Privacy
Your data is stored in the European Union, in the Netherlands.
It is handled under the EU General Data Protection Regulation and Dutch law.
You can export all of it in a machine-readable form, and delete all of it, at any time.
If Hevolut is ever acquired, your data stays under this policy. You are told before any transfer, and you can export and delete it first.
1. Who we are
Hevolut is the data controller for the personal data described here.
Questions about this policy, or about your data, go to privacy@hevolut.ai.
2. What we collect
- Account data, through Clerk, our identity provider: your email address, your name if you give one, and how you sign in.
- The waitlist: the email address you leave on hevolut.ai.
- Health and fitness data from sources you connect yourself, and only the data types you authorise: today Garmin, Oura, Whoop, Polar, Intervals.icu, Withings, Apple Health and Health Connect, with more to follow. That can include activities, heart rate and heart rate variability, sleep, body measurements, nutrition totals, and lab results you upload.
- What you type: questions to Hev, notes, symptoms, and documents you add.
- Technical data: page views on the website through Vercel Web Analytics, which sets no cookies and stores no identifiers, and server logs that hold your IP address briefly for security.
3. Why, and on what legal basis
- To provide the service you asked for: holding your record, reasoning over it, and acting on it. Legal basis: the contract between you and us (GDPR article 6(1)(b)).
- Health data is special-category data. We process it only with your explicit consent (GDPR article 9(2)(a)), given separately for each connected source and for each domain of your record. You can withdraw that consent at any time in the app, and the source stops feeding your record at once.
- Security and abuse prevention: keeping accounts and the service safe. Legal basis: our legitimate interest (GDPR article 6(1)(f)).
- Legal obligations, where a law requires us to keep or disclose something.
We do not use your data for advertising. We do not sell it. We never will.
4. Where it lives
Your record lives in one region of the European Union, in the Netherlands. The application runs on Railway, Amsterdam region, the database is MongoDB Atlas, Amsterdam region, and the original files you upload or that a source sends us are kept in object storage in the same Amsterdam region. The website runs on Vercel, Frankfurt region.
Everything is handled under the EU General Data Protection Regulation and the Dutch law that implements it, the Uitvoeringswet AVG.
5. Who processes it for us
These companies process personal data on our instructions, under written agreements:
- Clerk: Identity, sign-in and transactional email.
- Vercel: The website and its cookie-free analytics. Frankfurt, Germany.
- Railway: Hosting of the application. Amsterdam, the Netherlands.
- MongoDB Atlas: The database. Amsterdam, the Netherlands.
- AI model providers: Reasoning over pseudonymised data only; no personal identifiers are sent.
AI model providers receive pseudonymised data only. Your name, email address and other personal identifiers never go into a call to a third-party model. Where a processor is established outside the European Union, the transfer rests on an adequacy decision or on the EU Standard Contractual Clauses.
We never share your data with insurers, employers or advertisers. Only you send data onward, for example a claim to your insurer or a referral to a clinician, and only when you ask Hev to.
6. How the AI uses your data
Hev reasons over your own record to produce summaries, reminders and suggestions, and to carry out the actions you have authorised. It is not medical advice. It flags anything that needs a professional and routes you to one. Your data is never used to train models, ours or anyone else’s.
7. Apple Health and Health Connect
Data from Apple Health is used only to provide the features you ask for. It is never used for advertising, marketing or data mining, and it is never sold or shared with third parties for those purposes.
The same holds for data from Health Connect on Android: it is used only to provide the features you ask for, never for advertising, marketing or data mining, and never sold or shared for those purposes.
8. How long we keep it
- For as long as your account exists.
- The original files from each source are kept so that your record can be rebuilt. They are yours to export and delete like everything else.
- When you disconnect a source, the data it sent stays in your record, labelled with its source, until you delete it.
- When you ask us to delete your data, deletion is completed within 30 days of your request.
9. Your rights
You can, at any time:
- see what we hold about you;
- export all of it in a machine-readable form, together with your original files;
- correct it;
- delete it;
- withdraw a consent you gave, for any source or domain;
- object to processing based on our legitimate interest, or ask us to restrict it;
- complain to the supervisory authority, the Autoriteit Persoonsgegevens.
Export, deletion and consent live in the app. For anything else, write to privacy@hevolut.ai. We answer within one month.
10. Security
Data is encrypted in transit and at rest. The tokens that connect your sources are encrypted with a key of your own. Every access to your record is logged. If a breach ever puts your data at risk, we tell the supervisory authority within 72 hours and tell you without undue delay.
11. If Hevolut is acquired
Your data stays under this policy. Any successor is bound by it. You are told before any transfer takes place, and you can export and delete your data before it does.
12. Children
Hevolut is not for anyone under 16. We do not knowingly collect data from children, and we delete it if we learn that we have.
13. Changes and contact
When this policy changes, the date at the top changes with it. If a change affects you materially, we tell you by email before it takes effect. The address for everything in this policy is privacy@hevolut.ai.