Ava app · legal document

Ava app Privacy Policy

How the Ava app collects, uses and protects your data, in plain words.

Last updated: October 3, 2026

Preamble

This policy applies to the Ava mobile application (hereinafter "the app"). You entrust it with information that is sometimes very personal: what you eat, your weight, your goals. It explains which data is processed, why, by whom, for how long, and what your rights are.

Processing is governed by the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, and by the Swiss Federal Act on Data Protection (revFADP).

We never sell your data and do not use any data broker. The app contains no advertising tracker, and your phone number is never used for marketing campaigns, advertising audiences or advertising measurement.

1. Data controller

Eatten Sàrl, business identification number CHE-351.622.923, Avenue Jomini 5, 1004 Lausanne, Switzerland. Contact: timitten@live.fr

Data protection contact: Tim Schneider, data protection officer, timitten@live.fr (write "DPO" in the subject line). Target response time: 7 business days.

2. Data we collect

  • Phone number: the identifier of your account, used to send you the one-time sign-in code.
  • Messages: the texts you exchange with Ava, and your voice messages, transcribed into text so they can be understood.
  • Photos: the photos of meals and other images you send, to analyze their content.
  • Blood-glucose readings you enter or share with us (value, unit, time of measurement), for your blood-sugar tracking.
  • Health documents you send, for example blood-test results, to extract their values and tailor the advice.
  • Body photos you choose to send, for an approximate estimate of your body-fat percentage.
  • Health and nutrition data you enter or share: meals, weight, height, age, sex, goals, physical activity, and any allergies, intolerances or medical conditions you mention.
  • Your device's push notification token, if you allow notifications, to let you know when Ava writes to you.
  • Subscription information: status, plan and validity dates of your in-app subscription (App Store or Google Play). We never receive your banking details.
  • Technical data: server logs (IP address, timestamps), kept for 30 days at most, and technical session identifiers.

The app only accesses your camera, photo library or microphone when you choose to send a photo or a voice message, and with your permission.

3. Health data

Some of this data (weight, height, diet, blood-glucose readings, blood-test results, body photos, medical conditions mentioned, physical activity) belongs to the special categories of data under Article 9 GDPR and to sensitive data under Article 5(c) revFADP.

It is processed only with your explicit consent, given when you sign up, and only to provide you with the service. You can withdraw this consent at any time, without affecting the lawfulness of prior processing, by writing to us or by deleting your account in the app.

4. Purposes

  • Providing the service: analyzing your meals, tracking your goals, summaries, reminders and notifications.
  • Personalizing recommendations to your profile, your constraints and your history.
  • Creating and securing your account: sending and verifying the sign-in code, preventing fraud and abuse.
  • Managing your subscription: verifying in-app purchases and their status, support.
  • Improving Ava, using anonymized and aggregated analytics only.
  • Complying with our legal obligations.
  • Performance of the contract (Art. 6(1)(b) GDPR): providing the service, managing your account and your subscription.
  • Explicit consent (Art. 6(1)(a) and 9(2)(a) GDPR, Art. 6 revFADP): health and well-being data, notifications.
  • Legal obligation (Art. 6(1)(c) GDPR): retention of accounting records.
  • Legitimate interest (Art. 6(1)(f) GDPR): security of the service, fraud prevention, anonymized product improvement.

6. Ava and artificial intelligence providers

Ava is an artificial intelligence. To prepare its replies, Calerys sends the messages, photos and voice messages you send, together with the useful context from your history and your tracking, to DeepInfra, OpenAI or Anthropic, depending on the processing. This content may include the health data you choose to share: your blood-glucose readings are part of the conversation context sent to DeepInfra; your body photos are analyzed by OpenAI; your health documents are read by DeepInfra or OpenAI when they are images, and by Anthropic when they are PDFs.

At OpenAI and Anthropic, the use of this content to train their models is disabled.

7. Processors

Only the providers needed to run the app have access to your data, each for its own role:

  • Apple: app distribution, in-app purchases and payment, push notification service (Ireland and United States). For billing your subscription, Apple acts as an independent controller under its own privacy policy.
  • Google: app distribution on Android (Google Play), in-app purchases and payment through Google Play Billing (Ireland and United States). For billing your subscription, Google acts as an independent controller under its own privacy policy.
  • RevenueCat: management of the status of in-app subscriptions (United States).
  • Meta (WhatsApp Business): sending the sign-in code by WhatsApp and delivering messages on WhatsApp (EU / United States, DPF).
  • Twilio: sending the sign-in code by SMS (United States).
  • DeepInfra: AI inference on conversations and on the context needed for replies (United States).
  • OpenAI / Anthropic: AI processing of conversations, including voice message transcription and the analysis of photos (meals, body photos) and health documents (United States, DPF, training disabled).
  • Supabase: encrypted storage at rest (Germany, Frankfurt).
  • Railway: application hosting (United States / EU).

No other recipient. We do not sell your data and do not share it for any advertising purpose.

8. Transfers outside Europe

Some providers are established in the United States. The applicable safeguards depend on the provider and on the processing concerned. They may include in particular:

  • participation in the EU-US Data Privacy Framework (DPF), where the provider is certified;
  • the Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914);
  • additional technical measures: encryption, minimization of the data transferred.

For Switzerland, the Swiss-US Data Privacy Framework may cover a transfer to the United States where the provider is certified and the processing concerned falls within the scope of that certification.

9. Retention periods

  • Active account: duration of the subscription, then 3 years after your last interaction.
  • Conversations, meals and measurements: kept as long as your account exists, then according to the rule above. Your history is what makes tracking possible: a weight curve or a progression can only be read over time. You can request their deletion at any time.
  • Deleted account: effective deletion within 30 days at most, unless a legal obligation requires otherwise.
  • Accounting records: 10 years (Swiss legal obligation, Art. 958f CO).
  • Technical logs: 30 days.
  • Notification token: kept as long as it is active on your account, and deleted with your account.
  • Anonymized and aggregated data: without limit, as it cannot be linked to any identifiable person.

10. Your rights

In accordance with Articles 15 to 22 GDPR and Articles 25 to 28 revFADP, you have the following rights:

  • right of access to your data and to receive a copy of it;
  • right to rectify inaccurate or incomplete data;
  • right to erasure, subject to legal retention obligations;
  • right to restriction of processing;
  • right to data portability, in a structured, machine-readable format (JSON);
  • right to object, on grounds relating to your particular situation;
  • right to withdraw your consent at any time, without retroactive effect;
  • right to give instructions on what happens to your data after your death.

To exercise any of these rights, write to timitten@live.fr describing your request. We reply within 30 days; this period may be extended by 60 days for complex requests, with prior notice.

11. Deleting your account from the app

You can delete your account at any time, directly in the app: "My account" > "Delete my account", then confirm with a 6-digit code. Your meals, your weight, your goals, Ava's memory and the data linked to your account are then permanently erased, within 30 days at most, unless a legal retention obligation applies.

Deleting your account does not cancel your Apple subscription or your Google Play subscription: on iPhone, cancel it in Settings > [your name] > Subscriptions; on Android, in Play Store > Profile > Payments & subscriptions > Subscriptions.

12. Security

Eatten Sàrl implements appropriate technical and organizational measures:

  • encryption in transit (TLS) for all communications;
  • encryption at rest of databases and backups;
  • strong authentication (2FA) for all administrative access;
  • separation of production and development environments;
  • minimization: we only collect what the service needs.

In the event of a data breach likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours, and the people concerned as soon as possible when the risk is high.

13. Minors

The app is strictly reserved for adults (18 years or older). We do not knowingly collect data about minors. If we learn that an account belongs to a minor, it is deleted without delay.

If you are a parent or guardian and believe that a child has sent us data, contact us immediately at timitten@live.fr

14. Complaints

If you believe your rights are not being respected, you can lodge a complaint with:

We do however invite you to contact us first to try to resolve the situation directly.

15. Changes

This policy may be updated to reflect technical, legal or organizational changes. Any substantial change is notified at least 30 days before it takes effect, in the app or in your conversation with Ava.

16. Contact

Eatten Sàrl, Avenue Jomini 5, 1004 Lausanne, Switzerland. Email: timitten@live.fr

See also: Ava app Terms of Use