Privacy Policy
Your health data is sensitive. We treat it that way.
- Version
- 0.4
- Effective
- August 2026
- Review state
- Draft, counsel review pending
What we collect
Account information, what you enter or upload into your own record, including labs, medications, conditions, immunizations and documents, and counts of how the product is used. Nothing else.
How we use it
Only to keep your own record and to show it back to you inside EVORA. Your health data is never sold and is never shared with advertisers, data brokers or third-party trackers.
Device readings
No automatic device connection is live today. Where a reading from a wearable reaches EVORA, it does so because you imported a file you exported yourself, and the reading is written into your own record and normalized to one shape so that changing or dropping a device never restarts your history. If and when a direct provider connection becomes available, access will be read-only, limited to daily summary metrics you authorise, and used only to render your own record. Provider data is never sold, rented, licensed, redistributed or used in advertising, and never used to train or evaluate models for resale.
Removing an imported source
Removing an imported source from your account permanently deletes the readings EVORA received from it. Removing it in EVORA does not affect data stored inside the provider's own app, you control that separately. Deleting your EVORA record does the same for every source.
Security and incident notification
Data is transmitted over HTTPS and stored encrypted at rest, with row-level access scoped to your record. If we become aware of unauthorised access to data affecting your record, we will notify you without undue delay, as required by applicable law.
Brand and trademark
Oura, the Oura Ring, WHOOP, Apple Health, Garmin and other named devices are trademarks of their respective owners. EVORA is independent and is not affiliated with, endorsed by or sponsored by these companies.
Data ownership
You own your data. You can export everything you've shared with EVORA at any time as CSV or FHIR-formatted JSON, and you can delete your account in one action.
No third-party trackers
EVORA OS does not run advertising pixels, session recorders, or behavioral analytics scripts. Anonymous server logs only.
Security
Data is encrypted in transit and at rest. Access is limited, role-based, and audited.
Your rights
You can request a copy of your data, correct it, restrict processing, or delete your account at any time from your account page or by emailing privacy@evora.health.
Contact
privacy@evora.health
Version 0.4 · effective August 2026 · draft