Sarv Privacy Policy

1. Key Definitions

To help you understand this policy, here are some key terms:

• "Personal Information" means information that identifies, relates to, or could reasonably be linked with you, such as your name, email address, and health data.
• "Sensitive Personal Information" means health data, account credentials, precise geolocation, racial or ethnic origin, religious beliefs, and similar information requiring special protection.
• "De-Identified Information" means information that has been processed to remove personally identifying characteristics so it cannot reasonably be linked back to you.
• "Cookies" means small data files stored on your device that help us recognize you and improve your experience.

2. Children's Privacy

If you are under 18 years old, please do not use our Services or provide any personal information to us. If we discover that we have collected personal information from a child under 18, we will delete that information as quickly as possible.

If you believe we might have information from a child under 18, please contact us immediately at privacy@joinsarv.com.

3. Information We Collect

We collect information from and about you in the following ways:

3.1 Information You Provide Directly

When you create an account, use our Services, or communicate with us, you may provide:

• Account Information: A preferred name or nickname and your email address. We do not require your legal or full name — you may use a nickname — and we do not collect your date of birth. If you sign in with Apple or Google, we also receive the email address, name, and profile picture associated with that account.
• Health Information: An age range (not your exact age or date of birth), gender, weight category, health goals, medical conditions, allergies, medications, symptoms, pregnancy or menopause status, mental-health and stress indicators, sleep patterns, dietary preferences, substance use (such as caffeine, alcohol, or smoking), exercise habits, and any wellness details you choose to share — including free-text descriptions and voice recordings when you use voice features
• Subscription Information: When you subscribe through the Apple App Store or Google Play, the app store processes your payment and we never receive or store your credit card number, bank details, or billing address. If you subscribe through our website, a third-party payment processor handles your card and billing details on our behalf — we receive confirmation of your subscription and limited billing information, but do not store your full card number ourselves. We use this information only to manage your subscription.
• Communications: Messages you send to us, chat conversations, feedback, and customer support inquiries
• User-Generated Content: Photos, notes, journal entries, and other content you create or upload

3.2 Information Collected Automatically

When you use our Services, we automatically collect:

• Device Information: Device type, operating system, unique device identifiers, mobile network information
• Usage Data: Pages viewed, features used, actions taken, time spent, access times and dates
• Location Data: General location (city, state, country) based on IP address; precise location if you grant permission
• Log Data: IP address, browser type and version, time zone setting, crash reports, performance data

3.3 Information from Third-Party Sources

We may receive information about you from:

• Analytics Providers: Usage patterns and demographic information
• Advertising Partners: Information about ad performance and engagement
• Payment Processors: Transaction confirmation and payment status

3.4 Information We Generate

We create or infer information based on your use of our Services:

• Inferences: Your likely preferences, interests, health characteristics, and behavioral patterns
• Recommendations: Personalized herb and recipe suggestions based on your health profile
• Wellness Scores: Calculated metrics based on your health data and activities

4. How We Use Your Information

We use the information we collect for the following purposes:

5. How We Share Your Information

We do not sell your personal information for money. However, we may share your information in the following circumstances:

5.1 Service Providers

We share information with third-party vendors who perform services on our behalf:

• Cloud hosting, database, and authentication
• Subscription management and payment processing (including the Apple App Store and Google Play, which handle the actual payment)
• Artificial-intelligence processing to generate your personalized recommendations and insights, and to transcribe and read aloud voice interactions. To do this, the relevant parts of your health profile, symptoms, and check-in content — and your audio when you use voice features — are sent to this provider solely to produce your results, under contractual terms that require confidentiality and prohibit using your data to train its models.
• Crash and error diagnostics to keep the app stable
• Marketing attribution and measurement — see Section 5.3
• Customer support, email, and communication services
• Security and fraud prevention

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

5.2 Advertising and Analytics Partners

We work with third-party advertising and analytics companies that collect information through cookies and similar technologies:

• Analytics providers (usage patterns and demographics)
• Social media advertising platforms (advertising and analytics)
• Other advertising networks and measurement partners

These partners may combine information about you across different websites and apps. In some jurisdictions, this may be considered a "sale" or "sharing" of personal information. You can opt-out as described in Section 8.

5.3 Social Media Advertising

We use social media and other advertising platforms to show you relevant ads for Sarv and to measure how well our ads perform. To do this, we may share limited information with these platforms, including:

• Identifiers such as your email address (typically shared in a hashed, non-readable form)
• Device and advertising identifiers
• Information about your activity, such as whether you installed the app, created an account, or made a purchase

These platforms use this information to match you to your existing account with them so we can reach you (and people with similar interests) with ads, and to tell us how our campaigns are doing. We do not share your health data or other sensitive personal information with advertising platforms for this purpose.

5.4 With Your Consent

We share information when you direct us to do so, such as:

• Sharing your achievements on social media
• Participating in joint promotions or surveys

5.5 Business Transfers

If we are involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

5.6 Legal Requirements

We may disclose your information when required by law or when we believe disclosure is necessary to:

• Comply with legal obligations, court orders, or subpoenas
• Respond to law enforcement or government requests
• Protect our rights, property, or safety
• Protect the rights, property, or safety of our users or the public
• Prevent or investigate fraud, security issues, or illegal activity
• Enforce our Terms of Use and other agreements

5.7 Aggregated and De-Identified Data

We may share aggregated, de-identified, or anonymized information that cannot reasonably be used to identify you for research, marketing, analytics, or any other purpose.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

Retention Periods:

• Account Information: Retained while your account is active and for up to 3 years after account deletion (unless required longer for legal reasons)
• Health Data: Retained while your account is active and for up to 5 years after account deletion (to support continuity of care if you return)
• Transaction Records: Retained for 7 years for tax and accounting purposes
• Communications: Retained for 3 years or until you request deletion
• Marketing Data: Retained until you opt-out or request deletion
• De-Identified Data: May be retained indefinitely

When we delete your information, it will be removed from our active databases but may remain in backup systems for up to 90 days. We may retain certain information as required by law or for legitimate business purposes.

7. Data Security

We implement reasonable physical, technical, and administrative security measures to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction. These measures include:

• Encryption: Data is encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: Strict authentication and authorization mechanisms
• Monitoring: Regular security audits and continuous monitoring for threats
• Employee Training: All employees receive privacy and security training
• Data Minimization: We collect only the information necessary for our purposes
• Secure Infrastructure: Our data is hosted on secure, compliant cloud platforms

Your Responsibility: You are responsible for maintaining the confidentiality of your account credentials. Never share your password with anyone, and notify us immediately if you suspect unauthorized access to your account.

8. Your Rights and Choices

Depending on where you live, you may have certain rights regarding your personal information:

8.1 Access and Portability

You have the right to:

• Access the personal information we have about you
• Request a copy of your information in a portable format
• View and download your data through your account settings

8.2 Correction and Update

You can:

• Update your profile information at any time in the app
• Request correction of inaccurate information
• Modify your health profile and preferences

8.3 Deletion

You can request deletion of your account and personal information by:

• Going to Settings → Delete Account in the app
• Contacting us at privacy@joinsarv.com

Note: We may retain certain information as required by law or for legitimate business purposes (e.g., fraud prevention, resolving disputes).

8.4 Opt-Out of Marketing

You can opt-out of marketing communications by:

• Clicking "unsubscribe" in any marketing email
• Adjusting notification settings in the app
• Contacting us at privacy@joinsarv.com

Note: You will still receive transactional emails (e.g., account notifications, receipts).

8.5 Opt-Out of Sale/Sharing and Targeted Advertising

You can opt-out of:

• The "sale" or "sharing" of your personal information (as defined by applicable privacy laws)
• Targeted advertising based on your activity
• Cross-context behavioral advertising

To opt-out, email privacy@joinsarv.com.

8.6 Limit Use of Sensitive Personal Information

In some jurisdictions, you can limit our use of sensitive personal information (such as health data) to only what is necessary to provide our Services. Contact us to exercise this right.

8.7 Object to Processing

You may have the right to object to certain processing of your information, including:

• Processing based on legitimate interests
• Direct marketing
• Automated decision-making

8.8 Non-Discrimination

We will never discriminate against you for exercising any of your privacy rights, including by:

• Denying goods or services
• Charging different prices or rates
• Providing a different level or quality of service

How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@joinsarv.com using the email address associated with your account. We will verify your identity before processing your request and respond within the timeframes required by applicable law (typically 30-45 days).

9. Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar technologies to collect information and improve your experience.

9.1 Types of Cookies We Use

9.2 Managing Cookies

You can control cookies through:

• Browser Settings: Most browsers allow you to refuse or delete cookies
• Opt-Out Tools: Visit aboutads.info/choices or youronlinechoices.eu
• Mobile Settings: Adjust tracking preferences in iOS or Android settings
• Global Privacy Control: We honor GPC signals where required by law

9.3 Do Not Track

Some browsers have "Do Not Track" features. We do not currently respond to DNT signals, but we honor Global Privacy Control (GPC) signals where legally required.

10. International Data Transfers

Sarv is based in the United States, and your information may be processed and stored in the U.S. or other countries where our service providers operate. These countries may have data protection laws different from your country.

When we transfer personal information from the EEA, UK, or Switzerland to other countries, we implement appropriate safeguards, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions by the European Commission
• Your explicit consent

By using our Services, you consent to the transfer of your information to the United States and other countries as described in this policy.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

11.1 Notice at Collection

We collect the following categories of personal information:

• Identifiers (name, email, device IDs)
• Demographic information (age, gender)
• Commercial information (purchase history, preferences)
• Internet activity (browsing history, interactions)
• Geolocation data
• Sensory data (photos, audio if you provide them)
• Inferences (preferences, characteristics, behavior)
• Sensitive personal information (health data, account credentials, precise geolocation)

11.2 Sale and Sharing

11.3 Your California Rights

California residents have the right to:

• Know: What personal information we collect, use, disclose, and sell
• Access: Request a copy of your personal information
• Delete: Request deletion of your personal information
• Correct: Request correction of inaccurate information
• Opt-Out: Opt-out of sale/sharing of your personal information
• Limit: Limit use of your sensitive personal information
• Non-Discrimination: Not be discriminated against for exercising your rights

11.4 Shine the Light Law

California Civil Code Section 1798.83 permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes.

11.5 Authorized Agents

You may designate an authorized agent to make requests on your behalf. The agent must provide proof of authorization, and we may require you to verify your identity directly.

12. Other U.S. State Privacy Rights

12.1 Virginia, Colorado, Connecticut, Utah

If you are a resident of Virginia, Colorado, Connecticut, or Utah, you have rights similar to California residents, including:

• Right to confirm whether we process your personal data and access that data
• Right to correct inaccuracies
• Right to delete personal data
• Right to obtain a copy in a portable format
• Right to opt-out of targeted advertising, sale, and profiling

12.2 Washington My Health My Data Act

Washington residents have specific protections for consumer health data under the My Health My Data Act. For details, contact privacy@joinsarv.com.

12.3 Nevada

Nevada residents may opt-out of the "sale" of personal information. We do not currently sell personal information as defined by Nevada law. If you have questions, contact privacy@joinsarv.com.

13. Rights for EEA, UK, and Switzerland Residents (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, you have specific rights under the General Data Protection Regulation (GDPR) and similar laws.

13.1 Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract: Processing is necessary to perform our contract with you (providing the Services)
• Legal Obligation: Processing is necessary to comply with the law
• Legitimate Interests: Processing is necessary for our legitimate interests (e.g., fraud prevention, security, improving our Services) unless overridden by your rights

13.2 Your GDPR Rights

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Restrict Processing: Request that we limit how we use your data
• Data Portability: Receive your data in a machine-readable format
• Object: Object to processing based on legitimate interests or for direct marketing
• Withdraw Consent: Withdraw consent at any time (where processing is based on consent)
• Complain: Lodge a complaint with your local supervisory authority

13.3 Data Protection Officer

For GDPR-related inquiries, contact us at privacy@joinsarv.com.

13.4 Supervisory Authority

You have the right to lodge a complaint with a supervisory authority, particularly in the EEA member state of your habitual residence, place of work, or place of alleged infringement. A list of supervisory authorities is available at edpb.europa.eu.

13.5 International Data Transfers

We transfer personal data from the EEA, UK, and Switzerland to the United States using:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where available
• Other appropriate safeguards as required by law

14. Third-Party Services and Links

Our Services may contain links to third-party websites, apps, and services that we do not own or control. This Privacy Policy does not apply to those third-party services.

Third-Party Services We Integrate With:

• Cloud hosting, database, and authentication providers
• Apple and Google (sign-in, and App Store / Google Play subscription billing)
• Subscription-management providers
• A third-party AI provider (AI processing of your inputs to generate recommendations, plus voice transcription and playback)
• Advertising and analytics partners (advertising measurement and attribution — see Section 5.3)
• Crash- and error-diagnostics providers

When you connect your Sarv account to third-party services, you authorize us to access certain information from those services as permitted by their APIs and your privacy settings. We will only use this information as described in this policy.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make changes:

• We will update the "Last Updated" date at the top of this policy
• We will post the revised policy on our website and in the app
• For material changes, we may provide additional notice (e.g., email notification, in-app notification, or prominent notice on our website)
• We may require you to accept the new policy to continue using our Services

We encourage you to review this policy periodically. Your continued use of our Services after changes are posted constitutes your acceptance of the updated policy.

16. Contact Us