Privacy Policy

Let's be straightforward with each other.

Most privacy policies are written to give companies the legal cover to do whatever they want with your data. Ours is written to explain exactly how little of your data we actually touch.

At Enva, we believe your health and fitness data belongs to you. This Privacy Policy explains how Olympus Hills Ventures LLC ("Company," "we," "our," or "us") handles information when you use getenva.ai (the "Site") and the Enva mobile application (the "Mobile App") (collectively, the "Services").

By using Enva, you agree to this Privacy Policy and our Terms of Service. If you don't agree, please do not use the Services.

1. The Golden Rule: Your Raw Health Data Stays on Your Phone

• Local storage. When you connect Enva to Apple Health or other third-party integrations, that health and fitness data (like your heart rate, sleep metrics, and workout history) is imported and processed locally on your device. Individual timestamped records — discrete heart rate samples, GPS tracks, raw sleep stage events — never leave your phone.
• Computed summaries, not raw records. When AI features are enabled, Enva computes aggregate metrics from your data (like your weekly training load or your average sleep score) and sends that computed summary to our AI service to generate a response. The distinction matters: summaries are sent, raw records are not.

2. Information We Actually Collect (And Why)

While your health data stays on your phone, we do collect a limited amount of information to keep the app running, offer customer support, and figure out how to improve the product.

A. Information you provide directly

• Account and contact info: If you create an account or email us for support, we collect your name, email address, and the contents of your message.
• Payment information: We do not collect or see your credit card information. Subscriptions are handled entirely through the Apple App Store, subject to Apple's privacy policy.

B. Information collected automatically (app analytics)

• Usage data: We collect anonymized, non-personally identifiable data about how you use the app (for example, which screens you visit, what features you use, and session frequency). This data does not contain health information.
• Device data: Basic information like your device model, iOS version, and app version — used for crash analysis and compatibility.
• Analytics vendor: We use PostHog for product analytics. Analytics is opt-in: you are asked during onboarding and can change your preference in Settings. PostHog receives an anonymous rotating session ID — not your name, email, or Apple ID. No health data is included.

C. Bug reports and crash diagnostics

• MetricKit: If the app crashes, Apple's MetricKit framework sends an anonymized crash summary (crash type, app version, OS version, device model) to us. No health data is included.
• Report a Bug: If you submit a bug report through Settings → Report a Bug, we collect your written description, up to 30 recent in-app events (a breadcrumb log of actions, not health records), your device model and OS version, and optionally a screenshot you choose to attach. This is sent to our backend and retained for up to 12 months for debugging purposes.

D. AI-generated inferences

When you use AI features, Enva computes inferences from your health data — such as a recovery score, a training load estimate, or a wellness insight — entirely on your device. These inferences may be included in the computed summary sent to our AI service (see §3), but the underlying raw health records are not transmitted.

E. AI chat feedback

If you give a thumbs-down to an AI response in chat, we store a snippet of your question (up to 200 characters), the response index, and an anonymous session ID. This is retained for up to 12 months and used to improve response quality. A thumbs-up records only an anonymous count — no content is stored.

3. Enva Intelligence — How AI Features Work

Enva Intelligence is opt-in. If you choose not to enable it during onboarding, no health data ever leaves your device for AI processing. You can also disable it at any time after onboarding by going to Settings → Enva Intelligence in the app. Disabling the feature stops all future AI transmissions; it does not delete insights already generated or your local conversation history. If you do enable it, here is exactly what happens:

What is sent — tiered by feature:

• All AI features include a biometric baseline: recent HRV, resting heart rate, sleep score, recovery score, VO₂ Max estimate, and training load metrics — all as computed aggregates, never as raw timestamped records.
• Body and Insights features additionally include: weight, BMI, and body fat percentage (if you've entered them), and nutrition macro totals.
• AI Chat additionally includes: blood work values you've imported, goal notes you've typed, and the messages in your current conversation.
• Workout analysis additionally includes: session notes you've typed for that workout.

How the data travels — two paths:

• Most features. The context block is sent from the app to our backend (Google Cloud, us-central1 region), which forwards it to our AI service provider to generate your response. The backend does not write your health context to a database — it is used only to produce the response and is not retained after that.
• Workout screenshot import. If you use the screenshot import feature to import a workout from another app, the screenshot is sent directly from your phone to our AI service for data extraction. The image is not stored on our backend after extraction is complete.

Device identity. Your app is associated with an anonymous Firebase device ID — a stable per-install identifier used for AI quota tracking and to associate your conversation history within the app. This ID is not linked to your name, Apple ID, or email address. It is stored in your device's Keychain and survives app updates but is reset on reinstall.

What our AI service provider does not do. Your data is not retained by our AI service provider after your response is generated, and is not used to train AI models. For details, refer to our AI service provider's data processing terms.

Conversation history. Your AI chat history is stored locally on your device. It is not stored on our servers. If you delete the app, your conversation history is gone. The only exception is the chat feedback described in §2E above.

Reproductive health. Reproductive health data (menstrual cycle, fertility metrics) is not included in any AI context block by default. It stays on your device unless you explicitly type it into a chat message.

4. How We Share Your Information

We only share the limited data we collect (like your email or anonymized analytics) in the following scenarios:

• Service providers: With trusted vendors who help us operate the Services, including:
  • Google Cloud — backend infrastructure and Firebase services (anonymous device authentication and the backend that routes AI requests). Governed by Google Cloud's Data Processing Addendum.
  • PostHog — product analytics (opt-in only; receives an anonymous session ID and event names, no health data).
  • Apple — subscription billing via the App Store and MetricKit crash diagnostics.
  • AI service provider(s) — process computed health summaries on our behalf to generate AI responses when you have enabled Enva Intelligence. See §3 for details.
• Legal compliance: If we are legally required to do so by a valid court order, subpoena, or law enforcement request. We will notify you of any compelled disclosure to the extent permitted by law.
• Business transfers: If Olympus Hills Ventures LLC is acquired, merged, or sold, your contact and analytics data (but not your on-device health data) may be transferred as a business asset. Any successor will be bound to treat your data under terms no less protective than this policy.

5. Security and Data Retention

We use commercially reasonable security measures, including AES-256 encryption at rest and TLS in transit, to protect the limited data we do hold.

• Health data on-device: Stored in an encrypted SwiftData database protected by iOS file protection. You control retention — when you delete the Enva app, your local data is permanently deleted.
• Bug reports: Retained for up to 12 months and then deleted.
• AI chat feedback (thumbs-down): The prompt snippet (≤200 characters) is retained for up to 12 months and then deleted.
• PostHog analytics: Retained in anonymized, aggregated form. No health data is included.
• Crash reports (MetricKit): Retained for up to 12 months and then deleted.
• Subscription and contact data: Retained as long as your account is active or as required by law.

6. Children's Privacy

Enva is intended for users who are 18 years of age or older. You must be at least 18 to create an account and use the Services. We do not knowingly collect personal information from anyone under 18. If we learn that a user under 18 has accessed the Services, we will terminate that account and delete any associated data promptly. If you believe a minor has used Enva, please contact us at hello@getenva.ai.

7. U.S. State Privacy Rights

Many U.S. states have enacted comprehensive consumer privacy laws. If you are a resident of California, Utah, Colorado, Virginia, Texas, Washington, or another state with applicable privacy legislation, you have specific rights regarding your personal data.

Because we do not store your raw health data on our servers, these rights primarily apply to the data we do hold: your email address, support correspondence, analytics profile, and any bug report or feedback data.

• Right to know or access: You can ask us what personal data we hold about you.
• Right to delete: You can ask us to delete your personal data from our systems.
• Right to correct: You can ask us to correct inaccurate data.
• Right to opt out of sale or sharing: We do not sell or share your personal data for targeted advertising. This right is satisfied by our practices.
• Right to data portability: You can request a copy of your data in a portable format.

Washington My Health MY Data Act (MHMDA) and similar state health data laws. Enva processes certain health data as defined under state-level health privacy statutes, including biometric and fitness data. We collect and process this data only with your authorization, use it only to provide the Services, and do not sell it. To the extent state law grants additional rights with respect to health data, we honor those rights. Requests can be submitted to hello@getenva.ai.

To exercise any of these rights, email us at hello@getenva.ai. We will respond within 45 days. We will not discriminate against you for exercising your privacy rights.

"Do Not Track" and Global Privacy Control. We do not track users across third-party websites. We honor Global Privacy Control (GPC) signals for website analytics.

8. International Users (GDPR / UK GDPR)

If you are accessing Enva from the European Economic Area, the UK, or Switzerland, Olympus Hills Ventures LLC is the "data controller" for your contact and analytics data.

• Legal basis: We process this data to fulfill our contract with you (providing the app) and for our legitimate interests (improving the app).
• Your rights: You have the right to access, rectify, erase, restrict processing, object to processing, and request data portability.
• Data transfers: Your data is processed in the United States. By using Enva, you consent to this transfer.

To exercise your GDPR rights, contact us at hello@getenva.ai. You also have the right to lodge a complaint with your local data protection authority.

9. Third-Party Links

Enva may contain links to other websites or services, like Apple Health or research articles. We don't control those third parties, and this Privacy Policy does not apply to them. Please read their privacy policies before sharing your data.

10. Changes to this Policy

We may update this Privacy Policy from time to time. For non-material changes (typo corrections, clarifications that do not affect your rights), we will update the "Last updated" date at the top of this page. For material changes — changes that affect what data we collect, how we use it, or who we share it with — we will provide at least 30 days' notice through a prominent in-app notice before the change takes effect. Your continued use of Enva after the effective date of a material change constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding your privacy, please reach out to us:

Olympus Hills Ventures LLC
7533 S Center View Ct # R
West Jordan, Utah 84084
Email: hello@getenva.ai
Website: getenva.ai