Venoa — Consumer Health Data Privacy Notice

Status: Draft V01 — for legal review Effective date: [CONFIRM on publication] Last updated: 10 October 2026

Plain-English summary. This notice is for people in US states with consumer‑health‑data laws, such as Washington (My Health My Data Act), Nevada and Connecticut. It explains what health information Venoa collects, why, where it comes from, who it is shared with, and how to use your rights. It adds to our Privacy Policy, which still applies.

1. Who this notice covers

This notice applies if you live in Washington, Nevada, Connecticut or another US state with a law that protects consumer health data — personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health. Because Venoa is a companion app for people using GLP‑1 medicines, the fact that you use Venoa may itself be consumer health data.

2. Consumer health data we collect

• Medication and treatment: GLP‑1 medication, dose and schedule, injection sites and missed‑dose events.
• Symptoms and mood: side effects, symptoms and mood you log.
• Body measurements: weight, height and other body measurements, and your goal weight.
• Food, nutrition and hydration: food, calorie, protein, fibre and hydration logs, and meal photos you submit for analysis.
• Activity: strength-training logs and goals.
• Progress check-ins: weekly check-ins and optional progress selfies.
• Onboarding answers: the health‑related answers you give when you set up Venoa, such as your goals, age range and sex at birth.
• Use of a health app: the fact that you have installed and use Venoa, and, only if you opt in to advertising measurement, app‑install, app‑activity and purchase events linked to device or browser attribution identifiers and an opaque account identifier.

3. Why we collect it

• To provide the Services you ask for: tracking, reminders, insights, progress charts and educational content.
• To keep the Services secure and working, and to provide support.
• Only with your separate opt‑in consent: to measure and improve our advertising.

4. Where it comes from

• From you, when you enter it in the app or website.
• From your device, when you use the app (for example, the app version and the events described above).

We do not buy consumer health data from other companies.

5. Who we share it with

• Service providers that host, store and secure our data and deliver our communications, acting only on our instructions.
• Billing providers (RevenueCat and Stripe) receive what they need to manage your subscription, such as your account identifier and email address. They never receive the health entries you record in Venoa.
• Advertising measurement partners — only with your separate opt‑in consent: AppsFlyer (acting on our instructions) and Meta Platforms (for its own advertising services, under Meta's Privacy Policy). They receive app‑install, app‑activity and purchase events, device or browser attribution identifiers, and an opaque account identifier. An advertising identifier is used only when the device permits it. They never receive the content of your health entries or your answers to health questions.
• Legal reasons: where the law requires it.

Venoa has no affiliates that receive consumer health data.

6. Your rights and choices

You can:

• confirm whether we collect, share or sell your consumer health data, and access it, including a list of the third parties and affiliates we have shared it with;
• delete your consumer health data — directly in the app, or by asking us;
• withdraw your consent at any time. You can withdraw advertising‑measurement consent under Marketing analytics in mobile Preferences or Privacy settings on the website. Changes apply when you leave or close that screen;
• appeal if we decline your request, by replying to our response. If your appeal is denied, you may contact your state Attorney General.

To use these rights, email hello@venoa.health. We may need to verify your identity. We respond within the time limits set by law (generally 45 days).

7. We do not sell consumer health data

We do not sell your consumer health data without a valid authorisation signed by you, as the law requires.

8. Contact us

• Privacy / data protection: hello@venoa.health