Avylo Privacy Policy

Effective Date: [Insert Date]

1. Introduction

Welcome to Avylo (“we,” “our,” or “us”).

This Privacy Policy explains how we collect, use, store, disclose, and protect personal information when you use the Avylo mobile application, website, and related services (collectively, the “Services”).

Avylo is designed to support users with health, wellness, nutrition, and lifestyle tracking, including individuals using GLP-1 medications. The Services are intended to provide informational and organizational support and are not a substitute for professional medical advice, diagnosis, or treatment.

By using our Services, you acknowledge the practices described in this Privacy Policy.

2. Information We Collect

Depending on how you use our Services, we may collect the following categories of information.

2.1. Account and Identification Information

We may collect information such as:

• Name or display name;
• Email address;
• Account credentials or authentication identifiers;
• Profile information you choose to provide.

2.2. Health and Wellness Information

Because Avylo provides health and wellness features, you may choose to provide information such as:

• Weight, height, and other body measurements;
• Nutrition, meals, food preferences, and dietary habits;
• Physical activity and lifestyle information;
• Medication information, including GLP-1 medications, dosage details, and treatment-related information;
• Symptoms, side effects, goals, and progress;
• Health-related notes, questionnaires, and information you provide to the app;
• Photos, documents, or other materials you voluntarily upload, which may contain health information.

Please avoid submitting information that is not necessary to use the Services.

2.3. Communications and AI Interactions

If Avylo includes chat, coaching, or AI-powered features, we may collect the messages, questions, and other content you submit, along with relevant information needed to generate responses.

Depending on the feature, this may include health and wellness information you choose to share.

2.4. Payment and Subscription Information

If you purchase a subscription or other paid feature, payment processing may be handled by Stripe.

We may receive information such as subscription status, transaction identifiers, billing status, and limited payment-related details. Full payment card details are generally handled by Stripe rather than stored directly by us.

2.5. Technical and Usage Information

We may collect technical information necessary to operate, maintain, and secure Avylo, such as:

• Device type and operating system;
• App version;
• IP address and general diagnostic information;
• Log data, crash reports, and performance information;
• Information about how you interact with the Services, where applicable.

The information collected depends on the features enabled and the permissions you grant.

3. How We Use Information

We may use personal information to:

• Create and manage user accounts;
• Provide Avylo’s health, wellness, nutrition, and tracking features;
• Store your entries and display your progress;
• Generate responses through AI-powered features, where available;
• Process payments and manage subscriptions;
• Provide customer support and respond to requests;
• Maintain, troubleshoot, and improve the Services;
• Detect fraud, abuse, security incidents, and unauthorized activity;
• Comply with applicable legal obligations;
• Enforce our terms and protect our rights, users, and Services.

We will not use personal information for purposes materially different from those described in this Policy without providing any notice or obtaining any consent required by applicable law.

4. Third-Party Service Providers

Avylo may use third-party service providers to support the operation and delivery of the Services. These providers may process personal information on our behalf when necessary to perform their services.

4.1. Supabase

We use Supabase for database hosting, authentication, and data storage, as applicable. Information processed through Supabase may include account details, profile information, and information you submit through Avylo.

4.2. Stripe

We use Stripe to process payments and manage subscriptions. Stripe may process payment and billing information, transaction details, and information necessary to complete or manage a transaction.

Payment processing is subject to Stripe’s applicable terms and privacy practices.

4.3. Other Service Providers

If Avylo uses additional service providers, such as AI processing, email delivery, analytics, hosting, or customer support services, those providers may process relevant information as necessary to deliver the applicable features.

We will update this Policy as appropriate when our data practices change.

We do not authorize service providers acting on our behalf to use personal information for purposes unrelated to the services they provide, subject to applicable agreements and law.

5. AI-Powered Features

Certain Avylo features may use artificial intelligence to generate responses, summaries, suggestions, or other informational content.

When you use these features, the information you submit may be processed to generate a response. Depending on the feature, this may include messages or health and wellness information you choose to provide.

AI-generated content may be incomplete, inaccurate, or unsuitable for your individual circumstances. You should not rely on AI-generated content as a substitute for professional medical advice, diagnosis, or treatment.

Do not use Avylo to obtain emergency medical assistance. If you believe you are experiencing a medical emergency, contact emergency services.

If AI features or their underlying providers change, we will update this Policy as necessary to reflect our actual practices.

6. How We Share Information

We may disclose personal information in the following circumstances:

• Service providers: To providers that help us operate, secure, and maintain Avylo, including Supabase and Stripe where applicable.
• At your direction: When you request or authorize a disclosure.
• Legal requirements: When disclosure is required by law, regulation, legal process, or a valid governmental request.
• Safety and protection: When reasonably necessary to detect fraud, address security issues, enforce our terms, or protect the rights, safety, and property of users or others.
• Business transactions: In connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to applicable legal requirements.

We do not sell personal information in exchange for money. We will comply with applicable laws governing the sale or sharing of personal information, including any applicable requirements concerning targeted advertising or consumer health data.

7. Sensitive and Health Information

Some information collected through Avylo may be considered sensitive personal information or consumer health data under applicable laws.

We use this information to provide requested features, maintain your records, support app functionality, and perform other purposes described in this Policy, subject to applicable law.

Where required, we will obtain consent before collecting, processing, or sharing sensitive information.

We do not use health information for purposes that are prohibited by applicable law. Avylo does not make decisions about your medical treatment and is not intended to replace your healthcare provider.

8. Data Retention

We retain personal information for as long as reasonably necessary to provide the Services, maintain your account, fulfill the purposes described in this Policy, resolve disputes, enforce agreements, and comply with legal obligations.

Retention periods may vary depending on the type of information and the purpose for which it was collected.

When personal information is no longer reasonably necessary, we will take appropriate steps to delete it, de-identify it, or securely dispose of it, subject to applicable legal requirements and legitimate retention needs.

9. Data Security

We use reasonable technical, organizational, and administrative safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure.

However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and for notifying us if you suspect unauthorized access to your account.

10. Your Privacy Rights

Depending on where you live and the laws that apply, you may have rights regarding your personal information, including the right to:

• Request access to personal information we hold about you;
• Request correction of inaccurate personal information;
• Request deletion of personal information;
• Obtain a copy of certain information in a portable format;
• Withdraw consent where processing is based on consent;
• Opt out of certain types of data processing, where applicable;
• Appeal a decision we make regarding a privacy request, where required by law.

To exercise applicable rights, contact us using the contact details provided in the “Contact Us” section.

We may need to verify your identity before processing a request. We will respond within the time limits required by applicable law.

We will not unlawfully discriminate against you for exercising your privacy rights.

11. U.S. State Privacy Laws

Certain U.S. states provide residents with specific privacy rights, including rights relating to access, correction, deletion, portability, and opting out of certain processing activities.

Depending on the applicable law and Avylo’s activities, additional rights or disclosures may apply to sensitive personal information, consumer health data, targeted advertising, profiling, or the sale or sharing of personal information.

We will honor applicable rights and provide any notices, consent mechanisms, or appeal procedures required by law.

Not every state privacy law applies to every business or every type of data. The availability of particular rights depends on applicable legal requirements.

12. Children's Privacy

Avylo is not intended for children under 13, and we do not knowingly collect personal information online from children under 13 without the consent required by law.

If we learn that we have collected personal information from a child in circumstances that violate applicable law, we will take appropriate steps to delete the information.

If you believe a child has provided personal information to us, please contact us.

If Avylo is made available to teenagers or other minors, we will apply any additional requirements that may be relevant under applicable law.

13. International Data Transfers

Our service providers may process or store information in the United States or other countries where they or their infrastructure providers operate.

These countries may have data protection laws that differ from those in your jurisdiction. Where required, we will implement appropriate safeguards for international transfers of personal information.

14. Third-Party Websites and Services

Avylo may contain links to third-party websites, products, or services. We do not control the privacy practices of third parties.

If you access a third-party service through Avylo, its own privacy policy and terms may apply. We encourage you to review those documents before providing information.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in Avylo, our data practices, technology, or legal requirements.

When we make changes, we will update the “Effective Date” above. If a change requires additional notice or consent under applicable law, we will take the appropriate steps.

Your continued use of the Services after an updated Policy becomes effective is subject to the updated Policy, to the extent permitted by law.

16. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, you may contact us at:

Company or Legal Entity: [Insert Legal Entity Name]
Privacy Contact Email: [Insert Privacy Contact Email]
Business Address: [Insert Business Address, if applicable]

Please do not include unnecessary sensitive health information in your initial privacy request.

Important Note: This Privacy Policy should be reviewed and customized to reflect Avylo’s actual data practices, technology providers, business structure, and applicable legal requirements before publication.