Legal document

Privacy Policy – EVVO

Version 3.1
Last updated: 15 October 2026

This Policy explains how personal data is processed in the EVVO app, on this website (evvohealth.app) and in the services connected to them, such as web account deletion at conta.evvohealth.app.

EVVO is operated by:

59.704.010 Pedro Roberto do Carmo Oliveira
CNPJ: 59.704.010/0001-50
Brazil
Privacy email: support@evvohealth.app

For the purposes of Brazilian Law No. 13,709/2018 (General Personal Data Protection Law — LGPD), the person responsible for EVVO acts as the controller of the personal data processed in the app, on this website and on the account deletion page.

App versions. This Policy describes the new version of the EVVO app, which is being prepared and has not been published yet. Google Play still distributes the previous version of the app, whose operation is not described in this Policy. There is no iPhone version yet: references to the App Store and Apple concern a future version. The practices described here apply to the app once the new version is published; for this website and the account deletion page, they apply from the date shown at the top of this document.

1. Who can use EVVO

EVVO is intended exclusively for people aged 18 or over.

In the new version of the app, before use, the person enters their date of birth and declares that it is true. Age is calculated on EVVO’s servers and the confirmation is recorded only once; the confirmed date cannot be changed later in the app itself. If the date was entered by mistake, a correction can be requested through the contact channel (section 15). This confirmation is not yet active in the version currently distributed on Google Play.

If the date entered indicates an age under 18, access to the app is blocked. In that case, EVVO does not keep the date of birth: it only records that the confirmation indicated an age under 18 and when it was recorded. The sign-up data provided before the confirmation (section 2.1) remains in the account until it is deleted, and the person can still sign out and delete the account.

If EVVO finds out by other means that an account belongs to a person under 18, it may restrict access and delete the account, in accordance with applicable law.

2. Data processed

The data processed depends on the features used and on what the person chooses to provide. Some of it stays only on the device, but most is stored in the account, on the servers EVVO uses (section 6), and some is sent to the artificial intelligence service (section 4).

2.1. Sign-up and account

• name, email, mobile number and biological sex, when signing up with email;
• name and email provided by Google, when signing in with a Google account;
• technical account identifiers and authentication information (for example, whether the email was confirmed);
• the confirmed date of birth and the result of the age confirmation (for people under 18, only the result, as described in section 1).

2.2. Profile, body and goals

• goal, current weight, target weight, height, activity level and routine;
• body measurements (weight, waist, hips, thigh and arm) and their history;
• body mass index (BMI) and water goal calculated by the app;
• language, country, time zone and unit system preferences.

2.3. Health information

In the health and safety step of the initial setup and in the Profile, the person may, if they wish, indicate that they have:

• a physical limitation or injury, with a free-text description;
• a health condition, with a description;
• medication in use, with a description;
• professional follow-up, with a description.

It is also possible to answer “prefer not to say”. This information is sensitive personal data concerning health (LGPD, art. 5, II).

In the new version of the app, this information is only stored and used if the person gives a specific authorization for health information (section 5). The authorization is requested at the moment the person is about to provide it, is shown separately from other text and starts unticked. Without it, health information is not stored and the other features remain available; for workouts, the person can choose a generic conservative mode, which makes the workout lighter without consulting or sending health information.

With the authorization, the indication of a physical limitation or health condition is used on the device to make the workout more cautious. Sending it to the artificial intelligence service requires a second authorization, specific to that use (sections 4 and 5). The description of the health condition, medication and professional follow-up is not sent to that service.

Health information stored before the specific authorization existed is not used, neither on the device nor in requests, until the person answers a reconfirmation request (section 5). In the meantime it remains stored in the account, and the person can erase it at any time (section 9).

2.4. Nutrition

• diet goal, preferred and avoided foods, dietary restrictions (vegetarian, vegan, lactose-free, gluten-free), notes and allergy indication, number of meals and times;
• the generated diet and each day’s progress;
• favorite recipes.

Dietary restrictions, allergies and avoided foods may reveal religious or philosophical beliefs or aspects of health. Section 4 explains what is sent to the artificial intelligence service and what can be inferred indirectly. The shopping list is stored only on the device.

2.5. Workouts and physical activity

• training location, equipment, available days, level, goal and preferences;
• body regions the person chooses to spare (for example, knee, lower back, shoulder or wrist) and the choice of conservative mode, made when setting up the workout; the regions are recorded in the saved plan;
• workout plans, completed sessions and logged loads.

2.6. Habits, hydration and emotional logs

• water goal and logs, daily progress and streak;
• emotional trigger logs: emotion, intensity, context and notes. These logs may reveal aspects of health and wellbeing, are handled with the same care as health information and are not used for diagnosis. In the new version of the app, they are only stored with the authorization for health information, requested before the first log. Logs made offline wait in a queue on the device and are only sent to the account while the authorization is active;
• coach choices (character, tone and frequency), replies to the coach’s messages and the generated weekly comments.

2.7. Photos

The app lets you take photos to compare your body’s progress. Photos are shown on screen and are neither sent to EVVO’s servers nor stored by the app. If the person chooses to save a photo to the gallery or share it with another app, that happens on their own initiative, and the recipient’s processing follows its own rules.

2.8. Consents and preferences

For each authorization in section 5, the account records the choice (authorized or not), the version of the text shown, where it was made (initial setup, Profile, trigger log or reconfirmation) and the date. Notification settings are also recorded in the account.

2.9. Purchases and subscriptions

To confirm access to EVVO Premium, EVVO receives purchase information from the store, such as the product, the purchase token, the order number, the status and expiry of the subscription and whether auto-renewal is on. The purchase token provided by the store is kept only as an irreversible cryptographic digest (hash). EVVO does not receive or store card details.

2.10. Technical and usage data

• Firebase Analytics: the app records the name of each screen visited and links it to the person’s EVVO account identifier. The tool also automatically collects usage events (such as first open, session start and app update), device model and operating system, language, app version, an installation identifier and approximate location derived from the IP address. Screen names may show that the person visited health or emotional log screens; the content entered on those screens is not sent to Analytics. The new version of the app does not collect the device’s advertising identifier and keeps Analytics ad personalization signals switched off;
• Firebase Crashlytics: crash reports and information about the device, system and app version;
• Firebase App Check: integrity attestations of the app and device (with Play Integrity on Android);
• Server logs: technical operating and security logs, which contain neither dates of birth nor profile content. The workout generation log shows, among other technical data, whether the request included the generic precautions indication (section 4).

2.11. This website and the account deletion page

This website (evvohealth.app) does not use cookies or analytics or advertising tools and does not load third-party scripts. To deliver the pages and protect the service, the hosting provider (Firebase Hosting, from Google) processes technical data about each visit, such as IP address, date and time, page requested and browser information.

For web account deletion (conta.evvohealth.app/excluir), the email entered is used to send the confirmation link and complete the deletion (section 9).

3. What the data is used for and on what legal basis

Each purpose below is followed by the LGPD legal basis EVVO relies on:

• Creating and maintaining the account, authenticating access and confirming the email; providing the requested features (diet, workouts, hydration, measurements, coach, recipes); generating the diet, workout and weekly comment with artificial intelligence from data that is not sensitive; confirming and maintaining access to EVVO Premium; sending account emails; handling support requests: performance of the contract with the person (art. 7, V).
• Storing and using health information and emotional logs; sending the precautions indication and the description of the physical limitation to the artificial intelligence service based on that information: specific and prominent consent (art. 11, I), which can be withdrawn at any time (section 5).
• Sending coach reminders: consent (art. 7, I), given in the option itself.
• Using dietary restrictions to build the diet: performance of the contract (art. 7, V). If this information is considered sensitive data, the applicable basis will be reviewed (section 4).
• Confirming the minimum age and restricting access by people under 18: legitimate interest (art. 7, IX) in applying the service’s minimum age and protecting children and adolescents.
• Keeping the service secure, preventing fraud and abuse, checking app integrity and diagnosing failures: legitimate interest (art. 7, IX) and, for application access logs, compliance with a legal obligation (art. 7, II, and Law No. 12,965/2014 — Brazilian Internet Civil Framework, art. 15).
• Understanding how the app is used in order to improve it (Analytics): legitimate interest (art. 7, IX).
• Delivering and protecting this website: legitimate interest (art. 7, IX).
• Recording consent choices and keeping them after withdrawal: evidence of consent (art. 8, § 2) and regular exercise of rights (art. 7, VI, and art. 11, II, “d”).
• Complying with legal or regulatory obligations and orders from authorities; exercising rights in proceedings: art. 7, II and VI, and art. 11, II, “a” and “d”.

When processing is based on legitimate interest, the person may object to it through the contact channel (section 15), and the request will be assessed in accordance with the law. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

4. Artificial intelligence

Three features use artificial intelligence. In all of them, the app sends the request to EVVO’s servers (Firebase Cloud Functions), which call OpenAI technology and return the result. The OpenAI access key is kept only on EVVO’s servers. These features do not work only on the device: the data below leaves the device and is sent to OpenAI.

• Diet: goal and diet goal, calorie target, protein target, number of meals, the names of the preferred and avoided foods indicated by the person, the list of allowed foods and language. The calorie target is calculated on the device from weight, height, age, sex and activity level; those data are not sent in this request.
• Workout: goal, level, location, equipment, days per week, duration, number of exercises per day, split, age (in years), sex, language and the list of allowed exercises. The request includes a generic precautions indication, without details, when the person is 60 or over or when they recorded a physical limitation or health condition and gave both authorizations in section 5. Only in that second case is the description of the physical limitation also sent, as written by the person.
• Coach’s weekly comment: first name, the chosen coach and tone, and a numeric summary of the week (workouts done and planned, percentage of meals, active days, weight change and streak).

The requests do not include email, mobile number, account identifiers, date of birth, the description of the health condition, medication and professional follow-up, emotional logs, the names of dietary restrictions, nutrition notes or the allergy indication.

The description of the physical limitation is sent as written. We recommend that it contain only what is needed to adapt the workout, without names, diagnoses or other data that are not useful for that purpose.

What can be inferred indirectly. Even though sensitive data is not sent explicitly, the data sent as a whole may allow inferences about health, habits or beliefs. For example: foods incompatible with the chosen dietary restrictions are removed from the list of allowed foods before sending, and the absence of an entire food group (such as all dairy or all meat) may indicate a restriction; the avoided foods indicated by the person may also suggest restrictions; and when the workout is more cautious (because of age, authorized health information or the conservative mode) or when there are body regions to spare, the list of allowed exercises leaves out the most intense exercises or those that load those regions, which may indicate that there are precautions to consider. EVVO does not use these requests to classify the person or to make decisions about them.

Generated content may contain errors, is for information only and is not a diagnosis or prescription.

5. Optional consents and how to withdraw them

In the new version of the app, the following authorizations are requested, all optional and unticked at the start:

• Health information and emotional logs: allows the information in section 2.3 and emotional trigger logs to be stored and used. It is requested in the health step of the initial setup, in the Profile and before the first trigger log.
• Use of the physical limitation in workouts: allows the generic precautions indication and the description of the physical limitation to be sent to the artificial intelligence service that generates workouts (section 4). It only takes effect together with the previous authorization.
• Coach reminders: notifications on the device with workout, meal, water and coach message reminders.

Refusing an authorization does not prevent the use of the other features; only the feature that depends on it stops taking that information into account.

Reconfirmation. People who have health information or the old workout-use option recorded before these authorizations existed receive a reconfirmation request, with the options “Authorize” and “Do not authorize”. Until they answer, that information is neither used nor sent. Choices made before this request, including the old personalization option, do not count as authorization.

Withdrawal. Authorizations can be withdrawn at any time, free of charge, under Profile › Privacy and data. When withdrawing the authorization for health information, the person chooses between:

• “Only withdraw”: the information is no longer used but remains stored in the account, unused, until the person erases it or deletes the account;
• “Withdraw and erase”: the information is also erased, within the limits described in section 9.1.

In both cases, from that moment EVVO stops sending that information to the artificial intelligence service, stops using it on the device, does not store new logs and does not send to the account the logs waiting in the device queue. Withdrawal does not undo what happened before it: it does not reach requests already sent to OpenAI or change workout plans already generated (section 9).

The app may also ask for system permissions, such as notifications and camera. They can be managed in the device settings.

6. Who the data is shared with

EVVO does not sell personal data. Data is processed by providers only when needed for the service to work:

• Google / Firebase: authentication, database (Cloud Firestore), servers (Cloud Functions), exercise video files (Cloud Storage), hosting of this website and of the account deletion page (Firebase Hosting), App Check, Analytics and Crashlytics;
• Google: sign-in with a Google account;
• OpenAI: artificial intelligence features (section 4);
• Resend: sending account emails;
• Google Play: purchases and subscriptions on Android and app integrity checks;
• Apple: purchases, subscriptions and integrity checks in the iPhone version, once it is published;
• WhatsApp: only when the person opens the help conversation from the app; whatever is written in the conversation is also processed by WhatsApp, under its own rules.

Data may also be shared to comply with a legal obligation or an order from a competent authority, to exercise rights or to protect the security of the service and its users.

7. International transfer

Some of the providers in section 6, such as Google, OpenAI and Resend, may process or store data outside Brazil, including in the United States. This includes the data sent to the artificial intelligence service (section 4), which may involve health information when the person authorizes that sending.

8. How long data is kept

What is already defined in how the service works:

• account data is kept while the account exists;
• health information kept after “Only withdraw” remains stored, unused, until the person erases it or deletes the account;
• when the account is deleted, its data is erased from EVVO’s active systems, within the limits described in section 9;
• the record of consent choices is kept while the account exists, including after withdrawal or erasure of health information, to evidence the choices made;
• the technical record of a subscription purchase is kept without any link to the deleted account;
• the web deletion confirmation link is valid for 1 hour;
• the shopping list and photos are not kept on EVVO’s servers.

EVVO has not yet set specific periods for the other data, such as server and hosting technical logs, Analytics and Crashlytics data and any backups. Those periods will be stated in this Policy once they are established; until then, EVVO does not state periods that are not actually configured. Information about each person’s data can be requested through the contact channel (section 15).

9. Erasing health information and deleting the account

EVVO offers two forms of deletion: erasing only health information or deleting the whole account. Neither reaches everything: some data remains for technical or legal reasons or because it is held by third parties, as explained below.

9.1. Erasing health information

Without deleting the account, the person can erase health information under Profile › Privacy and data, with the “Erase stored health information” option or by withdrawing with “Withdraw and erase”. This erases the account’s health information (section 2.3), all emotional trigger logs, the logs waiting in the device queue and the copies kept on the device.

This option does not erase:

• the record of consent choices (section 8);
• workout plans already generated, which remain in the account and may reflect a more cautious workout and the body regions chosen to spare;
• what has already been sent to OpenAI (section 4);
• server technical logs, such as the workout generation log, and screen events already sent to Analytics;
• any backups, if they exist.

9.2. Deleting the account

The account can be deleted at any time:

• in the app, under Profile › Delete account;
• on the web, at conta.evvohealth.app/excluir, by entering the account’s email and confirming through the link received;
• by email, at support@evvohealth.app, from the registered address.

Deletion erases from EVVO’s active systems the sign-in account, profile, health information, diet, workouts and history, measurements, hydration, emotional logs, favorites, coach data, consent records and the email and age confirmation records.

Account deletion does not reach:

• what has already been sent to OpenAI and what is held by other providers, such as Analytics and Crashlytics data and email delivery records, which follow those services’ periods;
• server technical logs, for the period in section 8;
• the technical record of the subscription purchase, which is kept without any link to the account;
• messages exchanged with support by email or WhatsApp;
• any backups, if they exist, until they are replaced;
• data that the law requires to be kept.

Deletion does not cancel an active subscription on Google Play or the App Store: it must be cancelled in the store.

10. Security

EVVO takes measures to protect data, such as authentication, rules that limit each account to its own data, app integrity checks on calls to the servers, encrypted communication and keeping external service keys on the servers only. No system connected to the internet is completely secure. In the event of a security incident that may cause significant risk or harm, EVVO will notify the ANPD and the people affected, as required by law.

11. Data subject rights

Under the LGPD, the person may request: confirmation that processing takes place; access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data or data processed unlawfully; portability; information about sharing; information about the possibility of not consenting and its consequences; withdrawal of consent; deletion of data processed with consent, except where the law allows it to be kept; objection to processing based on another legal basis, in case of non-compliance with the law; and review of decisions made solely on the basis of automated processing.

Much of the data can be corrected directly in the Profile, and authorizations can be withdrawn under Profile › Privacy and data. Other requests can be made at support@evvohealth.app. We may ask for information to confirm the identity of the requester. The person may also lodge a complaint with Brazil’s National Data Protection Authority (ANPD).

12. Automated decisions

Diets, workouts, calculations and comments are generated automatically to help organize the routine. They have no legal effects, are not used to assess or classify the person before third parties and do not replace a professional assessment. Even so, the person may ask for clarification about the criteria used through the contact channel.

13. Advertising

EVVO does not show third-party ads and does not use health, body, food or emotional data for advertising. The new version of the app does not collect the device’s advertising identifier. If this changes, this Policy will be updated beforehand and the necessary permissions will be requested.

14. Changes to this Policy

This Policy may be updated to reflect changes in the app, providers or legislation. The version and date are at the top of the document. Significant changes will be communicated through the app or other appropriate channels and, when a change affects processing based on consent, authorization will be requested again.

15. Contact

Privacy questions and requests about personal data: support@evvohealth.app.

This Policy should be read together with EVVO’s Terms of Use.

Back to top