Privacy Policy

1. Information We Collect

a. Information You Provide Directly

• Profile information — your name, email address, and password. We also ask for your age or date of birth, sex/gender, height, and weight, because these help us calculate your nutrition and calorie needs. You may optionally add a profile photo.
• Health profile data — to deliver personalized guidance, we ask about your cultural or dietary background (to tailor meal suggestions), dietary preferences and restrictions, relevant medical conditions (such as diabetes or hypertension), allergies, and your goals (such as "lose 10 lbs" or "manage blood sugar"). This information is sensitive, and we treat it with a high level of confidentiality.
• Meal photos and nutrition logs — the photos you take of your meals, the food and drinks you log (including quantities and times), the calorie and macronutrient information generated from them, and any notes you add. Over time this builds a diary of your eating habits. These are stored securely, are private by default, and are treated as personal information. We'll ask for permission to access your camera or photo library when needed, and you can delete your photos anytime.
• User-generated content — when you upload meal photos, food descriptions, comments, responses to challenges, progress updates, achievements, or other content through Olvi ("User-Generated Content" or "UGC"), we may use that content to provide and improve our services, personalize your experience, and operate community features, challenges, contests, rewards programs, points systems, badges, leaderboards, streaks, and other gamification features. Where we use your UGC for these purposes beyond your personal account experience, we will remove or anonymize information that directly identifies you whenever reasonably possible. We will not publicly display your name, contact information, or personal health information without your consent. Aggregated and anonymized information derived from UGC may also be used to analyze usage patterns, improve our products and services, and create educational, statistical, or promotional content.
• Activity data — any exercise or activity you log, and any wearable or fitness-tracker data you choose to sync.
• Communications — if you contact us for support or share feedback, we collect what you send us (such as your contact details and the content of your message).

A note on optional fields: sharing health details (conditions, allergies, etc.) is voluntary but helps Olvi personalize accurately. If you leave fields blank, your recommendations may be less tailored — for example, if you don't tell us about a peanut allergy, a suggested recipe might include nuts. Only share what you're comfortable sharing.

b. Information Collected Automatically

• Usage data — how you interact with Olvi, such as when you log in, which features you use, and time spent in the app. This helps us improve the experience.
• Device and technical data — your device type, operating system, unique device identifiers, crash and error logs, IP address, and general (country/region-level) location. We use this for functionality, troubleshooting, and security.
• Analytics data — aggregated information about app usage patterns (such as screens viewed and features used), gathered through analytics tools. This is aggregated and does not directly identify you in our analysis.

We do not track your precise GPS location in the background. If we ever add a feature that needs precise location (for example, finding nearby healthy restaurants), we'll ask your permission first.

c. Information From Third Parties

Olvi does not currently obtain information about you from data brokers or marketing firms, and we never purchase user data. If you choose to connect Olvi to an external service — for example, Apple Health, Google Fit, or a clinic or wellness-program system — we'll receive data from that source only after you authorize the connection, and we'll tell you what is imported.

2. Your Consent & How We Ask For It

We believe consent should be informed, meaningful, and easy to understand. Before creating an account and using Olvi's personalized features, you will be asked to actively review and agree to the following:

• ☐ I have read and understand Olvi's Privacy Policy and Terms & Conditions.
• ☐ I consent to Olvi collecting, storing, using, and processing the personal, nutrition, activity, lifestyle, and health-related information that I choose to provide in order to deliver personalized nutrition analysis, health insights, recommendations, coaching, and other app features.
• ☐ I understand that Olvi uses artificial intelligence and automated systems to analyze information I provide, including meal photos, food logs, activity information, and health-profile data, to generate personalized insights, nutrition estimates, recommendations, and other wellness-related content.
• ☐ I understand that some of the information I provide may be considered sensitive personal information or health information and consent to its processing as described in this Privacy Policy.
• ☐ (Optional) I agree to receive notifications, reminders, progress updates, educational content, product updates, and other communications designed to support my health goals. I understand that I may change these preferences or withdraw my consent at any time.

Additional Consent for Specific Features

Where required, Olvi will request separate consent before:

• Connecting to third-party devices, wearables, fitness trackers, health applications, laboratory services, or health-data platforms.
• Importing health, activity, sleep, glucose, exercise, or similar information from connected services.
• Sharing information with a healthcare provider, dietitian, coach, caregiver, family member, wellness program, or other third party selected by you.
• Using new features that require access to additional categories of personal information or sensitive health information.
• Participating in research studies, surveys, product testing, or optional programs that involve additional data collection or use.

You may review, update, or withdraw your consents at any time through the App settings or by contacting us. Withdrawing certain consents may limit or disable features that depend on that information. We avoid repeated interruptions — you won't be asked to re-consent at every screen, and where the law allows us to rely on a consent or preference you've already given, we will.

3. How We Use Your Information

We use your personal information to:

• Provide the core service. We process your photos and logs to estimate calories and macros, show your daily totals and nutrition analysis, and track your progress. We use your health profile (age, weight, goals, etc.) to set personalized calorie targets and meal plans. The App may request access to your camera or photos to do this — we'll explain why before asking, and you can manage permissions in your device settings.
• Personalize your experience. We use your diet, activity, goals, and health profile to generate customized meal plans, nutrition insights, and suggestions. These are informational and educational only — not medical advice (see our Terms & Conditions). You can always accept, ignore, or adjust them.
• Improve Olvi. We analyze usage data and feedback to fix bugs and build better features. This analysis is done in aggregate or with personal identifiers removed.
• Provide support and account notices. We use your contact details to respond to you and to send essential service messages (such as password resets or notices about changes to this policy). You can't opt out of these essential notices while you have an account.
• Communicate with you (with your consent for anything promotional). We don't currently send marketing messages. If that changes, we'll ask for your consent first, and you'll always be able to opt out.
• Meet legal and safety obligations. We may use or disclose information where necessary to comply with the law, respond to valid legal process, prevent fraud or security threats, or protect the rights and safety of users and others — disclosing only the minimum necessary, and notifying you where lawful.

4. Automated Processing & AI

Olvi relies on automated systems, including artificial intelligence, to deliver its core features:

• Meal photo analysis. When you upload a photo, AI estimates the food, portion size, calories, and macronutrients. These are estimates, not exact measurements, and may contain errors.
• Calorie goals and meal plans. We use your health profile to generate personalized calorie targets and meal suggestions automatically.

These automated outputs are informational and educational only. They do not make decisions that have legal or similarly significant effects on you, and they are not medical diagnosis or treatment. You can always review, adjust, or disregard them.

We do not permit third-party AI providers to use your identifiable health information, meal photos, nutrition logs, or other personal information to train their general-purpose AI models without your consent. Any use of data to improve Olvi's own products, services, or AI capabilities is performed using de-identified, aggregated, or anonymized information where reasonably possible.

Some third-party services integrated with or linked from Olvi may be governed by their own privacy policies and terms of use. While we carefully select our service providers and take reasonable steps to protect your information, we cannot control or guarantee the privacy, security, availability, or practices of independent third-party services. We encourage you to review the privacy policies and terms of any third-party services you choose to access through or in connection with Olvi.

5. How We Handle Your Sensitive Health, Food & Image Data

Because Olvi is a nutrition and health app, much of what you share is sensitive personal information — including:

• Health metrics — age, sex, height, weight, conditions, allergies, and goals.
• Food and nutrition logs — what you eat, when, and the calorie/macro data derived from it.
• Behavioural patterns — habits and trends inferred from your logs (for example, hydration or eating-time patterns).
• Images — meal photos and any progress photos, which may reveal personal or bodily information.

We protect this category of information with heightened care: it is encrypted in transit and at rest, access is strictly limited to authorized personnel who need it, it is stored on secure servers in Canada, it is never sold and never disclosed to employers, insurers, or family members without your consent, and you can delete your photos and logs, export your data, or delete your account at any time.

6. How We Share Information

• a. Service Providers (Processors). We use trusted third parties to help operate Olvi — such as cloud hosting and storage, AI image-analysis services, analytics, and email delivery. They process your data only on our behalf and under our instructions, are contractually bound to protect it, and may not use it for their own purposes.
• b. Healthcare Providers & Wellness Programs (With Your Consent). If you use Olvi through a clinic, provider, or wellness program and you explicitly choose to link your account, we'll share relevant information — such as your nutrition and activity logs, progress reports, or summary insights — with them to support your care or program. We will never do this without your consent, and you can disconnect at any time. (Any data already provided to a clinic as part of your record remains under that clinic's custody and policies.)
• c. Research Partners (De-Identified). We may use de-identified, aggregated data to support research and product improvement — for example, studying general nutrition or activity trends with academic or public-health partners. This data does not include your name, email, or other direct identifiers and cannot reasonably be used to identify you, and partners are contractually bound to protect it and use it only for the approved purpose. If we ever wished to use identifiable information for research or to contact you for a study, we would seek your explicit consent and any required ethical approvals first.
• d. Legal Requirements. We may disclose information where we genuinely believe it's necessary to comply with the law or valid legal process, respond to lawful requests by public authorities (including permitted public-health or safety disclosures), or protect our rights or the safety of users and others. We disclose only what's necessary, and notify you where lawful.
• e. Business Transfers. If Olvi is involved in a merger, acquisition, financing, or sale, your information may be transferred as part of that transaction. We will ensure the new entity honours this policy, or seek your consent for any material change, and we'll notify you.

f. Information & Results You Choose to Share Yourself

Olvi lets you export and share your own information and Results — for example, sending a nutrition breakdown to your dietitian or posting your progress on social media. This sharing is initiated by you, with your own data, and is different from the situations above where we share data on your behalf (which we do only with your consent or as the law allows).

When you share publicly (for example, on social media), the information becomes visible to others and leaves our control. Please consider carefully what you reveal about yourself — anything containing health information is sensitive. When you send Results to a third party such as a dietitian or coach, how they store and use that information is governed by their privacy practices, not ours. You're always in control of your own sharing. If you connected a healthcare provider through Olvi and want to stop that sharing, see Section 6(b).

7. Where Your Data Is Stored & How Long We Keep It

Data location. Olvi stores your personal information on secure cloud servers located in Canada. Some limited processing — such as AI analysis of your meal photos — may be carried out by trusted service providers; where any such processing occurs outside Canada, we put contractual and technical safeguards in place to protect your information to a comparable standard, as required by applicable law.

Retention. We keep your personal information only as long as necessary to provide the service and meet our legal obligations. While you have an account, we keep your data so Olvi works for you. If you delete your account or request deletion, we securely delete or anonymize your personal data, except anything we're legally required to retain (for example, certain compliance records, or limited backup archives that age out over time).

Users in the United States

If you access or subscribe to Olvi from the United States, additional U.S.-specific protections apply, including U.S. consumer-health-data protections (such as applicable state consumer health data laws). Our U.S. Consumer Health Data Notice — set out in Section 12 below — describes how we handle consumer health data for U.S. users.

8. How We Secure Your Information

Our safeguards include:

• Encryption. Data is encrypted in transit (HTTPS/TLS) and at rest. Sensitive health information and passwords are encrypted in our systems.
• Access controls. Access to personal data is limited to authorized personnel who need it, using authentication, role-based access, and regular audits.
• Secure infrastructure. We host data in secure facilities with firewalls, monitoring, and timely security patching.
• Minimization & de-identification. We collect only what we need and separate or remove identifiers where possible.
• Staff training. Everyone who may handle personal data is trained on confidentiality and data protection.
• Breach response. No system is perfectly secure. If a breach occurs, we'll act quickly to contain and investigate it, and we'll notify affected users and the relevant privacy regulator at the first reasonable opportunity, as the law requires.

You play a role too: use a strong, unique password, don't share it, and log out on shared devices. We'll never ask for your password by email. If you notice anything unusual, contact us right away.

9. Cookies & Similar Technologies

Within the mobile app, our use of cookies is minimal. Our website and emails may use cookies for login, security, and analytics, and you can control non-essential ones through your browser settings or any cookie-preference tool we provide. If you use any Olvi website or receive our emails, we may use:

• Essential cookies — required for core functionality, login, and security (for example, keeping you signed in and protecting against fraudulent activity).
• Non-essential / analytics cookies — which help us understand how people use our site so we can improve it (for example, through privacy-respecting analytics tools).

10. Your Privacy Rights & Choices

Subject to applicable law, you have the right to:

• Access the personal information we hold about you. Most of your data is visible in the app; for a full export, contact us and we'll provide it in a common format. We aim to respond within 30 days where feasible.
• Correct or update inaccurate information. You can edit much of your profile directly; for anything you can't, contact us.
• Delete your data / withdraw consent. Deleting your account withdraws your consent and erases your personal data from our active systems (except what we must retain by law).
• Opt out of marketing, if we ever send it, via the unsubscribe link or your notification settings.
• Data portability, where applicable — to receive your data in a structured, machine-readable format.

To exercise any right, contact us (Section 15). To protect you, we may need to verify your identity. These requests are free, except in rare cases where a request is manifestly unfounded or excessive (in which case we'll explain). If we can't fully honour a request, we'll tell you why.

11. Regional Rights (EU/UK and California)

• If you are in the EU or UK: we process your personal information on one or more lawful bases — performing our contract with you, your consent, our legitimate interests (such as operating, securing, and improving Olvi), and legal compliance. Health-related information is "special category" data, which we generally process based on your explicit consent. You have the rights described in Section 10, plus the right to object to or restrict certain processing, and to lodge a complaint with your local data protection authority (such as the UK's Information Commissioner's Office). For cross-border transfers, we use recognized safeguards such as standard contractual clauses.
• If you are a California resident: you have the right to know what personal information we collect and how we use and disclose it, to request access and deletion, to correct inaccurate information, and to not be discriminated against for exercising your rights. We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising. You may also have rights regarding sensitive personal information (which includes health information). For Olvi's detailed U.S. consumer-health-data practices, see Section 12. To exercise your rights, contact us (Section 15).

12. U.S. Consumer Health Data Notice

This is a dedicated notice about your consumer health data — the nutrition, weight, activity, and health information you share with Olvi. It explains what we collect, why, who we share it with, and the rights you have, and you can access, delete, or withdraw your consent at any time.

This Consumer Health Data Notice ("Notice") supplements Olvi's U.S. Privacy Policy and applies specifically to "consumer health data" as defined under U.S. state consumer-health-data laws, including Washington's My Health My Data Act (MHMDA), Nevada's SB 370, and comparable laws. It is provided as a separate, dedicated notice and forms part of Olvi's U.S. Supplemental Terms (see "Additional Terms for U.S. Users" in our Terms & Conditions). Capitalized terms not defined here have the meaning given in this Privacy Policy.

What "Consumer Health Data" Means — and the Standard We Apply

Different states define health data differently. Rather than treat you differently depending on where you live, we apply the broadest, most protective standard to every U.S. user. We treat as "consumer health data" any information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status — or that qualifies as consumer health data, sensitive data, or health data under any applicable U.S. state law. We apply the commitments and rights in this Notice to that data for all U.S. users, regardless of your state of residence. Where a specific state grants you a right beyond what is described here, that right also applies to you.

Categories of Consumer Health Data We Collect

We may collect or receive the following categories of consumer health data, only as you provide them or authorize them:

• Health profile and conditions — health conditions you choose to share (such as diabetes or hypertension), allergies, and dietary or medical restrictions.
• Body measurements and metrics — height, weight, and (if you connect a device) related measurements such as heart rate or other physiological readings.
• Nutrition and food data — your meals, food and beverage logs, eating times and patterns, and the calorie and macronutrient information generated from them.
• Activity data — exercise and activity you log, and activity, sleep, or glucose data imported from a wearable or health platform you choose to connect.
• Health and wellness goals — for example, "manage blood sugar" or "lose 10 lbs."
• Meal and profile images — photos you submit, which may reveal personal or bodily information.
• Inferences — insights about your nutrition, habits, or health status that Olvi derives from the above to personalize your experience.

We collect only what is necessary for the purposes below, and sharing any of this data with Olvi is your choice.

Sources of Consumer Health Data

We collect consumer health data from:

• You — directly, when you create your profile, log meals, set goals, or contact us.
• Your device — through your use of the App, where you grant the relevant permissions (such as camera or photo access).
• Services you connect — wearables, fitness trackers, or health platforms (for example, Apple Health or Google Health Connect) that you choose to link, subject to the permissions you set.

We do not buy consumer health data from data brokers.

Why We Collect and Use Consumer Health Data

We collect and use consumer health data to:

• provide, personalize, secure, and improve the Service — including estimating nutrition, setting your goals, and generating insights and coaching;
• respond to your requests and provide support and account communications;
• with your consent, support optional activities such as research, surveys, or programs you join;
• create de-identified or aggregated data where reasonably possible; and
• comply with our legal obligations.

We use consumer health data only for purposes that are necessary to provide what you have requested, or for which you have given consent.

How We Share Consumer Health Data — and How We Don't

We share this data only to run Olvi for you, or with a provider or program you choose to connect.

• Service providers (processors). We share consumer health data with vendors who operate Olvi on our behalf — such as secure cloud hosting (located in Canada) and AI image-analysis services — under contracts that bind them to protect it and use it only for us.
• A provider or program you connect. If you choose to link a healthcare provider, dietitian, coach, or wellness program, we share the relevant data with them, with your separate consent, to support that connection. You can disconnect at any time.
• De-identified research. We may share de-identified or aggregated data that cannot reasonably identify you, with partners bound to protect it and use it only for the approved purpose.
• Legal requirements and business transfers. We may disclose data where required by law or in connection with a merger, acquisition, or sale, as described in this Privacy Policy.

We obtain your separate, specific consent before sharing consumer health data with a third party, except where the law permits sharing without consent (such as with our processors under contract).

Your Consumer Health Data Rights

For all U.S. users, you have the right to:

• Access the consumer health data we have collected about you;
• Confirm whether we collect, share, or sell your consumer health data, and the categories of third parties with whom we share it;
• Delete your consumer health data; and
• Withdraw consent to our collection or sharing of your consumer health data.

We will respond within the time required by applicable law. We will not discriminate against you for exercising these rights. If you withdraw consent or request deletion, some or all features of Olvi may stop working.

How to Submit a Request and Contact Us

For questions about this Notice or our consumer-health-data practices, email privacy@olvi.io. To protect you, we may need to verify your identity before acting on a request.

13. Children's Privacy

Olvi is intended for users 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, please contact us and we'll delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We'll revise the "Last Updated" date above and, for material changes, notify you (for example, by in-app notice or email). Continued use of Olvi after a change takes effect means you accept the updated policy.

15. Contact Us

For any privacy question, request (access, correction, deletion, withdrawal of consent), or complaint:

• Privacy contact: privacy@olvi.io
• General support: support@olvi.io
• Mailing address: Serathia Inc., Ontario, Canada

Please describe your question or request and include your contact details. We may need to verify your identity before acting on certain requests, to keep your data safe. Thank you for reading — and for trusting us with your health journey. Your data is in good hands with Olvi.