data and we do not want it; we cannot, however, give an unqualified guarantee that a crash trace will never contain a fragment of application memory, so we state the limit rather than overclaim. You can switch crash reporting off again at any time.

4.4 Support correspondence

If you email us or use the contact form, we receive your message, your email address so that we can reply, and anything else you decide to include. Please do not send us health records you do not want us to hold — we do not need them to help you.

4.5 Website visits

Visiting this Website involves a request to our server, which processes your IP address transiently in order to return the page. If, and only if, you opt in through the privacy banner, we additionally record an aggregate page view through Plausible Analytics. See the Cookie Policy.

4.6 Wearable connections (optional)

If you choose to connect a wearable or health service — for example Fitbit, Whoop or Android Health Connect — Lova sends an authorization request to that provider so it can read the activity and health data you approve, such as steps, workouts, sleep, heart rate or temperature. The data it reads is written only to your device and is never transmitted to Lova's servers or any other third party. The connection stays off until you turn it on, and you can disconnect it at any time in Settings, which stops any further reading.

Where the GDPR or UK GDPR applies to you, we must tell you why we process each category of data, the legal basis we rely on, and how long we keep it. Article references are to the GDPR.

Your tracked health data does not appear in this table, because we do not process it. It is held on your device under clause 6.

Where we rely on consent, you may withdraw it at any time — by switching crash reporting off, by declining or withdrawing analytics consent in the banner, or by not using the Learn Library’s search. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

The following is an inventory of the data the App keeps locally. We publish it so that the absence of a collection claim is visible rather than implied. For every row, the answer to “does the Company receive this?” is no.

When you delete your data in the App, the corresponding records — including hormone therapy regimens and intervention sessions — are removed from the device database.

• Database: an encrypted on-device database using AES-256.
• Keys: held in the operating system’s secure storage — the iOS Keychain or the Android Keystore — and not in the App’s own files.
• Location: the App’s private storage container on the device.

The practical limit of this design is worth stating plainly: it protects your data against someone obtaining the device’s files, but it cannot protect data on a device that is unlocked, shared, rooted or jailbroken, or whose operating system has been compromised. Use a device passcode or biometric lock, and the App’s own lock where it is available.

We do not share your health data, because we do not hold it. You can share it, and these are the routes by which that happens:

• Partner sharing. Data goes directly from your device to your partner’s, encrypted, and does not pass through our servers or anyone’s cloud. One honest caveat: the payload is always encrypted, but the channel you use to deliver it is whichever one you pick — AirDrop, a messaging app, email — and that channel is operated by someone else under their own terms. Our commitment is about the payload and the absence of a cloud, not about the delivery app you choose.
• Export for a clinician. You generate a FHIR, CSV or JSON file and send it yourself. Once it reaches a clinician it becomes part of their records and is governed by their obligations, not ours — see clause 14.
• Device backups. If you have iCloud Backup or Google One backup switched on, your operating system may include the App’s data in that backup. The backup is encrypted and is held by Apple or Google under their terms, not ours. This is a device setting you control, and it is the one route by which your health data may leave your device without any action inside the App. Turn the backup off for the App if you do not want this.

Inside the App, we include no advertising network, no social media SDK and no third-party behavioural analytics SDK. The only third-party components that process data outside your device are the billing and content providers named below, and the crash reporting service if you have enabled it.

For subscriptions, a limited amount of non-health data is processed by:

• Apple In-App Purchase and Google Play Billing, which take the payment. We never see your card details.
• RevenueCat, Inc., which validates subscription status and receives a randomly generated anonymous app user ID together with receipt metadata.

None of these providers receives your health data, cycle logs, symptoms or notes. Their own policies are published by Apple, Google and RevenueCat.

On the Website, one optional third-party technology may load, and only after you opt in: Plausible Analytics, which is cookieless and counts page views in aggregate. We run no advertising pixel on this site. We considered one and decided against it, because the pages you read here say too much about your health to hand to an advertising network. The Cookie Policy explains this in full.

The App uses automated processing to produce cycle predictions, fertility windows and related insights from the data you enter. This happens on your device.

These outputs are informational. They are not decisions that produce legal effects concerning you or that similarly significantly affect you within the meaning of Article 22 of the GDPR, and no human or automated decision about you is taken by us on the basis of them — we never see the inputs or the outputs. The logic is a statistical model of your own historical entries: broadly, it estimates the length and variability of your cycles and projects them forward. Its accuracy depends on how complete your entries are and on physiological variation no model can observe, which is why the “No Medical Advice” clause of our Terms of Service is emphatic that predictions are not a method of contraception.

Your health data stays on your device until you delete it. We cannot apply a retention period to data we do not hold, and we cannot delete it for you.

For the limited data we do hold, the periods are those in clause 5:

• Website analytics — aggregate only, with no individual-level record retained.
• Crash diagnostics — 90 days.
• Support correspondence — 90 days after the request is resolved.
• Learn Library request logs — no more than 30 days.
• Subscription records — for the life of the subscription, plus the period we are required to keep financial records for tax and audit purposes.

Because your health data is on your device, most rights are exercised directly in the App rather than by asking us:

• Access: the data is already in front of you.
• Portability: export at any time in FHIR, CSV or JSON.
• Erasure: delete individual entries or all data, in the App.
• Rectification: edit any entry.

For the data we do hold — support correspondence, crash diagnostics, Learn Library logs, subscription records — you have the right to request access, rectification, erasure, restriction of processing, portability, and to object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time.

Write to legal@lova.health or use our contact form. We respond within one month, and will tell you if we need longer. We do not charge for this and we will not treat you differently for asking.

California (CCPA/CPRA)

We do not sell personal information, and we do not share it for cross-context behavioural advertising. Because there is nothing to opt out of, we do not operate a “Do Not Sell or Share My Personal Information” mechanism — this statement is that disclosure. We have not sold or shared personal information in the preceding twelve months.

Sensitive personal information, including health information, is used only for the purposes set out in clause 5 — delivering the service you asked for — and never to infer characteristics about you. You therefore already have the benefit of the right to limit the use of sensitive personal information. You also have the rights to know, to delete, to correct and to non-discrimination, which you may exercise through the contacts in clause 20. An authorised agent may act for you on proof of authority.

Our service tiers differ in features, not in privacy. We do not offer a financial incentive in exchange for personal information, and we do not condition any privacy right on payment.

Washington (My Health My Data Act)

Washington residents have additional rights in relation to consumer health data, including a right to withdraw consent and a right to have consumer health data deleted. Those rights, and the disclosures the Act requires, are set out in our separate Consumer Health Data Privacy Notice.

Nevada

Nevada residents may direct us not to sell covered information. We do not sell it, and have no plans to, but you may confirm this with us at legal@lova.health.

Opt-out preference signals

This Website honours the Global Privacy Control signal. Because our only optional technology requires an affirmative opt-in before it loads, a GPC signal results in no analytics being loaded, which is the same outcome as declining the banner.

Lova is not a HIPAA covered entity, and is not a business associate of one. We are not a healthcare provider, a health plan or a clearinghouse, and the data you record in the App is not a medical record.

We say this because the protections described in this policy come from our architecture, from our contract with you, and from the privacy laws that do apply to us — not from HIPAA, and it would be misleading to let the word do work it cannot do here. In practice, the on-device model gives you more control than HIPAA would, because HIPAA governs how a provider may use records it holds, whereas we hold nothing.

When you export your data and give it to a clinician, the copy they receive becomes part of their records and is then governed by their obligations, which may include HIPAA. Our HIPAA information page explains what this means for providers.

People often begin tracking a cycle in adolescence, so we would rather be precise than pretend this does not apply.

• The App is not directed to children under 13, and use by anyone under that age is not permitted.
• In the European Economic Area and the United Kingdom, where processing relies on consent, the age of digital consent is 16 unless the law of your country sets it lower. Below that age, consent must be given or authorised by a parent or guardian.
• We do not knowingly collect personal information from a child below the applicable age. If you believe we have, write to legal@lova.health and we will delete it.

The architecture helps here, but it does not do all the work on its own, and we no longer claim that it does. Because tracked health data never reaches us, there is no store of children’s health data for us to hold or to disclose. The routes described in clause 4 — support email, crash diagnostics, Learn Library search — can still carry a young person’s personal information to us, which is why we apply the age limits above to those features too.

Your tracked health data is not transferred internationally, because it is not transferred at all — it stays on your device wherever you are.

The limited data described in clause 4 may be processed outside your country. In particular, RevenueCat and our crash reporting provider are established in the United States, so data processed for subscription validation and crash diagnostics is transferred there. Where that involves a transfer of personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable, and we assess whether additional safeguards are needed. Plausible Analytics processes website analytics within the European Union. You may request a copy of the transfer safeguards we rely on from legal@lova.health.

If a security incident affects personal data we hold, we will investigate it, take steps to contain it, and notify people as the law requires. Where the GDPR applies, that means notifying the competent supervisory authority within 72 hours of becoming aware of a breach where the obligation is engaged, and notifying you without undue delay where the breach is likely to result in a high risk to your rights and freedoms. Equivalent obligations under United States state law will be met on their own timetables.

The scope of any such incident is bounded by what we actually hold, which clause 4 sets out. Your tracked health data is not in that scope. If you wish to report a vulnerability, write to legal@lova.health; we welcome that and will not pursue good-faith security research, as the “Acceptable Use” clause of our Terms of Service confirms.

You do not have to take any of this on trust, and we would rather you did not. You can check it:

• Put the device in airplane mode and use the App. Tracking, predictions and bundled content all work, because they do not need us.
• Watch the App’s network traffic with a proxy. You should see requests only in the circumstances listed in clause 4 — subscription checks, Learn Library content where enabled, and crash reports if you switched them on. You should not see your tracked health data.
• Check the App’s permissions in your device settings.

If what you observe does not match what this policy says, that is a defect in the policy or in the App, and we want to know. Write to legal@lova.health.

We update this policy when our practices change or when the law requires it. The “last updated” date at the top of the page always reflects the current version, and every revision is recorded in the amendment history at the foot of the page.

Where a change materially reduces the protection we give you, we will not make it quietly: we will give notice in the App and on this page before it takes effect, and where the change depends on your consent we will ask for it rather than infer it from your continued use.

• Privacy enquiries and rights requests: legal@lova.health
• Data Protection Officer: legal@lova.health
• EU representative (Art. 27): None appointed — see clause 1
• Contact form: lova.health/contact

If you are not satisfied with our response, you may complain to your supervisory authority as described in clause 12.