Privacy Policy

1. Who We Are

Alva Health is a metabolic intelligence platform. Depending on your location, the data controller is:

Alva Health GmbH (European Union)

Friedrichstraße 95 · 10117 Berlin · Deutschland · HRB 256519B

Alva Health SA (Switzerland)

Zürichbergstrasse 13 · 8044 Zürich · Switzerland · CH-170.3.043.325-2

Novamed Wellness Global Trading FZCO (UAE · Middle East)

Building A1 · Dubai Digital Park · Dubai Silicon Oasis · UAE

Alva Metabolic Inc (United States)

501 Silverside Road · Suite 105 · Wilmington · Delaware 19809 · United States

References to ‘Alva Health’, ‘we’, ‘us’ or ‘our’ refer to the relevant entity for your jurisdiction.

2. Information We Collect

2.1 Information you provide

• Account information: name, email address, password
• Profile information: age, biological sex, height, weight, health goals
• Payment information: processed by Stripe — we do not store card details
• Communications: messages, feedback, and support requests

2.2 Health and biometric data

• Continuous glucose monitoring (CGM) data from your T-300D (EU) or CT-300D (UK) sensor
• Sleep patterns and duration
• Physical activity and movement data
• Heart rate and other biometric indicators
• Dietary information you choose to log
• EVA-generated energy scores and metabolic pattern data

2.3 Device and usage data

• Device identifiers, operating system, app version
• IP address and approximate location (country level)
• Pages and features accessed, session duration, scroll behaviour
• Interaction events via central analytics dispatcher
• CGM sensor model and firmware version

2.4 Data from third parties

• CGM sensor data via Zhejiang PocTech Co., Ltd. API
• Wearable device data where you connect a third-party device
• Attribution data from advertising platforms where applicable

3. How We Use Your Information

4. Legal Basis for Processing

4.1 GDPR (EU and UK)

• Contract: necessary to deliver purchased services
• Consent: for health data and marketing
• Legitimate interest: platform security and improvement
• Legal obligation: regulatory compliance

4.2 United States

We comply with applicable US state privacy laws including CCPA where applicable.

4.3 UAE

We comply with UAE Federal Law No. 45 of 2021 (PDPL) and applicable DIFC data protection law.

5. Health and Sensitive Data

Your health data is used exclusively to:

• Generate personalised metabolic insights and EVA predictions
• Track your progress and identify patterns over time
• Improve EVA accuracy using anonymised data only

Your identifiable health data is never:

• Sold to third parties
• Shared with insurers, employers, or governments without consent or legal requirement
• Used for advertising targeting
• Used for automated decisions with legal effects without human oversight

6. Automated Decision-Making (GDPR Article 22)

6.1 How EVA processes your data

EVA analyses your biometric data using pattern recognition to generate personalised metabolic recommendations. This constitutes automated processing under GDPR Article 22. The following safeguards apply:

• EVA outputs are recommendations only — you decide whether to act on them
• No recommendation creates legal obligations or clinically binding instructions
• A human review stage is available for any EVA output you dispute (contact support@alva.health)
• EVA operates within safety parameters set and reviewed by qualified professionals
• Confidence scoring is applied to all EVA predictions to signal reliability

6.2 Your right to object

You have the right under GDPR Article 22 to object to automated processing and to request human review of any EVA decision. Contact dpo@alva.health to exercise this right. We will respond within 30 days.

7. Privacy by Design and Security by Design

7.1 Privacy by Design

Privacy considerations are embedded throughout the design and development of all Alva Health products and features. Our Privacy by Design principles include:

• Data minimisation: we collect only the data necessary for the specific purpose
• Purpose limitation: data collected for one purpose is not reused for incompatible purposes
• Storage limitation: data is deleted or anonymised when no longer needed
• Default privacy: privacy-protective settings are the default, not an opt-in
• End-to-end security: privacy protections apply throughout the data lifecycle
• User control: you have meaningful control over your data at all times
• Accountability: we maintain records of all processing activities (GDPR Article 30)

7.2 Security by Design

Security is built into every stage of our product development:

• Threat modelling conducted at the design stage of new features
• Security requirements defined before development begins
• Code review with security checks before every production deployment
• Automated vulnerability scanning in the CI/CD pipeline
• Penetration testing conducted annually by independent third parties
• Encryption by default for all data at rest (AES-256) and in transit (TLS 1.3)

8. Data Breach Notification

8.1 Our obligations

In the event of a personal data breach, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where required under GDPR Article 33
• Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms (GDPR Article 34)
• Document all breaches in our breach register regardless of whether notification is required

8.2 What notification will include

• The nature of the breach and categories of data affected
• Approximate number of individuals and records affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact details of our Data Protection Officer

8.3 Reporting a suspected breach

If you believe your account or data has been compromised, contact security@alva.health immediately. We will investigate and respond within 24 hours.

9. Sharing Your Data

9.1 Service providers

9.2 Legal disclosures

We may disclose data where required by law, court order, or regulatory authority. We will notify you where legally permitted.

9.3 Business transfers

In the event of a merger or acquisition, data may transfer to the acquiring entity subject to equivalent protections.

10. International Data Transfers

Where we transfer personal data outside the EEA or UK, we apply:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreements (IDTAs)
• Adequacy decisions where applicable
• Transfer Impact Assessments where required

11. Data Retention Schedule

Upon account closure, identifiable personal data is deleted within 30 days unless retention is required by law.

12. Your Rights

12.1 EU and UK rights (GDPR / UK GDPR)

12.2 US rights

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt out of the sale of personal information
• Right to non-discrimination for exercising your privacy rights

To exercise any right: legal@alva.health · Response within 30 days (EU/UK) or 45 days (US).

13. Children

The Alva platform requires a minimum age of 13. For users aged 13–15 in EU member states, verifiable parental or guardian consent is required before processing health data (GDPR Article 8). If you believe we have inadvertently collected data from a child under 13, contact legal@alva.health immediately.

14. Cookies

We use cookies and similar technologies. Full details are in our Cookie Policy (ALVA-LEGAL-003). We use a consent management platform to ensure analytics and marketing cookies are only placed after explicit consent.

15. Trademarks

Trademarks

ALVA® and EVA® are registered trademarks of Alva Health GmbH. All rights reserved. Unauthorised use of these trademarks, including in domain names, product names, or marketing materials, is strictly prohibited without the prior written consent of Alva Health GmbH.

All other trademarks, service marks, and trade names referenced on the platform are the property of their respective owners.

16. Changes to This Policy

We will notify you of material changes by email or in-app notice at least 14 days before they take effect. Your continued use after the effective date constitutes acceptance.

17. Contact and Complaints

Legal enquiries: legal@alva.health

Data protection / DPO: dpo@alva.health

General support: support@alva.health

Security issues: security@alva.health

Supervisory Authorities

EU: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI) · datenschutz-berlin.de

UK: Information Commissioner’s Office (ICO) · ico.org.uk

UAE: UAE Data Office · tdra.gov.ae