Privacy Policy

1. Who We Are

Ezivo ("we", "us", "our") is a UK-based health and wellness technology service operating at ezivo.co.uk. Ezivo provides an AI-powered exercise and pain management application designed to support musculoskeletal wellness.

For data protection enquiries, contact us at: privacy@ezivo.co.uk

2. Data We Collect

2.1 Information You Provide

• Name and email address (account registration)
• Pain location, intensity, and mobility information (health assessment)
• Age range and physical activity level
• Exercise session logs and progress data
• Payment information (processed securely via Stripe — we do not store card details)

2.2 Information Collected Automatically

• Device type, operating system, and app version
• Usage data (features accessed, session duration)
• IP address and approximate location (country level only)
• Crash reports and performance data

2.3 Health Data (Special Category)

Pain and physical condition information constitutes Special Category data under UK GDPR Article 9. We collect this data only with your explicit consent and use it solely to generate your personalised exercise programme.

3. How We Use Your Data

• To provide and personalise your AI-generated exercise programme
• To process subscription payments via Stripe
• To track your progress and adapt recommendations over time
• To send service-related communications (not marketing without consent)
• To improve the Ezivo app through anonymised usage analytics
• To comply with our legal obligations

We do not use your health data for advertising, profiling, or sale to third parties under any circumstances.

4. Legal Basis for Processing

• Consent — for Special Category health data and marketing communications
• Contract — to deliver the services you have subscribed to
• Legitimate interests — for app improvement and fraud prevention
• Legal obligation — where required by UK law

5. Data Storage & Security

Your data is stored securely using Supabase, a SOC 2 Type II certified infrastructure provider. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Our AI processing is handled via Anthropic's API under a data processing agreement that prohibits training on your personal data.

We retain your data for as long as your account is active, plus 12 months following account deletion, after which it is permanently purged.

6. Third-Party Services

• Supabase — database and authentication (EU/UK data residency)
• Stripe — payment processing (PCI DSS Level 1 certified)
• Anthropic — AI exercise generation (data processing agreement in place)
• Netlify — website hosting

None of these providers are permitted to use your personal data for their own purposes beyond the services they provide to us.

7. Your Rights Under UK GDPR

You have the right to:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate personal data
• Erasure — request deletion of your personal data ("right to be forgotten")
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — at any time, without affecting prior processing

To exercise any of these rights, email privacy@ezivo.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

Please see our Cookie Policy for full details of cookies used on this website.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification. Continued use of Ezivo after changes constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions: privacy@ezivo.co.uk
Website: www.ezivo.co.uk