Do Not Sell or Share My Personal Information

We Do Not Sell Your Data

Ovaela does not sell your personal information to third parties, ever. We do not participate in data brokerage, data marketplaces, or any arrangement where your information is exchanged for monetary or other valuable consideration.

No Targeted Advertising

We do not share your personal information for the purpose of targeted advertising, cross-context behavioral advertising, or any form of ad personalization. Your health data is used solely to provide you with wellness insights.

Sharing Only With Your Explicit Consent

The only time your data would be shared with another person is when you explicitly choose to do so. Ovaela is designing a future doctor-sharing workflow that would let you prepare and share a wellness summary with a provider you select, with explicit per-instance consent and revocation at any time; that workflow is not yet enabled. No such sharing happens today.

Third-Party Service Providers

To operate Ovaela, we use third-party service providers and processors. These providers receive only the data needed to perform their function. Where applicable, they operate under data-processing terms or agreements that limit use of your data to providing the service.

• Supabase: Encrypted database hosting, authentication, and file storage
• Anthropic (Claude AI): AI processing for wellness insights and conversational features where enabled. Data sent to Anthropic is used to generate your insights; Anthropic does not use commercial inputs or outputs to train its models by default. Ovaela is continuing to expand its data-processing and retention terms with Anthropic.
• Terra: Wearable-data aggregator used on some product surfaces to relay metrics from wearable devices (such as Oura, Fitbit, Garmin, Polar, Withings, or Suunto) that you choose to connect
• Perplexity: Retrieves published research that enriches your wellness insights. Receives research queries derived from your health observations after attempting to remove direct identifiers; these may include non-identifying markers, values, or trends, but not your identity or your full stored health record.
• Vercel: Application hosting, serverless functions, edge networking, and infrastructure delivery
• Stripe: Subscription payments and billing. Payment card details are entered directly with Stripe; Ovaela never sees raw card data.
• Sentry: Crash, error, and operational telemetry. Configured with default PII collection disabled and outbound-event redaction callbacks for request bodies, cookies, and IP/user context. Web and server tiers may also collect performance traces and request context for debugging.
• Upstash Redis: Per-user and per-request rate-limit tracking and Stripe webhook idempotency. Receives identifiers such as your user ID or request IP and limit/idempotency-key metadata, not your wellness data.
• PostHog: Web product analytics. Used on the web application only; the native iOS app does not include the PostHog SDK.
• Apple Push Notification service (APNs) & Web Push: Push notification routing for mobile and web. Ovaela stores a push token linked to your account so notifications can be delivered.
• Email delivery providers (Resend, and Postmark where configured): Send account, security, sharing-related, and notification emails. Ovaela does not include your personal health data in the emails it sends to you; the provider receives only your email address and the account or notification message needed to deliver them.

How to Exercise Your Rights

If you have questions about how your data is handled, or if you would like to exercise your rights under the California Consumer Privacy Act (CCPA/CPRA), the Washington My Health My Data Act, the Colorado Privacy Act, or any other applicable privacy law, please contact us at:

admin@ovaela.ai

For our full privacy practices, please see our Privacy Policy.