EvrFit Privacy Policy

Effective date: 3 October 2026

1. Who we are

EvrFit is provided by Arqevia Labs Private Limited, a company registered in India ("EvrFit", "we", "us", or "our"). We decide how and why the personal data described in this policy is used. We are the controller of that data under the GDPR and the data fiduciary under India's Digital Personal Data Protection Act, 2023.

Privacy and Grievance Officer: privacy@evrfit.app

2. Scope and age requirement

This policy applies to the EvrFit mobile app, this website and related services. EvrFit is intended only for people aged 18 or older. By creating or using an account, you confirm that you are at least 18.

If we learn that a person under 18 has provided personal data, we will restrict the account, investigate, and delete the data unless the law requires otherwise. A parent or guardian may contact us at privacy@evrfit.app.

3. Data we collect

Depending on the features you use, we collect:

• Account data, such as your user ID, email address, name, authentication-provider details, and account timestamps.
• Subscription data, if you buy EvrFit Plus: your subscription status, its expiry date and Apple's transaction identifiers. Apple takes the payment, and we never receive your card or bank details.
• Profile and preference data, such as birth year, sex, height, weight, goals, fitness level, activity level, cuisine and workout preferences, active hours, timezone, avatar, smoking and drinking preferences, injuries, medical conditions, and medications.
• Health and fitness data, such as workouts, exercises, sets, repetitions, load, distance, duration, calories, water intake, weight, heart-rate summaries, and sleep summaries and stages.
• Nutrition data, such as food entries, serving information, meal type, and estimated nutrients. If you request photo analysis, the image is processed for that request but is not saved in EvrFit Storage or attached to your food log.
• Medical-report data, such as an uploaded PDF, extracted report text, your caption, and an AI-generated explanation or summary.
• Medication-log data, including medication name, dose, and time taken.
• Device and app data, such as push-notification tokens, device identifiers used for notifications, app activity needed to provide the service, AI usage and credit records, and security or diagnostic logs maintained by our service providers.

Apple Health access is optional and controlled through Apple’s permission interface. If you grant access, EvrFit reads only the categories you approve. The current app uploads derived daily summaries needed by its features to our backend. The complete Apple Health database remains under Apple’s and your device’s controls.

4. How we obtain data

We receive data directly from you, from Apple Health when you authorize access, from Apple or Google when you choose to sign in with them, and from technical systems that operate and secure the service.

5. Why we use data and our legal bases

We use personal data to:

• Create and secure your account and provide requested app features.
• Generate plans, summaries, insights, and progress views.
• Process food photos and medical reports when you ask us to.
• Synchronize authorized Apple Health information.
• Send reminders and service notifications you enable.
• Prevent abuse, troubleshoot, and maintain service security.
• Comply with law and respond to valid legal requests.

For ordinary account and service data, we generally rely on performing our contract with you. For special-category health data, including medical conditions, medications, HealthKit summaries, and medical reports, we rely on your explicit consent where required by law. We may rely on legal obligations or legitimate interests for narrowly scoped security, fraud prevention, and legal compliance after assessing your rights. Where Indian law applies, we process personal data on the basis of your consent and for the other uses that law permits, such as providing a service you asked for and meeting legal obligations.

AI-assisted processing of health data is integral to EvrFit: plan generation, weekly reviews, food-photo analysis, and medical-report interpretation all depend on it. For this reason consent is requested once, before you begin using the app, and the app cannot be used without it.

There is no separate in-app control to withdraw this consent while keeping your account. To withdraw, delete your account from Profile → Account → Delete Account. Deletion is immediate and permanent, and erases the data described in section 9. Withdrawal does not make earlier lawful processing unlawful.

You can revoke Apple Health access separately at any time in iOS Settings, without affecting your account.

6. AI processing

When you use an AI feature, the relevant content is sent securely from our servers to the AI service providers we work with, who process it only to return a result. Depending on the feature, the content can include profile details, goals, food or workout information, health metrics, known conditions, medications, and extracted medical-report text.

This information is not anonymous merely because your account ID is omitted from an AI prompt: the content itself may identify you or concern your health. AI output may be incomplete or wrong and is provided for general wellness information, not diagnosis, treatment, or emergency care.

We only use providers that do not keep submitted content beyond serving the request. Your content is not used to train AI systems, by us or by our providers.

If we change providers in a way that alters this position, we will update this policy and, where the change concerns health data, seek renewed consent.

7. When we share data

We disclose data only as needed to operate the service, follow your instructions, protect the service, or comply with law. Current categories of recipients include:

• Cloud infrastructure providers, for authentication, database, file storage, and the servers that run EvrFit.
• AI service providers, for user-requested AI processing.
• Google, when you choose Google Sign-In.
• Apple, for Sign in with Apple, platform services, Apple Health permissions, subscriptions, and push-notification delivery.
• Professional advisers, authorities, or transaction counterparties where legally necessary.

We do not sell personal data. We do not use Apple Health or medical data for advertising, data brokerage, or marketing profiling.

8. International transfers

We use global cloud services, and our providers may process data in regions including the European Union, India, the United States and Singapore, which can be outside your country or the European Economic Area. Where required, we use an approved transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, and assess supplementary safeguards.

EvrFit is operated from India, so our team can access your data from there.

9. Retention and deletion

We keep personal data only as long as needed for the purposes above, legal obligations, dispute handling, and security. EvrFit automatically deletes food logs and their referenced legacy photos, workout logs, water logs, weight logs, medication logs, synchronized health summaries, plans, and reviews after they are more than 90 days old. The cleanup runs daily, so an expired item may remain for up to about 24 additional hours. New food-analysis photos are not stored by EvrFit. This does not delete information held independently in Apple Health.

Medical reports, your account and profile, avatar, devices, and AI usage/credit records follow separate retention rules and are not deleted by the rolling activity cleanup. You may delete individual items where the app offers that control. Reset Preferences deletes many logs, plans, and medical reports but does not delete your account or all associated data. You can permanently delete your account and associated production data from Profile → Account → Delete Account. Limited security or billing records may be retained only where another documented legal basis requires it and are otherwise deleted or de-identified.

10. Our website, cookies and local storage

The EvrFit website does not use cookies, analytics or advertising trackers, and it does not load scripts from other companies. Because of that it does not show a cookie banner.

The website does keep two small items in your browser. Neither one leaves your device or identifies you. If you choose a light or dark theme with the theme button, that choice is saved in your browser's local storage so the site remembers it. You can clear it at any time in your browser settings. While you browse, your browser tab also remembers which page animations have already played, so they do not repeat as you move between pages. This is cleared when you leave or reload the page.

Our hosting provider may keep ordinary server logs, such as your IP address, browser type and the pages requested, for security and reliability.

If we add analytics or any non-essential cookies in future, we will update this policy and ask for your consent first where the law requires it.

11. Security

We use measures intended to protect data, including authenticated access, access controls, private file storage, and encrypted transport. No system is completely secure. Access controls protect confidentiality but do not make data anonymous.

12. Your rights

Depending on your location, you may have rights to access, correct, export, delete, restrict, or object to processing, to withdraw consent, and, under Indian law, to nominate another person to exercise your rights and to have a grievance addressed. You may also complain to your local data-protection authority and, where Indian law applies, to the Data Protection Board of India after you have raised the matter with us.

Send requests to privacy@evrfit.app. We may request proportionate information to verify your identity. We normally respond within one month where the GDPR applies, subject to lawful extensions.

You can revoke Apple Health permissions in iOS settings at any time. As explained in section 5, consent to AI processing of health data is withdrawn by deleting your account, which erases your data immediately.

13. Changes

We may update this policy when our practices, providers, or laws change. We will post the updated date and provide additional notice when a change is material or requires renewed consent.

14. Contact

Arqevia Labs Private Limited
Privacy and Grievance Officer
India
privacy@evrfit.app

Optional assistant connections (when available)

You can approve a connection in your signed-in EvrFit app without signing into this website. For this handoff, your browser keeps temporary connection identifiers and secret values in local storage for up to five minutes of usable access. The app link contains a separate approval ticket, never your account password, session or health records. Our server stores hashed tickets, request status and, after you open the request in the app, its account association. Requests expire after five minutes; records are removed within about one day to prevent replay. A callback is returned only to the browser holding its completion ticket. QR codes are generated on your device and are not sent to a QR service.

If you choose to connect an external assistant through EvrFit MCP, account linking identifies your account and shares the sign-in identity information shown during authorization. You separately choose which EvrFit data categories the connected service can read and which actions it can perform. Medical context, synced Health information, report text, original report files and changes to your records have separate permissions. Sharing is optional; assistant connections require an active EvrFit Plus entitlement.

Data returned to a connected assistant is received by the service you chose and may be retained or used under that service's own terms and privacy settings. Read these before granting access, especially for medical or Health information. Disconnecting stops future EvrFit access and pending sensitive commits; it cannot recall information already received by another service. You can reduce permissions or disconnect in account controls, including after Plus expires.

Assistant-side analysis and ordinary logging do not consume EvrFit AI credits. Requests that invoke EvrFit's own generation continue to use its existing consent and credit rules. Authorized changes are recorded as account actions; medicines and AI-generated plans are not prescriptions or medical approval. Apple Health writes require the authorized phone and its system permissions and may remain pending while it is offline. Explicit edits/deletes can update or remove corresponding EvrFit-owned Health samples; rolling activity retention does not erase independently retained Apple Health history.

Connector security records include client identity, permissions, action/record identifiers, timestamps and request-key fingerprints. Action audit events are kept for up to 90 days. Health-containing retry/proposal payloads expire after 24 hours (or earlier under activity retention) and are cleared by periodic cleanup. Opaque request-key records remain with the connection to prevent duplicate actions; reset clears or invalidates them, and account deletion removes them. Device-deletion identifiers may remain as account safety metadata to repair late writes or reconcile a newly selected phone. Private-file cleanup references remain until cleanup succeeds. A file cleanup reference may briefly survive account deletion to remove an upload that was already in flight; it contains an allocated object path, not extracted report text. These records do not extend the existing activity-history retention.