Privacy Policy

We collect only what we need to deliver the Services:

• Account data — name, email address, hashed password or Google sign-in identifier, and account settings.
• Assessment and wellness inputs — the answers you voluntarily provide in the Health Assessment and free tools (sleep, nutrition, activity, stress, energy, habits, lifestyle, symptoms, and similar self-reported data), plus any lab results you choose to upload as a Pro member.
• Generated outputs — Wellness Score, biological age estimate, Health Blueprint, and AI tool outputs derived from your inputs.
• Billing data — subscription status, plan, and billing events. Card details are collected and stored by Stripe, our payment processor; Aevon never receives or stores full payment card numbers.
• Technical data — IP address, device and browser type, pages viewed, referring URL, and timestamps, collected through cookies and server logs.
• Communications — messages you send us by email or through forms.

We do not knowingly collect information from children under 16. We do not collect telephone numbers, and we do not send SMS or automated marketing calls.

• Provide, personalize, and operate the assessment, dashboard, and AI tools.
• Create and maintain your account and authenticate sign-in.
• Process subscriptions, renewals, cancellations, and refunds through Stripe.
• Send transactional email (results, receipts, security and account notices).
• Send educational and marketing email where you have opted in, with an unsubscribe link in every message.
• Improve accuracy, safety, and performance of the Services in aggregate or de-identified form.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use your individual wellness inputs to train third-party foundation models.

• Contract — to deliver the Services and your subscription.
• Consent — for non-essential cookies, marketing email, and processing of health-related data you voluntarily submit (special category data under Art. 9 GDPR). You may withdraw consent at any time.
• Legitimate interests — security, fraud prevention, and product improvement, balanced against your rights.
• Legal obligation — tax, accounting, and lawful requests.

We share personal information only with vendors who process it on our behalf:

• Supabase — database, authentication, and file storage for lab uploads.
• Stripe — payment processing, subscription billing, and invoicing.
• AI model providers — process your assessment inputs to generate blueprints and tool outputs, under agreements that prohibit using your data to train their models.
• Email infrastructure — delivery of transactional and opt-in email from notify.aevonhealth.com.
• Hosting and CDN — serving the application securely.

We may also disclose information to comply with law, respond to valid legal process, protect rights and safety, or in connection with a merger or acquisition (with notice to you). We never sell personal information to data brokers.

Aevon is based in Miami, Florida, United States, and our providers may process data in the United States and other countries. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses together with supplementary technical measures such as encryption in transit and at rest.

• Account and assessment data: kept while your account is active, then deleted or de-identified within 30 days of account deletion.
• Uploaded lab results: kept until you delete them or delete your account.
• Billing records: retained up to 7 years where required by tax and accounting law.
• Server and security logs: typically 90 days.
• Marketing suppression lists: retained indefinitely so we can honor your unsubscribe.

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal information; to object to processing; to withdraw consent; and to be free from discrimination for exercising these rights.

California (CCPA/CPRA). You may request disclosure of the categories and specific pieces of personal information we collected, request deletion or correction, and limit use of sensitive personal information. We do not sell or share personal information as those terms are defined by the CPRA, so no "Do Not Sell or Share My Personal Information" opt-out is required — but you may still submit a request. Authorized agents may submit requests with proof of authorization.

To exercise any right, email info@aevonhealth.com with the subject line "Privacy Request". We verify requests using the email address on your account and respond within 30 days (CCPA: 45 days, extendable once). EEA/UK users may also lodge a complaint with their local supervisory authority.

We use strictly necessary cookies plus optional analytics and marketing cookies. You control optional categories through our consent banner. Manage cookie preferences. Full detail is in our Cookie Policy. We honor Global Privacy Control (GPC) signals where legally required.

We use HTTPS/TLS everywhere, encryption at rest, row-level security on our database, hashed credentials, least-privilege service access, and scoped storage for lab uploads. No system is perfectly secure; if we become aware of a breach affecting your personal information, we will notify you and regulators as required by law.

Every marketing email identifies Aevon Health, Inc., includes our physical mailing address in Miami, Florida, describes itself accurately in the subject line, and contains a working one-click unsubscribe link honored within 10 business days, consistent with the CAN-SPAM Act. Transactional messages (results, receipts, security notices) may still be sent after you unsubscribe from marketing.

We will post any changes on this page and update the "Last updated" date. Material changes will be communicated by email or an in-app notice before they take effect.