Privacy policy

Who the controller is

EVA Tecnologia Ltda, Brazilian company registry (CNPJ) 65.228.711/0001-63, registered at Avenida Paulista, 2001, suite 1018 — Bela Vista, São Paulo/SP, 01311-931, Brazil. We are the controller of the data described in this policy and we answer for the decisions about how it is processed.

What we collect on the website

If you join the waitlist or contact us through the site, we collect only:

• Your name and email.
• A health goal, if you choose to state one. The field is optional.
• The page of the site where you signed up.

Nothing else. Browsing the site requires no account and no sign-up.

What the app processes

The EVA One app exists to follow your health over time, so most of what it stores is information you provide:

• Account details: name, email, date of birth, biological sex, height and sign-in credentials (Apple, Google, or email and password). Phone number is optional: it is only used for WhatsApp alerts, if you turn that channel on.
• Health and well-being: lab results and their metrics, weight and measurements, sleep, physical activity, mood, daily check-ins, goals and progress history.
• Medication: medicines, doses, schedules, stock and side effects you report — including therapies such as GLP-1 and your statement that you have a prescription and medical follow-up.
• Photos and files you upload: meals, body, lab reports, prescriptions, labels and medication packaging.
• Wearable data: when you connect Apple Health (iOS) or Health Connect (Android), we read steps, sleep, heart rate and variability, weight, calories, blood pressure, oxygen saturation, temperature, distance and workouts.
• Conversations with EVA, in the app and over WhatsApp, and the analyses generated from them.
• Calendar, appointments, workouts, protocols, achievements and content you publish in the social area.
• Technical data: device model and operating system, notification identifier (push token) and usage logs kept for security.
• Location: only when you allow it, and only for features that depend on it — today, showing the weather for your day.

How artificial intelligence fits in

EVA uses third-party AI models to read, understand and respond to what you record. That processing is what turns a photo of a plate or a lab PDF into useful information. Nothing is sent to these providers before you read and accept, inside the app, a dedicated permission screen, shown right after sign-up and always available under Profile → Privacy → Artificial intelligence, where you can also withdraw it. In practice:

• OpenAI (GPT-6 Luna and Whisper): conversations with EVA, reading lab results and prescriptions, nutrition guidance, check-in questions, summaries and personalized notifications, analysis of meal, label and body photos, and transcription of the voice notes you record (in the app and on WhatsApp).
• Anthropic (Claude): automatic backup for conversations, lab results and texts when the main provider fails or is slow.
• Google (Gemini and Vertex AI): automatic backup for photo analysis when the main provider fails, and drafting reminders.
• ElevenLabs: the voice of your weekly audio summary, generated from the episode script.

What is sent to these providers: your first name, age, sex, height and weight; the health data you record and the Apple Health or Health Connect data you allowed; what you send to EVA (messages, voice notes, photos and lab documents, sent as they are); and the most recent messages of the conversation, for context. What is never sent from your account details: full name, email, phone number, national ID, address or any account identifier. These providers act as processors: they handle the content on EVA's behalf, only to produce the answer you asked for, and do not use your data to train their models. They may keep the content for up to 30 days (OpenAI and Anthropic) or up to 55 days (Google), solely for safety and abuse prevention, and then delete it. We do not keep the text sent to providers in our technical logs; we keep only usage metadata (model, amount of text and cost) for up to 13 months, and your conversation history with EVA, which is deleted with your account. EVA's answers support self-care, show the sources they rely on and do not replace diagnosis, prescription or a consultation with a health professional.

Talking to EVA over WhatsApp

The WhatsApp channel is optional and only works after you link your number inside the app — we do not message anyone who did not ask for it, and numbers without an active link get no reply at all.

• What travels through it: the text you write, the audio you record (transcribed into text) and EVA's replies. That history is the same conversation you see in the app.
• Photos sent over WhatsApp are not analyzed in that channel: EVA replies explaining this and points you to the app to send the image.
• WhatsApp is a Meta service and messages travel through its infrastructure. We also use Twilio as the sending provider for part of the messages.
• To opt out, reply "PARAR" (stop) — or "sair", "cancelar", "descadastrar" — to any of our messages. Sending stops immediately, without affecting your account in the app.

What we use your data for

• Delivering the health follow-up you asked for: recording, organizing and giving your progress back to you as dashboards, summaries and conversations.
• Personalizing EVA's guidance based on your history.
• Allowing follow-up by the professional or organization you authorize.
• Sending the reminders and notifications you set up (check-in, medication, goals) and service announcements.
• Billing and managing subscriptions and purchases.
• Ensuring security, preventing fraud and abuse, and complying with legal obligations.

We do not sell your personal data and we do not use it for third-party advertising.

Legal basis

We process your data under Brazil's data protection law (LGPD, Law 13.709/2018). For health data and photos, the basis is your specific and highlighted consent: for sending data to artificial-intelligence providers, it is requested on a dedicated screen before your first use of EVA, informing you that processing happens outside Brazil (LGPD art. 11, I and art. 33, VIII); for sensitive photos, at the moment the feature is used. You may withdraw it whenever you want, under Profile → Privacy, aware that this turns off the features that depend on it. For running your account, subscription and support, the basis is performance of the contract. For tax and regulatory records, compliance with a legal obligation. For security and fraud prevention, legitimate interest. On the website waitlist, the consent you give when signing up.

Sharing with professionals

Nothing is shared by default. Sharing only exists once you accept a link with a professional or an organization, and it is controlled by eight independent categories: workouts, habits, health metrics, check-ins, lab results, personal events, medication and nutrition.

You can switch off any category or end the whole link at any time, in the app, under Profile → My professionals or in the privacy settings. Once ended, the professional immediately stops seeing your data, including individual items previously shared.

Who else we share with

Beyond the AI providers already named and the professionals you authorize, we rely on processors that keep the service running:

• Google Cloud and Firebase: hosting, database, authentication, file storage, push notifications and app usage measurement.
• Meta (WhatsApp) and Twilio: sending and receiving messages on the WhatsApp channel.
• Resend: sending the service's emails.
• Apple and Google: billing for subscriptions purchased inside the app. EVA never receives your card details. Stripe processes one-off purchases in the protocol marketplace.
• Open-Meteo: receives only the device's approximate coordinates, when you allow location, to return the weather forecast. We send nothing that identifies you along with it.
• Open Food Facts: receives only the barcode you scan, to return the product information.

Reading the barcode with the camera happens on the device itself, without sending the image to anyone.

Where the data lives and how it is protected

The database, the backend and the files are hosted on Google Cloud infrastructure in the São Paulo region, in Brazil. We use encryption in transit and at rest; photos and documents are only reachable through short-lived signed links; sensitive photos and files — body, lab reports, prescriptions and medication packaging — are kept in a separate repository with an encryption key managed by EVA. Every access to those files is logged. Internal access is restricted to what is needed to operate and support the service.

International transfer

Part of the processing happens outside Brazil: the artificial-intelligence providers process content on servers outside the country, mainly in the United States (OpenAI, Anthropic and Google may use other regions); email sending, the messaging channel and one of the backup copies are on servers in the United States. You are informed of the international nature of this processing on the AI permission screen, and we require contractual and technical safeguards from suppliers, compatible with the level of protection required by the LGPD.

How long we keep it

While your account exists, your data stays available to you — that history is what makes the follow-up meaningful. When you delete the account, personal and health data are erased immediately and backup copies are overwritten in the normal cycle, within 90 days. Financial and tax records are anonymized and kept only for the period the law requires. Photos and files you delete go through a short technical retention period before permanent removal.

Cookies and measurement

On the website we use only what is needed to make it work and, subject to your acceptance in the cookie notice, audience measurement to understand which pages help. In the apps, we measure screens visited and usage events through Firebase Analytics, to know what needs improving, and we record technical failures (errors and crashes, without the content of your conversations or health data) through Sentry, to fix them. We do not use this data for advertising and we do not sell it.

Children and teenagers

EVA is intended for people aged 18 and over. We do not knowingly collect data from children or teenagers. If we identify such an account, it is closed and the data erased.

Changes to this policy

If this policy changes, we publish the new version on this page with the effective date updated. Relevant changes are also announced inside the app.