Privacy policy

What we collect

We use these category names throughout this policy, so you can follow the same piece of data from collection through to sharing. "Personal data" means information that identifies or could reasonably be linked to you.

Why we use it, and our legal basis

The legal basis column applies if you are in the EEA, the UK or Switzerland. If you are in the US the purposes are identical; that column simply is not part of your framework.

Health data

Your quiz answers about sleep, skin, energy, fitness, focus and mood and how you eat, any self-reported weight or measurements, your assigned track, and the habits you record are all health-related. We treat the whole lot as sensitive, everywhere, regardless of which law applies to you.

EEA, UK and Switzerland. This is special category data under Article 9 of the GDPR and its UK and Swiss equivalents. We rely on your explicit consent, asked for separately when you provide the data — not bundled into accepting the terms. You can withdraw it at any time, and withdrawing does not affect anything we did lawfully beforehand. It does mean we can no longer build or adjust your plan, which effectively ends the service.

Washington, Nevada and Connecticut. This section is also our consumer health data privacy notice for the Washington My Health My Data Act, Nevada SB370, and the health provisions of the Connecticut Data Privacy Act.

Where it comes from. You, and only you. We do not buy health data, we do not get it from data brokers, and we do not collect it from wearables, Apple Health, Google Fit or any other outside source.

Why we collect it. To build your plan, adjust it as you go, show you the lessons that fit it, and let you track your own progress. That is the entire list.

We do not sell it. We never have, and we do not authorise anyone else to. Washington law requires a signed authorisation before any sale of consumer health data; we do not ask for one because we do not sell it.

We do not share it with advertisers. Meta, TikTok, Google and Hyros receive generic events only — a page view, that a quiz was started, that a subscription began. They do not receive your answers, your track, your measurements, or anything else in this section. This is a hard line, not a current configuration.

Who does see it. Only the providers who host and run Vivra for us, and our email provider for the messages we send you, acting on our instructions and barred from using it for their own purposes. Nobody else, unless the law compels us.

Your rights over it. You can ask us to confirm whether we collect, share or sell it, tell you who we have shared it with, and delete it — including from our backups and from our providers. Email [email protected]. We do not charge, and we will not treat you differently for asking. If we deny a request you can appeal by replying, and we will answer in writing.

Who we share it with

We do not sell your personal data for money. We use the providers below to run Vivra. Each acts on our instructions under a written data processing agreement, and may not use your data for its own purposes.

Other times we may disclose data

• Where the law requires it, or in response to a lawful request from law enforcement, a regulator or a court
• Where it is necessary to protect our rights, our users or the public, or to investigate fraud or abuse
• To a buyer or successor if Vivra is involved in a merger, acquisition or sale of assets — we will tell you before your data becomes subject to a different policy, and your rights will not be reduced

Do not sell or share my personal information — United States

We run advertising and attribution tools from Meta, TikTok, Google and Hyros, and analytics from Google Analytics, PostHog and Amplitude. When those set cookies or identifiers, California law treats it as "selling" and "sharing" your personal information for cross-context behavioural advertising, and other state laws treat it as targeted advertising — even though no money changes hands and no health data is involved.

You can opt out. Email [email protected] with the subject line "Do not sell or share". We will stop sharing your identifiers with advertising partners for targeted advertising, and confirm when it is done.

We honour Global Privacy Control. If your browser or extension sends a GPC signal we treat it as a valid opt-out for that browser automatically, and you do not need to email us.

We do not knowingly sell or share the personal information of anyone under 16. Vivra is 18+, so this should never arise.

Your health data is never part of any of this.

Cookies and tracking

We use cookies and similar technologies in four groups, and we keep them in these groups so a choice about one never quietly changes another.

• Strictly necessary — sign-in, security, load balancing, and remembering your consent choices. These cannot be switched off without breaking the service, and no consent is required for them.
• Functional — remembering your preferences and settings so the product behaves consistently. Turning these off leaves Vivra usable but more forgetful.
• Performance and analytics — counting visits, seeing which features get used, finding what to improve. Turning these off means we simply see less.
• Targeting and advertising — measuring our campaigns and showing you relevant ads. Turning these off means less relevant ads, not fewer.

Consent to tracking — EEA, UK and Switzerland

If you are in the EEA, the UK or Switzerland, nothing outside the strictly necessary group is placed on your device until you opt in. Declining costs you nothing and the product still works.

You can change or withdraw your choices at any time. Email [email protected] and we will action it, and you can also clear or block cookies in your browser settings.

International transfers

Vivra is operated from the United States, so if you are in the EEA, the UK or Switzerland your personal data is transferred there and to our providers.

Where a country has not been found to provide adequate protection, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and the equivalent Swiss provisions, together with additional technical and organisational measures. Some of our US providers also certify under the EU-US Data Privacy Framework and its UK and Swiss extensions.

You can ask us for a copy of the safeguards we use by emailing [email protected].

Your rights — EEA, UK and Switzerland

If you are in the EEA, the UK or Switzerland you have the right to:

• access the personal data we hold about you, and get a copy
• have inaccurate data corrected, and incomplete data completed
• have your data erased in the circumstances the law allows
• restrict how we use your data while a question about it is resolved
• object to processing we base on our legitimate interests, and to direct marketing at any time — for direct marketing we always stop
• receive your data in a portable, machine-readable format, and have it sent to another provider where technically feasible
• withdraw consent at any time, without affecting what we did lawfully before you withdrew it
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects — see the automated decisions section below
• lodge a complaint with your data protection supervisory authority, the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner

Your rights — United States

Depending on your state — California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Nebraska, New Hampshire, New Jersey, Iowa, Indiana, Kentucky, Rhode Island, Tennessee, Minnesota, Maryland and others as their laws take effect — you have some or all of these rights:

• know what personal information we collected, where it came from, why, and who we disclosed it to
• access a copy, in a portable format
• correct anything inaccurate
• delete it, subject to the narrow exceptions the law allows
• opt out of sale, sharing and targeted advertising
• limit the use of sensitive personal information
• not be discriminated against for exercising any of these rights
• appeal if we deny a request

California — Shine the Light

California Civil Code section 1798.83 lets California residents ask, once a year, what personal information a business shared with third parties for those third parties' own direct marketing purposes.

To ask, email [email protected] with "Request for California Shine the Light Privacy Information" in the subject line and your state of residence in the message. This law applies only to businesses with 20 or more employees, so it may not apply to us yet — we will tell you if that is the case.

How to exercise your rights

Email [email protected] from the address on your account and say which right you want to exercise. That is the only step.

We confirm receipt within 10 business days and respond within 45 days in the US, or within one month in the EEA, UK and Switzerland. We will tell you if we need an extension, and why.

To protect your data we may need to verify who you are, usually by confirming you control the account email.

You may use an authorised agent, provided they give us written authorisation signed by you and we can verify it with you directly.

If we deny a request, our response will explain why and how to appeal. To appeal, reply to that response — put "PRIVACY APPEAL" in the subject if you want it flagged. We decide appeals in writing within 45 days, and if we deny the appeal we will tell you how to complain to your state Attorney General or your supervisory authority.

None of this costs anything.

Automated decisions

Your quiz answers are scored automatically to suggest a starting track, how many habits to begin with, and which lessons to show first. It is a recommendation about how to use a wellness app — it has no legal or similarly significant effect on you, it does not decide your price, and you can ignore it entirely.

We do not use automated processing to make decisions about credit, employment, insurance or anything comparable, and we do not profile you for those purposes.

How long we keep it

We keep your account and plan data while your account is open, and for up to 12 months after you close it so you can come back without starting over. After that we delete or irreversibly anonymise it.

Quiz answers from people who never created an account are deleted after 12 months.

Billing and transaction records are kept as long as tax and accounting law requires, generally seven years. Records needed to establish or defend legal claims are kept as long as they may be needed.

When you ask us to delete your data we remove it from live systems promptly and from backups within 90 days as those cycle.

Security

Personal data is encrypted in transit and at rest, access is limited to the people who need it for their work, and we review that access. No service can promise perfect security, but if a breach affects your data we will notify you and the relevant authorities within the time the law requires.

Age

Vivra is for adults. You must be 18 or older. We do not knowingly collect personal data from anyone under 18, and if we learn we have, we delete it and close the account. If you believe a minor has given us data, email [email protected].

Marketing email

We send marketing email only where we have your consent or another lawful basis. Every marketing email has an unsubscribe link, and unsubscribing takes effect promptly.

Service messages — receipts, renewal and trial-conversion notices, security alerts, and changes to these documents — are not marketing. You will keep getting those while you have an account, because in several cases the law requires us to send them.

Who is responsible for your data

Vivra is the controller of the personal data described in this policy, and decides why and how it is processed.

Whatever your question — an access request, a deletion, a complaint, or just wanting to understand something here — email [email protected]. That address reaches us directly, wherever you are, and we answer every one.

Other sites

Vivra may link to sites we do not run. This policy does not cover them and we are not responsible for what they do with your data. Read their policies.

Changes to this policy

We may update this policy, and the date at the top shows when. If a change materially affects how we handle your data — and always before we would use your health data in a new way — we will tell you by email or in the app and, where the law requires it, ask for your consent first.

Contact

For anything in this policy, or to exercise any right in it, email [email protected]. We read every one.