Privacy Policy

Your account. An email address and a password. The password is stored only as a cryptographic hash by our authentication provider; we never see it.

The record you build. Whatever you choose to add: medications and doses, conditions, allergies, vital signs, lab results, imaging, vaccinations, surgeries, hospital stays, family history, insurance details, emergency contacts, appointments, visit notes, personal notes, and documents you photograph or upload. If you use cycle tracking, that includes period, symptom and pregnancy entries. All of it is optional — the record holds what you put in it and nothing else.

Readings you import from Apple Health. Only if you turn the import on, and only after iOS shows you its own permission sheet. See the Apple Health section below.

Sharing activity. When you share your record or invite someone to help manage it, we store who you invited, what you chose to share, and a log of access: when a share was opened, from what kind of device, and the name the viewer typed for themselves. That name is a claim, not a verified identity, and the log shows it to you that way.

No advertising identifiers, no analytics or tracking SDKs, no location data, and no contact-list access. Notification reminders are scheduled on your device by the app itself — we do not operate a push service and never hold a push token. We do not sell data, share it with advertisers or data brokers, or use it to train AI models. There are no ads in Cavora.

The Apple Health import is read-only. Cavora asks iOS for permission to read vital-sign types — heart rate, blood pressure, oxygen, glucose, temperature, weight and similar — and requests no write access at all. Nothing is ever written back to Health.

Readings you allow are copied into your Cavora record so they can appear alongside the rest of it, and are labelled “Apple Health” wherever they show up, so you and anyone you share with can always tell them from readings you entered yourself. Health data is used only to provide this feature — never for advertising, never for marketing, and it is never disclosed to third parties except as part of a share you initiate.

You can turn the import off at any time in the app’s settings, change what Cavora may read in the Health app (Sharing › Apps), and delete imported readings like any other entry. Deleting your account deletes them too.

Your record is stored with Supabase, our database and file-storage provider, in a managed PostgreSQL database and a private storage bucket. Data is encrypted in transit (TLS) and encrypted at rest by the hosting platform.

Access is enforced at the database layer with row-level security: an account can reach its own record, and records explicitly shared with it, and nothing else. Uploaded documents are never publicly addressable — they are served through short-lived signed URLs that expire.

If you turn on Face ID, Touch ID or fingerprint unlock, the biometric check happens entirely on your device through the operating system. Cavora receives only the yes or no; biometric data never reaches us and never leaves your phone.

Nothing in your record is visible to anyone else until you share it. When you do, you choose what is included, shares expire on the schedule you set, and you can revoke any share or invitation at any time. A clinician opening a share link sees what you chose to include, in their browser, without an account.

Two service providers process data to make the product work: Supabase (database, authentication and file storage, described above) and Resend, which delivers the emails you ask us to send — an invitation to a helper, or a share notification. Those emails carry names and the instructions needed to use what you shared; they do not carry the contents of your record.

Beyond that, we disclose data only if the law requires it. We do not sell it, rent it, or trade it — to anyone, in any circumstances.

Your record exists for as long as your account does. Delete an entry and it is removed; delete your account and your record, documents and sharing history are deleted from our live systems. Copies inside encrypted infrastructure backups expire automatically on a rolling schedule. See Data deletion for the exact steps.

You can read, correct and delete everything in your record from inside the app — the record is yours to edit. You can revoke any share or helper’s access at any time, turn the Apple Health import off, and control reminders in your device’s notification settings. You can delete your account, and everything in it, without contacting anyone.

Depending on where you live, data-protection law may give you additional rights — to access, correct, export, restrict or erase personal data. Email privacy@cavorahealth.com and we will honour them.

Cavora is not directed at children under 16, and we do not knowingly collect data from them. A parent or guardian managing a child’s health information within their own account is responsible for that decision. If you believe a child under 16 holds their own account, contact us and we will delete it.

If what the product does changes, this page changes with it, and the date at the top moves. For material changes — anything that touches what we collect or who can see it — we will tell you in the app before the change applies to you.