Privacy Policy

1. Information We Collect

Information you provide to us

• Account information. When you create an account using Sign in with Apple or Sign in with Google, we receive your name and email address (or, if you use Apple’s “Hide My Email,” a private relay address). We do not receive or store your password for those services.
• Health profile information. To personalize product safety results, you may tell us about your health conditions and your life stage, selected from the options supported in the App. The available options may change over time as we add support for more conditions and life stages.
• Product activity. Barcodes of products you scan, products you look up, and products you save or favorite.
• Photos of product labels. If you photograph a product label, we process the photo to extract the ingredient text, using Google’s optical character recognition (OCR) service acting as our processor. Label photos are used only for text extraction and are not stored after the text is extracted.
• Shared scores. If you choose to share a product score with someone, we process the content needed to generate that share (see Section 5).
• Support communications. Anything you send us when you contact support.

Information collected automatically

• Device and technical information. Device model, operating system version, app version, language, and identifiers needed to operate the App.
• IP address and approximate location. We use your IP address to infer your approximate region (country or state level) in order to apply the correct legal requirements, including age requirements, and to secure the Services. We do not collect precise GPS location.
• Usage and diagnostics. How you interact with the App, such as screens viewed, features used, crashes, and errors, collected through our analytics provider (see Section 4).

Consumer health data

Under laws such as the Washington My Health My Data Act, “consumer health data” includes information that identifies your past, present, or future physical or mental health status. For Truva, this includes the health conditions and life stage you select (which may include reproductive health information) and information derived from them, such as personalized product safety results, and product scans or saves when linked to your health profile. We treat all of this as consumer health data and apply the protections in this policy to it.

What we do not collect

We do not collect precise geolocation, biometric data, government identification numbers, or your contacts. Payment for subscriptions is handled entirely by Apple; we never see your payment card details.

2. Consent for Health Information

We only collect and use your health profile information with your explicit, affirmative consent, which we ask for during onboarding before any health information is collected. Providing health information is voluntary: you can use parts of the App without it, but personalized safety results require it.

You may withdraw your consent at any time by emailing hello@truva.care or by deleting your account in the App’s settings. If you withdraw consent, we will stop processing your health information and delete it, though the App’s personalized features will stop working.

3. How We Use Information

We use the information described above to:

• provide the Services, including generating personalized cosmetic safety results based on your health conditions and life stage;
• create and maintain your account and authenticate you;
• operate your subscription (in conjunction with Apple; see Section 4);
• fulfill product shares you initiate;
• understand how the App is used and improve it, fix bugs, and maintain security;
• apply the correct regional legal requirements (including minimum age) based on your approximate location;
• respond to your requests and support inquiries; and
• comply with law and enforce our Terms.

We do not sell your personal information. We do not share your personal information for targeted or cross-context behavioral advertising. There is no advertising in the App. We also do not use your health information for marketing.

We do not use your personal information, including your health information, to train or improve scoring models, and we do not use it for research.

4. How We Share Information

We share personal information only as described below.

Service providers (processors). Companies that process data on our behalf, under contracts restricting their use of your data to providing services to us:

At your direction. When you choose to share a product score with someone, the recipient will see the information contained in that share.

Legal reasons. If required by law, subpoena, or legal process, or where necessary to protect the rights, safety, or property of Truva, our users, or others. Given the sensitivity of health information, we will resist overbroad requests where lawfully possible and, unless legally prohibited, will attempt to notify you of legal demands for your data.

Business transfers. If Truva is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction; this policy’s protections will continue to apply, and you will be notified of any material change.

We do not share consumer health data with any third party for their own purposes, and we do not permit our service providers to use it for theirs.

5. Sharing a Product Score

Sharing is entirely user-initiated. When you share a product’s score, we generate a link (hosted on our website) containing that product’s information and score. The shared page displays the product and the score generated for you as the sender; it does not state the health conditions or life stage you selected. Even so, consider carefully who you share with: because scores are personalized, a shared score could imply information about your health profile to the recipient.

6. Retention and Deletion

We keep personal information only as long as needed for the purposes above:

• Account and health profile data: retained while your account is active.
• Analytics data: retained in identifiable form for no longer than 12 months, after which it is deleted or aggregated.
• Support communications: retained for the life of the Services, so we can maintain a history of our correspondence with you.

Account deletion. You can delete your account at any time in the App’s settings. Deletion removes your account, your health profile, and your authentication data. We also direct our analytics provider to delete analytics data associated with your account; that deletion is processed by the provider and may take additional time to complete. If you have an active subscription, note that billing is managed by Apple and does not stop automatically when you delete your account. Cancel your subscription in your Apple account settings (Settings, then your name, then Subscriptions) before or after deleting.

We may retain limited information where the law requires it (for example, records of consent, or transaction records) and will tell you if that applies to your request.

7. Security

We use administrative, technical, and organizational safeguards designed to protect your information, including encryption in transit and at rest, access controls limiting who can access user data, and authentication through Apple and Google rather than storing passwords ourselves. No system is perfectly secure; if a breach affecting your personal information occurs, we will notify you and regulators as required by applicable law.

8. Your Rights

You have rights over your personal information. How to exercise any right: use the in-app controls (settings and account deletion), or email hello@truva.care from the email address associated with your account (we use this to verify your identity; we may request additional verification for sensitive requests). We respond within the time required by your local law (generally 30 to 45 days). If we deny a request, we will explain why and how to appeal. You may appeal by replying to our decision, and we will respond to appeals within the period required by your state’s law. You will not be discriminated against for exercising any right.

United States

Depending on your state, you have the right to:

• know and access the personal information we have about you and receive a copy in a portable format;
• correct inaccurate personal information;
• delete your personal information;
• withdraw consent to the collection or sharing of consumer health data at any time;
• opt out of targeted advertising, sale, and certain profiling (not applicable to Truva; we do none of these); and
• appeal a refusal and, if the appeal is denied, contact your state Attorney General.

Consumer health data (Washington, Nevada, Connecticut, and similar laws). We collect and share consumer health data only as described in Sections 1 and 4, only with your consent or as necessary to provide services you request. You may access it, withdraw consent, and have it deleted, including from our processors. A list of the third parties with whom consumer health data is shared appears in Section 4. We do not sell consumer health data and would never do so without your separate, valid authorization. We do not use geofencing around healthcare facilities (we do not collect precise location at all).

Opt-out preference signals. Because we do not sell or share personal information for targeted advertising, opt-out signals such as Global Privacy Control do not change how we process your data.

Website analytics. This website uses Google Analytics to count visits and see which pages people arrive on, and it sets a first party cookie in your browser for that purpose. The iPhone app uses a separate provider, named in the table above, and the two are not joined up.

Canada

We handle personal information in accordance with PIPEDA and, for Quebec residents, the Act respecting the protection of personal information in the private sector (as amended by Law 25). We collect health information only with your express consent, and you may withdraw consent, and request access to and correction of your personal information, at any time. Your information is processed outside Canada (in the United States) by us and the providers in Section 4. Our Privacy Officer, Aman Prasla, can be reached at hello@truva.care.

Other regions

The Services are currently offered in the United States and Canada. If you access the Services from another region, your information will be handled as described in this policy; contact us at hello@truva.care with any question about your privacy rights.

9. Age Requirements and Children

The Services are intended for users who are at least 18 years of age in the United States and at least 16 years of age elsewhere, or older where local law requires (we may use your approximate location to apply the correct minimum age). The Services are not directed at minors, and we do not knowingly collect personal information from anyone under the applicable minimum age. If you believe someone under the applicable age has provided us personal information, contact hello@truva.care and we will delete it.

10. Changes to This Policy

We may update this policy from time to time. If we make material changes, especially any change to how health information is collected, used, or shared, we will notify you in the App and, where the law requires, ask for your renewed consent before the change applies to previously collected health data. The effective date at the top shows when the policy was last revised.

11. Contact Us