Privacy Policy
Please read our terms, policies, and legal information carefully
Last Updated: July 17, 2026 | Effective Date: July 17, 2026
Operated by: HealNova Corporation
Table of Contents21 Clauses
Privacy at a Glance
- •What we collect: Account details, health content you submit, purchase/subscription status, and basic technical data.
- •AI processing: Sent to third-party AI service with limited context (like age) for accuracy. We ask permission first.
- •Never sent to AI: Name, email, and phone number are NEVER shared with AI services.
- •No selling/ads: We don't sell data or use health data for advertising.
- •Your control: Access, correct, download, or delete data anytime. Account deletion purges personal data within 30 days.
Introduction
HealNova (“the Platform”) is operated by HealNova Corporation (“HealNova,” “we,” “us,” or “our”). This Privacy Policy explains how we collect, use, store, disclose, and protect your information when you use the HealNova mobile application and associated services (“Services”).
HealNova is an AI-powered wellness platform that offers wellness screening tools, health education, lifestyle insights, pregnancy and mental wellness support, diet planning, and holistic health management. It is not a medical device and does not provide medical advice, diagnosis, or treatment.
By using the Services, you agree to this Privacy Policy. If you do not agree, please discontinue use immediately.
Scope and Applicable Laws
- United States: Health Insurance Portability and Accountability Act (HIPAA) — Note: HealNova is a general wellness application and does not function as a HIPAA Covered Entity or Business Associate. However, we adopt HIPAA-aligned best practices for health data protection. California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) for California residents.
- European Union / EEA: General Data Protection Regulation (EU) 2016/679 (GDPR) for EU/EEA users.
- United Kingdom: UK GDPR and the Data Protection Act 2018.
- India: Digital Personal Data Protection Act, 2023 (DPDPA) and Information Technology (Reasonable Security Practices) Rules, 2011.
- Canada & Australia: PIPEDA (Canada) and Privacy Act 1988 / APPs (Australia).
- United Arab Emirates: UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection.
About HealNova
HealNova is an AI-powered wellness platform designed to help users monitor and manage their overall wellness through educational information, wellness screening tools, health tracking, and AI-generated informational insights. Depending on the features you choose to use, HealNova may process photos, videos, voice recordings, documents, and other information you provide to generate wellness-related insights and personalized experiences.
HealNova is intended to support general wellness and health awareness. The Services, including any AI-generated content, are provided for informational and educational purposes only and should not be relied upon as a substitute for professional medical advice, diagnosis, treatment, or clinical judgment. Users should always seek the advice of a qualified healthcare professional regarding any medical condition or health concern.
HealNova is not intended for use in medical emergencies or urgent health situations. If you believe you are experiencing a medical emergency, immediately contact your local emergency services or seek assistance from the nearest qualified healthcare provider.
Medical Emergency Notice
If you believe you are experiencing a medical emergency, do not rely on HealNova or its AI-generated outputs. Immediately contact your local emergency services or seek assistance from the nearest qualified healthcare provider.
- • USA & Canada: 911
- • India: 112
- • United Kingdom: 999
- • European Union: 112
- • Australia: 000
- • United Arab Emirates: 999
Data Controller Information
For the purposes of the GDPR and equivalent laws, the data controller is:
Information We Collect
5.1 Account and Profile Information
When you create and manage an account, we collect:
- Name, email address, and phone number (for verification only; never displayed publicly or shared with third parties for marketing)
- Age, date of birth, and gender
- Encrypted password (never stored in plain text)
- Firebase-linked user identifiers, authentication tokens, login session data, and account recovery information
- Email verification and one-time password (OTP) flow data
- Personal profile details, including health essentials and emergency contact information
- Contact and security settings
5.2 Health and Wellness Content You Submit
You choose what to submit. Depending on the features you use, this may include:
- Photos and videos of body parts (e.g., tongue, nails, skin, scalp, teeth, posture), food, prescriptions, or lab reports for AI screening
- Voice recordings you make when using voice input
- Chat messages and symptom descriptions you type in AI chat, AI doctor, mental wellness, and symptom analysis features
- Feature inputs (pregnancy stage, child details, dietary inputs, lifestyle factors, mood entries, heart rate measurements, etc.)
- AI-generated outputs, including wellness scores, indicators, suggestions, diet plans, and analysis results
5.3 Health Vault and Document Storage Data
If you use the Health Vault, we collect and store: your Vault name and PIN (encrypted), PIN reset email, uploaded PDFs/documents, and metadata. Vault documents are stored persistently until you delete them or close your account.
5.4 Doctor Directory and Appointment Booking Data
If you book an appointment, we collect: patient's full name, email, phone, DOB, age, height, weight, gender, relationship to patient, selected doctor/time, and booking history. You confirm you have consent to submit data for others.
5.5 Purchases and Subscriptions
Payments are processed by app store providers (Apple/Google). We receive limited transaction info (history, identifiers, status) to activate subscriptions and comply with legal obligations. We do not store your full payment info.
5.6 Technical and Usage Data
- Device type, operating system, app version, and device identifiers
- IP address (used for security and fraud prevention only)
- Usage analytics (anonymized and aggregated)
- Crash reports and error logs
5.7 Third-Party Integrations
If you connect wearable devices or third-party apps, data is governed by their policies. We only receive data you explicitly authorize.
Third-Party AI Services
Some HealNova features are powered by third-party artificial intelligence services. This section explains exactly what is shared, who it is shared with, and how we obtain your permission.
We ask for your permission first. Before any of your data is sent to a third-party AI service, the app shows you a permission prompt. Nothing is transmitted until you tap Allow. You can withdraw permission anytime in Settings → Privacy → AI Data Sharing.
| Feature | Provider & Storage | Data Sent | Never Sent |
|---|---|---|---|
| Photo/Image Screening | OpenAI. Stored securely on AWS. | Submitted image/video + required info (e.g., age, gender). | Name, email, phone, contact details. |
| AI Chat, Doctor, Voice | BytePlus. Stored securely on AWS. | Text/voice input, context, and limited profile info. | Name, email, phone, contact details. |
| Pregnancy, Diet, Reports | OpenAI. Stored securely on AWS. | Only information provided for that specific feature. | Name, email, phone, contact details. |
Additional Safeguards:
- Requests are identified by random IDs, not your name.
- Providers may process data ONLY to deliver the requested feature and CANNOT use it for advertising or training their own public AI models.
- Please do not include personal info about others without consent.
- Raw uploaded files (images/videos) and temporary processing data are deleted within 15 days.
Your Permission and Choices
- Withdraw anytime: Go to Settings → Privacy → AI Data Sharing to review or withdraw permission. It takes effect immediately for future processing.
- Device permissions: Camera, microphone, photo library permissions are managed through OS settings (iOS Settings or Android Settings → Apps → HealNova). Revoking these may disable related features.
- Notifications: Service reminders/notifications can be turned off in Settings.
How We Use Your Information
- To provide AI-powered wellness screening, insights, and recommendations.
- To maintain your wellness history and track progress.
- To enable and improve AI-powered features.
- To send service-related reminders and updates.
- To process purchases, manage subscriptions, and provide support.
- To maintain platform security, detect fraud, and troubleshoot.
- To improve Services using anonymized or aggregated data.
- To comply with legal obligations and enforce Terms.
We do not sell your personal data or use your personal health information for advertising, commercial profiling, or to train publicly available AI models.
Legal Basis for Processing
For users in the EU, EEA, and UK, we process personal data under:
- •Consent (Art. 6(1)(a)): For health images, voice recordings, sensitive health info, AI sharing, and optional analytics.
- •Contract (Art. 6(1)(b)): To provide the requested Services.
- •Legitimate Interests (Art. 6(1)(f)): For security, fraud prevention, and service improvement using anonymized data.
- •Legal Obligation (Art. 6(1)(c)): To comply with applicable law.
For special category health data (Article 9 GDPR), we rely on your explicit consent (Article 9(2)(a)).
AI Processing Disclosure
HealNova uses AI to generate wellness insights. You should be aware that:
- AI analysis is based on pattern recognition; it is not an individualized clinical assessment.
- AI-generated scores and suggestions are informational only and not diagnoses.
- Results may be inaccurate, incomplete, or inapplicable to your circumstances.
- You should never make health or medical decisions based solely on AI-generated insights.
Under GDPR Article 22, you have the right not to be subject to solely automated decision-making that produces legal or similarly significant effects. HealNova's insights are informational and do not produce such effects.
Data Sharing and Disclosure
We do not sell, rent, or trade your personal data. We share data only:
- With your consent: When you explicitly authorize us.
- AI service providers: OpenAI and BytePlus process data strictly on our behalf to provide requested features. (We do not send contact details).
- Cloud infrastructure: AWS is used for secure storage and management.
- Legal requirements: Where required by law, court order, or regulatory authority.
- Business transfers: In case of merger, sale, or acquisition (with advance notice).
- Safety/protection: To protect rights, investigate fraud, or prevent harm.
Data Security
We implement technical and organizational measures to protect your data. Our security program aligns with ISO/IEC 27001:2022, ISO/IEC 20000-1:2018, ISO/IEC 42001:2023 (AI), SOC 2 Type II, CMMI Maturity Level 3, and HIPAA-aligned security practices where applicable.
Data Retention
| Data Type | Retention Period |
|---|---|
| Account and Profile | Until account closure. |
| Raw Photos, Videos, Voice | Deleted within 15 days. |
| Results, Vault, History | Retained until deleted by you or account closure. |
| Technical Logs | Maximum 12 months for security and troubleshooting. |
Upon account deletion, all personal data is permanently purged within 30 days, except where legal retention obligations require otherwise.
International Data Transfers
We implement appropriate technical, organizational, and contractual safeguards (like SCCs) when transferring personal data across borders to ensure protection in accordance with applicable laws.
Your Privacy Rights
Depending on jurisdiction, you have rights to:
- Access your data
- Rectify inaccuracies
- Erasure (Right to be forgotten)
- Restrict processing
- Data portability
- Object to processing
- Withdraw consent
Email [email protected] to exercise rights.
Children's Privacy
Accounts are strictly for users 18+. We do not knowingly collect minors' data directly. If an adult enters info about a child for features (like baby health), they confirm they are the legal guardian. We delete unauthorized minor data immediately.
Cookies and Tracking
We use strictly necessary, functional, and anonymized analytics cookies. We do not use cookies or identifiers to track you across other companies' apps or websites for advertising.
Data Breach Notification
If we become aware of a personal data breach, we will investigate and take remediation steps. Where required by applicable laws, we may notify relevant authorities and affected individuals.
Privacy and Data Protection Contact
Medical Disclaimer
HealNova provides general wellness information and AI-generated suggestions only.
It DOES NOT diagnose, treat, cure, or prevent any medical condition. Always consult a qualified healthcare professional for medical concerns.
Contact Us
For all privacy-related requests, questions, or concerns:
HealNova Corporation Privacy Team
Email: [email protected]
Subject: "Privacy Request – HealNova"
Website: https://healnova.ai
We aim to acknowledge all requests within 5 business days and respond fully within the legally required timeframe.