Consumer Health Data Privacy Policy
This policy describes how Celevo Co., Ltd. handles "consumer health data" as defined by the Washington My Health My Data Act and similar state laws. It supplements our general Privacy Policy, which continues to apply.
1. What This Policy Covers
Some U.S. state laws — notably the Washington My Health My Data Act and Nevada SB 370 — define "consumer health data" broadly. It is not limited to medical records: information about sleep, physical activity, diet, body measurements, alcohol and tobacco use, and supplement intake can all qualify. Most of what this app records falls into that definition.
This document tells you exactly what we collect in that category, why, where it comes from, who processes it, and how to get it back or get rid of it. Our general Privacy Policy still applies to everything else.
We provide this policy to everyone, not only to residents of a particular state. You should not have to prove where you live to find out what we hold.
2. Consumer Health Data We Collect
Each row is a category, where it comes from, and what we do with it. We collect nothing in this table unless you enter it or turn the relevant feature on.
| Category | Source | Purpose |
|---|---|---|
| Sleep records — duration, condition, energy | You, in the app | Display your records; calculate the sleep component of your health score; generate insights |
| Meditation records — minutes by date | You, in the app | Display your meditation history |
| Exercise and step records — type, duration, distance, intensity, active energy, heart rate during workouts; on iOS also cardio fitness (VO2 max), resting heart rate and sleep stages | You, in the app · Apple Health or Health Connect, only if you enable the integration | Display your records; calculate the exercise component of your health score; streak and weekly reports |
| Diet records and food photos — meals, nutrients, optional photos | You, in the app (photo capture is optional) | Display your meal log; estimate nutrients; calculate the diet component of your health score |
| Body measurements — weight, target weight, body composition, height | You, in the app | Show weight trends and goal progress |
| Lab and check-up results — values such as blood pressure, fasting glucose, HbA1c, inflammation, blood count, kidney and liver markers, with the test date | You, in the app — typed in, or read by AI from a photo of your report and saved only after you confirm each value | Show each value over time; factor it into your biological age estimate |
| Alcohol and tobacco records — quantity, type, abstinence days | You, in the app | Display your records; calculate the alcohol and smoking components of your health score |
| Supplement records — products taken and intake check-ins | You, in the app (optionally via label photo scan) | Track your routine; show ingredient information; adherence display |
| Health assessments — questionnaire answers and results for the lifestyle, biological age and sleep assessments | You, in the app | Produce and store your assessment history so you can compare over time |
| Profile attributes — date of birth, sex (optional), health goals | You, at sign-up | Used to compute age- and sex-adjusted scores and guidance |
| Diet profile — allergies, diet preferences, and foods you mark as sensitive (with an optional symptom note) | You, in the app | Warn you about foods that may contain your allergens, that you marked as sensitive, or that conflict with your diet preferences; let the AI assistant answer with your allergies and sensitive foods in mind |
| Derived health scores and insights | Generated by the app from the records above | Shown to you in the app; not used for any other purpose |
| AI assistant conversations — what you ask the in-app coach and what it answers | You, in the app | Continue the conversation across sessions and devices, and keep a record of what guidance was given under which safety rules. A turn the assistant flags as a crisis conversation is stored without its text |
| Assistant diary notes — short notes with topic and date | You, in the app — the assistant suggests a note and saves it only when you confirm | Keep the notes you chose to save. Deleted with your account; contact us to delete them sooner |
| Health goals and facts you describe to the assistant | You, in a form in the app — the assistant proposes but never writes to it on its own | Let the assistant answer against your own goals and circumstances. You can edit or clear it at any time |
| App usage and diagnostics — which features and screens were used, app version, error messages | Automatically from your device | Fix crashes and understand which features are used. Linked to an account identifier, so we disclose it here — see Section 4 |
| Support messages — what you write in "Send feedback", with your email | You, when you contact us | Reply to you and fix what you reported |
3. What We Do Not Collect
- Menstrual cycle data. The feature was removed on August 2, 2026 and is no longer offered. Nothing is collected, transmitted, or stored on our servers.
- Precise location. We never request GPS or precise location. We do keep your time zone (to date your records) and the country used to decide which consent rules apply, and when you ask the assistant to find a restaurant, the area you name is sent to Google Maps (Section 5).
- Advertising identifiers. We do not collect them and never combine any health data with them.
- Biometric identifiers. We do not collect fingerprints, face scans, or voiceprints.
- Data about you from third parties. We do not buy health data or obtain it from data brokers. Everything comes from you or your device, with one exception: a group organizer — including a partner clinic — can enter your email address to invite you to their group (Section 6). We keep that address for 90 days after it was entered and do not email you.
4. A Note on Usage and Diagnostic Data
We want to be precise here, because "anonymous analytics" is often claimed and rarely true.
- Usage events and error reports carry an account identifier, so they are pseudonymous, not anonymous. We treat them as linkable to you and disclose them as a category above.
- Because these events record which screens and features were used, they can reveal that you used a health feature. That is why they appear in this policy.
- Automatic error reports do not include your email address. Your email is attached only when you contact us yourself through "Send feedback", so that we can reply.
- We do not use this data for advertising, and we do not share it with advertising networks.
5. Who We Share It With
We share consumer health data only with service providers who process it on our behalf, under contract, and only as needed to run the service. They may not use it for their own purposes.
| Recipient | Category of third party | What they receive |
|---|---|---|
| Supabase Inc. | Cloud database and storage provider | All records you sync, plus food photos. Stored in Seoul, South Korea |
| Vercel Inc. | Hosting provider | Records in transit to and from our API. Our API runs in Seoul, South Korea and is delivered over a global edge network. Not stored |
| Google LLC | Authentication and payment provider | Account identifiers for sign-in, and Google Play transaction data for in-app purchases. No health records |
| Google LLC (Gemini API) | AI processing provider | Supplement label images, food photos, photos of health check-up reports, body composition result sheets and workout screenshots (a check-up report photo can show the name, date of birth and clinic printed on it), and text you submit for analysis (quick logs and food searches), along with any allergies you registered when a food photo, quick log or food search is analyzed, and your diet preferences for food searches; for AI assistant replies, your conversation plus the logs and health profile needed to answer — not used to train Google’s models; Google keeps logs for a limited period only to detect abuse. When the assistant looks up a restaurant on Google Maps, only the restaurant name and area are sent, and Google keeps them for 30 days; that lookup carries no health records |
| Apple Inc. | Authentication and payment provider | Account identifiers for Sign in with Apple, and App Store transaction data for subscriptions. No health records |
We have no affiliates and share consumer health data with none. We do not disclose it to third parties for their own purposes, except where the law requires us to.
6. Community Sharing You Control
The app includes an optional Community feature: private groups where you can share selected records with people you invite, and public channels we run, where records cannot be attached. This section explains exactly what that does with your health data.
- Nothing is shared unless you post it. Joining the app, or even creating a community profile, shares no health records. Only the specific snapshot you attach to a post — for example, a day’s health score or one workout summary — becomes visible, and only to members of the group you post it in.
- A post is a snapshot, not a pipe. It contains the values shown in its card at the moment you posted. It does not grant access to your history, your trackers, or future records.
- Groups are private. Members are people who created the group, joined with an invite link or code, or signed up with an email address the group organizer entered to invite them. Public channels we run are different: anyone signed in to the app can read their posts and comments, and records and photos cannot be attached there.
- You consent separately. Before your first use of Community, we ask for a distinct consent to this sharing. Declining it leaves every other feature working normally.
- You can undo it. Deleting a post removes it from the group, along with the photos attached to it, which are deleted right away; we keep the deleted post’s text and the records attached to it for 30 days so reports can still be reviewed, then delete them permanently. Deleting your account removes your posts with it. Leaving a group stops future sharing, but posts you already made stay in that group until you delete them. Withdrawing your sharing consent stops further sharing.
Recipients here are other users you chose, not third-party companies. Our service providers in Section 5 store this data for us, under the same contracts, in the same way as the rest of your records.
7. We Do Not Sell Consumer Health Data
We do not sell consumer health data, and we have never sold it. Under the My Health My Data Act, selling would require your separate, signed authorization, which we do not seek and have never obtained. We also do not share it for cross-context behavioral advertising.
8. Your Rights
You have the right to:
- Confirm and access — find out whether we collect, share, or sell your consumer health data, get a copy of it, and see the list of third parties it has been shared with
- Withdraw consent — withdraw your consent to our collection and sharing of your consumer health data at any time
- Delete — have your consumer health data deleted from our systems, including from our service providers
How to exercise them
- Delete everything, immediately, yourself: in the app, go to Profile → Account & data → Delete account permanently. This removes your account, all records, and your stored photos.
- Delete individual records: every tracker lets you delete an entry directly in the app. The one exception is assistant diary notes — contact us and we will delete them.
- Withdraw consent, access, or anything else: email contact@vivledia.com. We respond within 45 days, and will tell you if we need a permitted extension.
Withdrawing consent stops further collection and sharing. It does not by itself delete what we already hold — tell us if you want deletion as well, or use the in-app deletion above.
If we decline your request
You may appeal. Reply to our decision, or email contact@vivledia.com with "Appeal" in the subject line. We will review and respond within 45 days with a written explanation. If we deny the appeal, you may contact the Washington State Attorney General at www.atg.wa.gov/file-complaint.
9. How Long We Keep It
- Deleted immediately when you delete your account, including from our storage provider
- Food photos: deleted automatically 90 days after you save them
- A community post you delete: its photos are deleted right away; its text and the records attached to it are kept for 30 days so reports can still be reviewed, then permanently deleted
- Inactive accounts: deleted three years after you last used the app (opened it or synced a record); we email you 30 days before
- We keep a minimal record that consent was given or withdrawn — the date, which policy version, and an identifier — because we have to be able to demonstrate compliance. It contains no health data.
10. Contact
Celevo Co., Ltd. · contact@vivledia.com
We are based in the Republic of Korea, and the records you sync are stored there. Some of our service providers process data in the United States — see Section 5.
11. Changes to This Policy
If we change the categories we collect, why we collect them, or who we share them with, we will update this policy and obtain fresh consent before the change takes effect where the law requires it. We will not collect or share consumer health data beyond what this policy discloses.