Venoa — Privacy Policy

Status: Draft V02 — supersedes V01 (9 August 2026) Effective date: [CONFIRM on publication] Last updated: 10 October 2026

Plain-English summary. Venoa is a companion app for people using GLP‑1 medicines. You tell us about your doses, symptoms, weight, food and progress so the app can help you stay on track and learn about your treatment. Your health information is sensitive, and we treat it that way. We never share the content of your health entries with advertisers. If you opt in, we share app-install, app-activity and purchase events with our advertising partners (AppsFlyer and Meta) to measure our ads. You can opt out at any time in Settings. You can export or delete your data at any time. This summary is for orientation only — the full policy below governs.

1. Who we are

If you have any questions, contact us at hello@venoa.health.

2. Where this policy applies

This policy applies wherever you use Venoa. Venoa is available globally, so depending on where you live, additional rights may apply to you:

• If you are in the UK, the UK GDPR and the Data Protection Act 2018 apply (see Sections 9–10).
• If you are in the EU/EEA, the EU GDPR applies (see Sections 9–10).
• If you are in the United States, US state privacy laws and consumer‑health‑data laws may apply (see Sections 11–12).

Where local law gives you stronger protection than this policy, that local law applies.

3. Key terms (in plain English)

• Personal data — any information that identifies you or relates to you, such as your email address, or a weight entry linked to your account.
• Health data — the health‑related information you enter into Venoa: for example your medication and doses, injection sites, side effects and symptoms, weight and body measurements, and food and hydration logs. Health data is a special category of personal data and receives extra protection.
• Sub-processor / service provider — a trusted third party that processes data on our behalf and under our instructions (for example, our cloud hosting provider), and only for the purposes we set.
• De‑identified / aggregated data — data that has been stripped of identifiers and combined so that it can no longer reasonably be linked back to you (for example, "average weekly weight change across all users").

4. A special note about your health data

Venoa is designed around sensitive health information, so we want to be clear up front:

• We collect your health data only to provide the Services to you — for example, to show your dose schedule, remind you about an injection, chart your progress, and surface relevant educational content.
• We process your health data on the basis of your explicit consent (in the UK/EU) and, where required, your opt‑in (in the US). You can withdraw consent at any time (see Section 10).
• We take deliberate steps to keep the content of your health entries out of our analytics and advertising tooling. Our analytics record how features are used, not the content of your health entries.
• Venoa is not a healthcare provider and does not provide medical advice. Because of this, the information you provide through the Services is generally not "protected health information" under the US Health Insurance Portability and Accountability Act ("HIPAA"), and we are not a "covered entity" or "business associate" under HIPAA. This does not lessen our commitment to protecting your data — it simply describes the legal framework that applies.

5. What we collect, and why

We collect the following categories of data. Some are required to run the Services; most health entries are optional and entirely under your control.

We do not collect more than we need, and we do not ask for health data we do not use.

6. How we use your data

We use personal data to:

• provide, maintain and secure the Services and your account;
• deliver core features: dose tracking, reminders and missed‑dose guidance, symptom, weight, food and hydration logging, progress charts and insights;
• surface relevant educational content (our "stories" library);
• provide customer support and respond to your requests;
• keep the Services safe — prevent, detect and investigate fraud, abuse and security incidents;
• understand and improve the Services, including testing, research and product development, using de‑identified or aggregated data wherever practical;
• send you service communications (for example, security or billing notices), and — only with your consent where required — optional product updates you can opt out of at any time;
• process web subscription purchases and provide subscription support;
• comply with our legal obligations and enforce our Terms.

Advertising measurement (only if you opt in). If you agree to it, we share app-install, app-activity and purchase events, together with your device's advertising identifier where your device settings permit, with our advertising partners AppsFlyer and Meta, so we can measure which of our ads bring people to Venoa and improve them. The content of your health entries is never shared for this purpose. You can withdraw this consent at any time in Settings or by contacting hello@venoa.health.

We do not sell your personal data. We do not use your health data to train advertising or third‑party AI models.

7. Legal bases for processing (UK/EU)

Where the UK or EU GDPR applies, we rely on the following legal bases:

For advertising measurement, the UK's Privacy and Electronic Communications Regulations (PECR) and equivalent EU rules also require your consent before the AppsFlyer software in our app stores or accesses information on your device.

You can withdraw consent at any time; doing so does not affect processing carried out before withdrawal, but some features may stop working without the underlying health data.

8. Who we share data with

We share personal data only in these limited circumstances, and never in exchange for money:

• Service providers (sub‑processors) who process data on our behalf under contract and only on our instructions, including:
  • cloud hosting and database providers who store the app's data securely;
  • crash‑reporting and analytics providers (configured so the content of your health entries is not sent to them);
  • communications providers who deliver our emails and push notifications;
  • customer‑support tools. We keep an up‑to‑date list of sub‑processors available on request at hello@venoa.health.
• Billing providers. We share the stable account identifier and email address needed for a web subscription with RevenueCat to manage plans and subscription access. Stripe processes web checkout and receives the payment and transaction information needed to do so. Neither RevenueCat nor Stripe receives the health entries you record in Venoa. Apple and Google process App Store and Google Play subscriptions under their own policies.
• Advertising measurement partners (only with your opt-in). If you opt in to advertising measurement:
  • AppsFlyer processes the data as our processor, acting on our instructions, to measure which ads lead to installs and purchases;
  • Meta Platforms receives it as an independent controller for its own advertising services, under Meta's Privacy Policy. They receive app-install, app-open, onboarding and billing-screen view and purchase events, your device advertising identifier where permitted, your IP address, your device model and operating system, and your account's opaque customer identifier used to connect advertising attribution with subscription purchases. They never receive the content of your health entries, your answers to health questions, your name or your email address.
• Legal, safety and corporate reasons — where we are required by law, valid legal process, or to protect the rights, safety and property of Venoa, our users or the public; and, if Venoa is involved in a merger, acquisition or asset sale, as part of that transaction (we will notify you and this policy will continue to protect your data).

We may create and use de‑identified and aggregated data (which cannot reasonably identify you) to understand trends, improve the Services and for research.

9. Where your data is stored and how we protect it

Your account and health data are stored on secure cloud infrastructure operated by our hosting sub‑processors. We protect it using appropriate technical and organisational measures, including:

• encryption in transit (TLS) and encryption at rest;
• strict access controls and the principle of least privilege for our staff and processors;
• hashed password storage;
• logging, monitoring and regular review of our security practices.

No method of transmitting or storing data is completely secure, so we cannot guarantee absolute security — but we work hard to protect your data and to improve our safeguards over time. You also play a part: choose a strong password and keep your device and credentials secure.

10. International data transfers

Because Venoa operates globally, your data may be processed in countries other than your own, including outside the UK and EEA. Where we transfer personal data internationally, we use appropriate safeguards, such as:

• transfers to countries covered by a UK or EU adequacy decision; or
• Standard Contractual Clauses (EU) and the UK International Data Transfer Addendum, together with additional measures where needed.

You can request a copy of the relevant safeguards at hello@venoa.health.

11. How long we keep your data

We keep personal data only for as long as we need it:

You can export or delete your data at any time from within the app, or by contacting us (see Sections 14–16).

12. Your rights (UK/EU)

If the UK or EU GDPR applies to you, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten");
• restrict or object to certain processing;
• data portability — receive your data in a structured, machine‑readable format;
• withdraw consent at any time; and
• lodge a complaint with a supervisory authority.

Many of these you can exercise directly in the app (export and delete). For anything else, email hello@venoa.health; we will respond within the time limits set by law (generally one month). If we decline a request, we will explain why, and you can appeal by replying to our response.

You may complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or to your local EU/EEA data protection authority.

13. Your rights (United States)

Depending on your state, you may have rights to access, delete, correct and obtain a portable copy of your personal data, to opt out of any "sale" or "sharing" of personal data or targeted advertising, and to limit the use of sensitive personal data.

We do not sell your personal data for money. [COUNSEL: confirm whether Meta ads optimisation is a 'sale' under WA/CA definitions] If you opt in to advertising measurement, sending app events to Meta may be treated as "sharing" for cross‑context behavioural advertising under California law, and as sharing of consumer health data under Washington, Nevada and Connecticut law. You can opt out at any time in Settings, through the "Do Not Sell or Share My Personal Information" link in the app and on our website, or by emailing hello@venoa.health. We honour Global Privacy Control signals on our website. We do not use your sensitive data beyond the purposes described in this policy.

We will not discriminate against you for exercising these rights. To make a request, email hello@venoa.health; we may need to verify your identity. If we deny your request, residents of certain states may appeal by replying to our response, and may contact their state Attorney General.

Consumer health data (Washington, Nevada, Connecticut and similar)

If you live in a state with a consumer‑health‑data law (such as Washington's My Health My Data Act, Nevada, or Connecticut), the health information you enter into Venoa is consumer health data. We collect it only to provide the Services with your consent, and we do not sell it. We share advertising-measurement events with AppsFlyer and Meta only with your separate opt-in consent, and never the content of your health entries. You may withdraw consent and request deletion at hello@venoa.health. For details, see our Consumer Health Data Privacy Notice.

14. Cookies and similar technologies

Our app does not use advertising cookies. Only if you opt in to advertising measurement, the app runs the AppsFlyer software development kit (SDK), which stores and reads information on your device, including your device's advertising identifier (IDFA on iOS where you allow tracking, GAID on Android) and an AppsFlyer device identifier, to measure our advertising. Without your opt-in, the SDK does not run. Our website uses a small number of cookies:

• essential cookies needed for the site to work;
• functional cookies that remember your preferences; and
• analytics cookies that help us understand how the site is used.

You can control non‑essential cookies through the cookie banner and your browser settings. Our Services do not currently respond to "Do Not Track" browser signals, but we honour recognised opt‑out preference signals where legally required.

15. Children's privacy

Venoa is intended for adults and is not directed at anyone under 18. We do not knowingly collect personal data from under‑18s. If you believe a child has provided us with personal data, contact hello@venoa.health and we will delete it promptly.

16. Automated decision‑making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

17. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you in the app, by email, or by other appropriate means before the changes take effect, and we will update the "Last updated" date above. Continuing to use the Services after changes take effect means you accept the updated policy.

18. Contact us

• Privacy / data protection: hello@venoa.health
• Data Protection Officer / EU‑UK representative: hello@venoa.health
• General support: hello@venoa.health