The controller responsible for processing your personal data within the meaning of Art. 4(7) GDPR is:
Daniel Denis Golaszewski, operating as "HAVYT"
Self-employed professional (autónomo) registered in Spain
NIF: Z3964150J
Avinguda d'Alexandre Rosselló 15, 6 D, 07002 Palma de Mallorca, Illes Balears, Spain
Email (support and data protection): support@havyt.app
HAVYT is provided as a web application at app.havyt.app, as an iOS app, and with a marketing website at havyt.app / www.havyt.app.
This policy is drafted under the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Spanish Organic Law 3/2018 on Data Protection and Digital Rights Guarantee ("LOPDGDD") and, for information-society services, Law 34/2002 ("LSSI-CE").
For all data-protection matters, contact support@havyt.app. We respond within one month (Art. 12(3) GDPR).
This policy covers:
It does not cover third-party services you use under their own terms (e.g. Apple Health, your wearable's own app, the Apple App Store) — those providers are independent controllers of the data they hold; see Sections 9 and 10.
We collect only what you actively provide or what a feature you choose to use requires. By category:
Email address, password (stored only as a hash by our authentication provider), display name, country, avatar image, language/locale, account timestamps.
Note on avatars: avatar images are stored in a publicly readable storage location — anyone with the direct link can view your avatar. Do not upload an avatar you consider private.
Sex, date of birth, height, weight, activity level, occupation type, fitness goals, available equipment, training experience, diet type, cooking skill, coaching-tone preference, and — if you provide them — food allergies and intolerances (treated as health data, Section 6).
Whether you have declared Ankylosing Spondylitis (AS) or another condition, affected body areas, baseline pain, known flare triggers, training sensitivity, injuries, movement restrictions, and implants/pacemaker information you choose to record.
Energy, stress, soreness, sleep quality and times, mood (with optional tags and free-text notes), steps, weight; and — in the AS symptom check — pain level, pain region and pain quality, morning stiffness duration, fatigue, flare level, eye symptoms (redness, pain, light sensitivity, blurry vision), gastrointestinal symptoms including blood in stool, rash and fever. Weekly BASDAI questionnaire answers and the computed score (a self-tracking score, not a diagnosis).
Free-text notes may contain anything you choose to write; we treat all check-in content as health data.
Cycle phase, bleeding level, cycle symptoms and severity, relief methods used, menstrual status, and pregnancy/postpartum status — only if you enable cycle tracking (Section 6).
Standalone pain logs (location, type, intensity, notes) and illness episodes (illness type, severity, temperature, symptoms, free-text medication notes).
Medication tracking in HAVYT is deliberately minimal: a daily taken yes/no plus an optional label you choose to enter. We do not ask for doses, prescriptions or medication schedules by default. Supplement tracking covers supplement names, dosage, frequency and daily intake.
Meals, estimated macros, ingredients, notes, meal photos, water intake and alcohol logs. Scanning a barcode sends the barcode (and your IP address) to Open Food Facts to look up the product (Section 10).
Exercises, sets, reps, weights, RPE (effort), pain reported during training, session feedback, workout schedules and generated training plans.
If you enable outdoor activity tracking: full-precision GPS route polylines, distance, pace and elevation, including background location while a tracked outdoor session is running. See Section 8.
If you connect Apple Health: activity and workouts; heart, recovery, respiratory and temperature measurements; sleep and sleep stages; mobility and running/cycling measurements; body measurements; and, only when you enable the relevant optional group, nutrition, hydration, cycle/reproductive-health, mindfulness and compatible symptom entries. Limited source and device identifiers are used to prevent duplicates. HAVYT does not request clinical Health Records. See Section 9.
If you enable weather features, an approximate location (city-level rounding) is used to fetch local weather. We store your location rounded to roughly 11 km (0.1°) together with a city label and daily weather summaries.
Your chat messages, voice-call transcripts, and the health-context block assembled from your data (profile, declared conditions, allergy list, medication yes/no flags, cycle phase, recent check-ins and symptoms, wearable metrics, supplements, coach notes) that is sent to OpenAI to generate responses; plus AI-generated coach notes, memory entries and conversation summaries stored in your account. See Section 7.
Progress photos (front/side/back) and meal photos, stored in private storage locations accessible only to you. If you tap "analyze", the photo is sent to OpenAI (Section 7).
App version, platform, device model/OS as reported by your device, push notification tokens and notification preferences, error information.
Usage events (e.g. session started, onboarding step completed, screen viewed) recorded in our own database only. HAVYT contains no third-party analytics or advertising SDKs. You can turn product analytics off in Settings.
IP addresses and user agents in security-related logs (admin access, rate limiting, invite-code attempts).
Support tickets and emails you send us, including any health information you volunteer in them.
Email address, name and a confirmation token if you join the waitlist on havyt.app (double opt-in).
Store product identifier, transaction/event identifier, storefront price/currency and credit fulfilment status received from RevenueCat/Apple. HAVYT currently sells one-time consumable AI-credit packs, not subscriptions. We never receive or store your card or bank details; Apple handles payment. See the AI Credits, Billing & Refund Policy.
If you apply to work with HAVYT, we process the information you submit, such as contact details, application answers and a CV. The protected admin portal also processes staff account, role, support-ticket, operational audit and security-log data. Authorized support staff may access the minimum account information needed to investigate a request; health or AI content is accessed only when relevant to the request, safety, fraud/security, or a binding legal obligation.
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and operating your account; core app features you request (workout logging, plans, schedules, streaks) | Account, profile (non-health parts), workouts (non-pain parts), gamification | Art. 6(1)(b) — contract |
| All health tracking (check-ins, symptoms, BASDAI, pain, illness, medication yes/no, supplements, allergies, body metrics) | Sections 4.2–4.9 health parts | Art. 6(1)(a) + Art. 9(2)(a) explicit consent |
| AS Mode (condition-aware coaching and safety adjustments) | Section 4.3 | Art. 6(1)(a) + Art. 9(2)(a) explicit consent |
| Cycle and women's health tracking | Section 4.5 | Art. 6(1)(a) + Art. 9(2)(a) explicit consent |
| AI coaching (chat, voice, plan generation, insights prose) via OpenAI | Section 4.13 | Art. 6(1)(a) + Art. 9(2)(a) explicit consent |
| Photo analysis (progress and meal photos) via OpenAI | Section 4.14 | Art. 6(1)(a) + Art. 9(2)(a) explicit consent |
| Wearable/health-platform import (per provider) | Section 4.11 | Art. 6(1)(a) + Art. 9(2)(a) explicit consent, per connection |
| GPS activity tracking | Section 4.10 | Art. 6(1)(a) — consent, requested at first outdoor session |
| Weather features | Section 4.12 | Art. 6(1)(a) — consent for location; Art. 6(1)(f) for the weather data itself |
| Push notifications and reminders | Section 4.15 tokens/preferences | Art. 6(1)(a) — consent (device-level opt-in + in-app toggles) |
| Product analytics (first-party) | Section 4.16 | Art. 6(1)(a) — consent via in-app toggle; Art. 6(1)(f) for a minimal set of essential service events |
| Security, abuse and fraud prevention | Section 4.17 | Art. 6(1)(f) — legitimate interest (keeping the service secure). We never rely on legitimate interest for health data. |
| Support | Section 4.18 | Art. 6(1)(b); health details you volunteer are processed at your initiative to handle your request |
| Waitlist / newsletter | Section 4.19 | Art. 6(1)(a) — consent (double opt-in) |
| Billing records and invoicing | Section 4.20 + tax records | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation (Spanish tax law) |
| Job applications and recruitment | Section 4.21 | Art. 6(1)(b) steps at your request before a possible contract; Art. 6(1)(a) consent where we ask to retain an unsuccessful application for future roles |
| Proving consent and legal acceptance | Consent records (Section 6.4) | Art. 6(1)(c)/(f) — demonstrating compliance (Art. 7(1) GDPR) |
Where we rely on consent, you may withdraw it at any time with effect for the future (Section 14). Where we rely on legitimate interest, you may object (Section 14).
Most of what HAVYT does involves "data concerning health" under Art. 9(1) GDPR — including derived values such as readiness scores, flare-outlook states and detected patterns, because they are computed from your health logs. Processing such data is prohibited unless an exception applies; we rely exclusively on your explicit consent (Art. 9(2)(a)).
Before the core health-tracking service starts, you actively accept this version of the Privacy Policy using a dedicated checkbox that expressly covers the health-data processing described here. We keep the accepted document version, time, method, app version and platform. Optional processing is controlled separately:
The relevant screen explains the data, purpose and recipient before optional processing starts. Declining an optional consent does not block features that do not require it. HAVYT cannot provide health-personalized tracking without permission to process the health data you choose to enter.
You can withdraw any of these consents at any time by emailing support@havyt.app, and — where the app offers a control for it — directly in the app: the AI features toggle in Settings disables AI processing, each wearable connection can be disconnected individually, and product analytics can be switched off in Settings. On withdrawal we stop the related processing; withdrawal does not affect the lawfulness of processing before it (Art. 7(3) GDPR). You can additionally ask us to erase the data already collected (Section 14).
For the core privacy consent we record the accepted document/version, timestamp, method, app version, platform and technical audit data. For AI we record the AI disclosure version and opt-in/withdrawal timestamps. Apple and the operating system retain their own permission records for HealthKit, location and notifications. We do not claim a separate HAVYT consent record where the permission is controlled only by the device.
HAVYT's AI coach "Emelie" and related AI features are powered by OpenAI.
What is sent to OpenAI, only after you enable AI and request the relevant feature:
What OpenAI does with it: OpenAI processes this data as our processor under a data processing agreement. Under OpenAI's API terms, data submitted via the API is not used to train OpenAI's models by default.
What Emelie is not: Emelie is a wellness coach, not a doctor. She does not diagnose, prescribe or replace professional care; her outputs are informational and hedged, and safety-relevant answers point you to healthcare professionals. See also the AI Disclaimer and Medical Disclaimer.
You can withdraw AI consent with the AI toggle in Settings. The server then blocks further AI transmissions. Existing conversations, transcripts and coach notes remain in your account until you delete them or your account.
If you start an outdoor activity, and only after you grant location permission, we record your route at full precision — including in the background while the tracked session runs — to draw your route map and compute distance, pace and elevation. Routes are stored in your account until you delete the activity or your account.
Be aware: a route that starts or ends at your home reveals where you live. Route data is private to your account by default, but consider where you start and stop recordings.
Map styles and tiles are fetched from OpenFreeMap, which receives your IP address and the coordinates of the requested tiles (an approximate area, not your account identifier or recorded route file).
If you enable weather features, an approximate location (city-level rounding) is used to fetch local weather from Open-Meteo (an EU non-profit service; no account identifier is sent). We store only a location rounded to ~11 km (0.1°). You can use a manually chosen city instead of device location.
Apple Health is currently the only health service HAVYT connects to. The import requires your explicit consent (Section 6.1, item 7) and your authorization on Apple's side.
What arrives through Apple Health varies. Each device maker decides which measurements its own app writes into Apple Health, and you decide which categories you grant us. Some values may therefore be missing, less detailed, or delayed compared with what you see in the provider's own app, and some — for example a provider's own readiness, recovery or strain score — may never appear at all. We can only read what is actually present in Apple Health, so we cannot promise complete or continuous data from any particular device.
Selected imported records and limited source attribution are stored in HAVYT's Supabase database for sync, summaries and product features. HAVYT uses compact, source-attributed summaries for Daily Check-In, explainable wellness scoring, trends, AS/flare context, doctor reports and — only after AI consent — the minimum relevant context for Emelie. Raw HealthKit streams are not routinely sent to OpenAI. HealthKit data is never sold, used for targeted advertising or used for unrelated marketing profiles.
Disconnecting stops HAVYT sync but keeps existing history. The separate confirmed Delete imported Apple Health data action removes HAVYT's server-side Apple Health mirrors without deleting data from Apple Health. You can revoke read and write access in Apple's Health settings at any time.
Apple and the makers of any device you use remain independent controllers of the data they hold about you, under their own privacy policies. Naming a device or service here describes where data can come from; it does not mean that company sponsors, endorses or is affiliated with HAVYT.
If you connected a wearable directly in an earlier version. Earlier builds of HAVYT offered a direct Oura, WHOOP or Huawei Health connection. That option has been withdrawn. If you used it, we may still hold an access token for that provider; it is no longer used to import any data. Write to support@havyt.app and we will delete it, and you can remove HAVYT's access at any time in that provider's own account settings, which takes effect immediately on their side.
We never sell personal data and never share it for advertising. Data is disclosed only to the following, only as needed. A user-friendly overview is also available on our Data Processing page.
| Provider | What they do for us | Data they handle | Health data? | Location / transfer |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage, server functions — our core infrastructure | All app data | Yes | Engaged under GDPR safeguards; any processing outside the EU/EEA is covered by an adequacy decision and/or Standard Contractual Clauses in the provider's DPA |
| OpenAI | AI coach chat, voice (Realtime + transcription), photo analysis, plan generation, report summaries and staff-assisted support summaries/drafts | Chat/support content including health context where relevant, real-time voice audio, selected photos | Yes | USA — EU–US Data Privacy Framework and/or SCCs via the OpenAI DPA; API data not used for model training per OpenAI API terms |
| RevenueCat | In-app purchase validation and consumable AI-credit fulfilment | App user ID, product/transaction events, storefront price and currency | No | USA — DPA + SCCs |
| Resend | Transactional email (waitlist confirmation, support email) | Email address, name, email content (may include health details you volunteer) | Possibly | USA — DPA + SCCs |
| Vercel | Hosting and CDN for app and website | IP addresses, request logs | No | USA/global edge — DPA + SCCs |
| Bunny.net | CDN for exercise media (media.havyt.app) | Requester IP only; no user content | No | EU |
| Google Analytics 4 (Google Ireland Ltd) | Website audience measurement, website only, loaded only after you consent | Page views, signup events, approximate location from IP, device and browser. Never any health data. | No | EU (Ireland), with onward transfer to the US under the EU–US Data Privacy Framework and/or SCCs |
| Google Ads (Google Ireland Ltd) | Advertising conversion measurement, website only, loaded only after Marketing consent and only if an Ads account is configured | Whether an advertising interaction led to a signup. Never any health data. | No | EU (Ireland), with onward transfer to the US under the EU–US Data Privacy Framework and/or SCCs |
| Apple (APNs) | Push notification delivery | Push tokens, notification payloads (payloads contain no health data) | No | Apple platform terms |
| Provider | Role | Data they receive |
|---|---|---|
| Apple (App Store / in-app purchase, HealthKit) | Independent controller | Payment and billing data stay with Apple; we never see card data. HealthKit data is read on-device with your permission. |
| Open-Meteo | Weather API (EU non-profit) | Approximate (city-level) location and IP; no account identifier |
| Open Food Facts | Barcode/product lookup (EU non-profit) | Scanned barcode and IP; no account identifier |
| OpenFreeMap | Map tiles for GPS routes | IP + tile coordinates (approximate area) |
| Apple Health | Data source you authorize (independent controller) | Your authorization; they send data to us at your instruction |
We may also disclose data where a law we are subject to requires it (e.g. to tax authorities or on a binding order), and to professional advisers under confidentiality where strictly necessary.
Not used anywhere: Meta Pixel, TikTok pixel, Microsoft/Bing tags, Google Tag Manager, Firebase, Sentry, PostHog, Stripe and PayPal. None is present in the HAVYT app or website.
Not used in the HAVYT app: Google Analytics and Google Ads. They can operate only on the marketing website after the relevant consent, and they never receive HAVYT health data. Analytics inside the app remain first-party only.
Where a provider processes data outside the EU/EEA (for example OpenAI, RevenueCat, Resend, Vercel), transfers rely on GDPR safeguards: an adequacy decision — including the EU–US Data Privacy Framework where the provider is certified — and/or the EU Standard Contractual Clauses (SCCs) incorporated in the provider's data processing agreement, with supplementary measures where required. You can request a copy of the relevant safeguards via support@havyt.app.
Honest baseline: most of your content exists so you can see your own history, so it is kept until you delete it or delete your account. Specifics:
| Data | Retention |
|---|---|
| Account, profile, all health/symptom/cycle/food/workout logs, photos, GPS routes, Apple Health/wearable imports, patterns and derived scores | Until you delete the individual entry or your account. Account deletion permanently erases all of it, including storage files and OAuth tokens. |
| AI chat history, transcripts, coach notes/memory | Until you delete them (archive/delete controls) or delete your account |
| Stories (social) | Expire after 24 hours |
| Consent and legal-acceptance records | Kept after withdrawal or account deletion as evidence of compliance (Art. 7(1) GDPR), for as long as legally required |
| Security logs (IP addresses, user agents) | Short-term; we are bringing these under a fixed time limit (target: 90 days) |
| First-party analytics events | Deleted with your account; we are bringing these under a fixed retention window |
| Push tokens | Deleted when notifications are disabled or the account is deleted |
| Support tickets and emails | Approximately 2 years after the ticket is closed |
| Job applications | For the recruitment process and normally no longer than 6 months after it closes, unless you ask us to retain it for future roles or law requires longer |
| Waitlist / newsletter | Until you unsubscribe (then suppressed) |
| Billing/tax records | As required by Spanish tax and commercial law (statutory retention periods) |
Where the table notes a time limit is being implemented, technical logs may currently be retained longer; the schedule above is the committed target and is being enforced technically.
No system is perfectly secure; if a breach is likely to result in a risk to you, we will notify the AEPD and, where required, you, per Arts. 33–34 GDPR.
Under GDPR and the LOPDGDD you have the right to:
How to exercise them: email support@havyt.app from your account email (we may ask you to verify your identity). We respond within one month (extendable by two further months for complex requests, with notice — Art. 12(3)). Exercising your rights is free of charge.
About data export: Settings includes a self-service data export. You may also request access or portability by email; we handle verified requests within the legal deadline.
Complaints: you may lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD) — C/ Jorge Juan 6, 28001 Madrid, www.aepd.es — or with the supervisory authority of your habitual residence. We'd appreciate the chance to resolve any concern first, but you are never required to contact us before the AEPD.
HAVYT computes personalization from your data — readiness scores, a flare outlook (a qualitative "looks similar to your higher-symptom periods" signal, never a percentage or prediction), pattern observations and training-plan adjustments. These are informational and user-controlled: they suggest, you decide; you can dismiss, override or ignore any of them, and safety-relevant adjustments only ever move in the conservative direction (train lighter, rest, see a professional).
We do not make any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. Nothing HAVYT computes is a diagnosis, a medical prediction, or a decision about your access to the service.
HAVYT is not intended for children under 16: you must be at least 16 years old to create an account. We use the date of birth entered during onboarding to enforce this limit. If you are 16 or 17 and the law where you live requires permission from a parent or legal guardian for the relevant processing, you may use HAVYT only with that permission. We do not knowingly process data of anyone under 16; if you believe a child under 16 has an account, contact support@havyt.app and we will investigate and delete the account where required.
The app does not use advertising or third-party tracking cookies. It stores an authentication token and functional preferences (language, units, theme, active workout session, consent flags) in your browser's local storage, plus offline caches — full inventory in the HAVYT Cookie Policy.
The website (havyt.app) uses HAVYT's own consent manager. Google Analytics 4 is not requested from Google until you grant Analytics consent; Google Ads measurement is requested only if you grant Marketing consent and an Ads account is configured. Both begin denied. No health data from the HAVYT app is sent to Google. You can change or withdraw your choice through the Cookie settings link in the website footer. See the HAVYT Cookie Policy for the complete list and controls.
We may update this policy as HAVYT evolves. For material changes — especially any new processor for health data, new data category, or new purpose — we will notify you in the app and, where the change relies on consent, ask for your renewed acceptance before the change applies to you. Each version is dated and numbered; acceptance is recorded (Section 6.4). Continued use after non-material updates constitutes acknowledgment.
Related documents: Terms of Service · Cookie Policy · Aviso Legal / Legal Notice · Data Processing · Medical Disclaimer · AI Disclaimer · Data Deletion
18. Social features and what your friends can see
If you use friends, challenges, shared goals/streaks or stories, the people you connect with can see what you choose to share. Be aware that shared streaks and goals can indirectly reveal health-related information (e.g. a recovery streak). Sharing is off by default, controlled by visibility settings, and stories expire after 24 hours. You can block users at any time.