Privacy Policy for Sovasta Health
Effective date: November 4, 2026
Developer: Primealpha Research
Privacy contact: [email protected]
Sovasta Health ("Sovasta Health," "the app," "we," or "us") is a local-first wellness application. This policy explains what the app accesses, how information is used and stored, when information can leave the device, and the choices available to you. Additional disclosures concerning information that may qualify as consumer health data are in the Consumer Health Data Privacy Policy.
What is stored where
| Information | Where it is kept |
|---|---|
| Health records, daily inputs, scan images and scan results, trends, protocols | Only in this browser on this device (IndexedDB). Sovasta Health has no server copy. |
| Signed receipts for scans, lab imports and meal confirmations (which record, its SHA-256 fingerprint and when), and the signing key that made them | Only in this browser on this device. The key cannot be exported, and the receipts contain no health values. |
| Community posts, comments and votes, with the email address of your Sovasta ID | Sovasta Health's server (Cloudflare D1) |
| Consent records (which consent you accepted and when) | Sovasta Health's server |
| Your Sovasta ID (sign-in account) and your Sovasta plan | Sovasta's identity service and Sovasta Hub, shared by all Sovasta solutions |
| Product-usage events without health values | Sovasta Health's analytics service |
1. Summary
- Sovasta Health does not operate a health-intelligence application server that receives your HealthKit, Health Connect, camera, microphone, or wellness-log data as part of the current health-intelligence runtime.
- It is designed not to receive health measurements, sensor data, wellness logs, or health-platform records.
- Health and wellness records are stored in the app's encrypted or integrity-protected on-device database.
- Selected Apple Health or Health Connect data is read only after permission in the current release.
- Camera and microphone access is user initiated. Raw frames, raw video, and raw microphone audio are not retained by Sovasta Health in the current release.
- Derived features, measurements, quality reports, trends, consent records, and integrity receipts may be stored locally.
- Sovasta Health does not sell health data or use health data for advertising or behavioral profiling.
2. Information accessed or stored on your device
Depending on the features available and the features you choose, Sovasta Health may access, process, derive, or locally store:
- Local profile and age-band information;
- Wellness logs, supplements, activities, sleep-related inputs, nutrition-related inputs, and user-entered notes;
- Camera-derived pulse spot checks, signal-quality information, and other non-diagnostic derived features;
- Voice-session timing and signal-quality features;
- Read-only Apple Health or Health Connect records you authorize, such as heart rate, resting heart rate, sleep, and steps;
- User-selected laboratory documents or information derived from them when a laboratory-document feature is available and you choose to use it;
- Derived wellness measures such as trends, biological-age estimates, recovery-related scores, or similar non-diagnostic estimates when those features are available;
- Permission decisions, consent receipts, audit records, verified-device imports, and integrity evidence.
3. Camera and microphone
Camera and microphone access begins only after you choose a feature and review its disclosure. The current release processes the live signal locally. It may retain derived numeric features, quality indicators, session timestamps, and tamper-evident receipts, but it does not retain raw camera frames, raw video, or raw microphone audio.
4. Apple Health and Health Connect
The current release requests read access only to data types connected to visible app features. Access is optional and controlled through Apple Health or Health Connect. Sovasta Health does not use this information for advertising or marketing and does not sell it.
Records stored by Apple Health or Health Connect are controlled separately by those platforms. Removing Sovasta Health's local copy does not automatically delete platform records.
5. When information can leave the device
Sovasta Health does not automatically upload the current health-intelligence dataset. Information can leave the device through an explicit user action, such as exporting a file, sharing a report through the operating-system share mechanism, or voluntarily including information in a support message. A future feature that transfers health data must be separately disclosed and consented to where required.
Do not send raw health records, raw images, passwords, encryption keys, or other sensitive information to support unless Sovasta Health specifically provides an approved secure process.
6. Sovasta plan and platform services
Sovasta Health is free and has no payment flow of its own. To decide which features you can use, it asks Sovasta for the name of your Sovasta plan (for example “Basic”). Sovasta Hub handles payment for Sovasta plans under its own terms; no health information is sent to Sovasta Hub or to any payment provider.
Your browser, operating system and network providers may process technical information (such as crash or connection data) under their own terms and privacy policies.
On-device image analysis. To find your face, eyes, hair or hand in a scan photo, Sovasta Health downloads Google’s MediaPipe software from cdn.jsdelivr.net and its model files from storage.googleapis.com into your browser. The photo is analyzed on your device and is never sent to these services; they receive only an ordinary download request (such as your IP address and browser type). The model files are kept in this browser’s storage so they are not downloaded again. If the download fails, the scan uses the built-in method instead. The 3D body view and the health graph likewise download the open-source Three.js and D3 libraries from cdn.jsdelivr.net; no health information is sent with those requests.
Inside the Sovasta app. When you open Sovasta Health inside sova.sovasta.com, Sovasta Health tells the Sovasta app which of its parts are ready and when a new record was added (for example “a lab result was added”). It does not send the values, images or contents of your records.
7. Website performance analytics, advertising, and AI
The current health-intelligence runtime does not include third-party behavioral advertising, a third-party health analytics SDK, or an external large-language-model provider for health processing. The public Sovasta Health website may use Cloudflare Web Analytics or similar infrastructure-level performance telemetry. Website performance telemetry is kept separate from Sovasta Health's local health-intelligence dataset and is not used by Sovasta Health for health profiling or behavioral advertising.
8. Security
Sovasta Health uses local storage protections, domain-separated cryptographic controls where supported, transaction-integrity checks, permission boundaries, and tamper-evident evidence. No technical system can guarantee absolute security. Device compromise, operating-system backups, shared devices, user-directed exports, and third-party destinations can affect confidentiality.
9. Retention and deletion
Local health and wellness information remains on your device until you delete records through the app, choose Delete Account & Data, clear application storage. Server-held information (community content and consent records) is deleted by Delete Account & Data or on request; backup copies expire within 30 days. Platform backups may persist according to Apple or Google's settings and policies.
Commerce, support, fraud-prevention, security, tax, accounting, or transaction records that Sovasta Health or its providers actually possess are separate from the local health database and may be retained for legitimate operational, contractual, security, or legal obligations. Where applicable law gives you deletion or cessation rights, Sovasta Health will honor them subject to lawful exceptions and records controlled independently by third parties.
See Data Deletion and Consumer Health Data Privacy.
10. Age policy
The current U.S. web launch is intended for adults age 18 and older and is not directed to children.
11. General wellness boundary
Sovasta Health is intended for general wellness and educational use. It is not intended to diagnose, cure, mitigate, treat, or prevent disease, determine emergency status, or replace professional medical care. Metrics, estimates, and summaries may be incomplete or inaccurate. Consult a qualified healthcare professional before making health, medication, supplement, diet, exercise, or treatment decisions.
12. Your choices and requests
You may decline or revoke camera, microphone, Apple Health, or Health Connect access; delete local records; or choose not to export information. See Privacy Choices. For consumer-health-data rights that may apply where you live, see the Consumer Health Data Privacy Policy.
13. Changes
We may update this policy when the app, law, SDK inventory, or data practices change. The effective date will be updated, and material changes will be presented or consented to where required by applicable law.
14. Contact
Primealpha Research
Email: [email protected]
15. Community consent
Before your first post or comment on the in-app Community wall, we ask for explicit, versioned consent, which is recorded on our servers against your Sovasta ID along with the time it was given. Community posts, comments, and votes are stored with your account identifier and are visible to other signed-in members. You can request removal of your Community content by contacting us. Reddit and Quora links on the Community page take you to those independent services, which have their own privacy policies.