Privacy Policy

Evolu Tecnologia S.A., CNPJ 69.081.622/0001-98, headquartered at Rua Palmares, 17, Santa Lúcia, Belo Horizonte/MG, CEP 30360-480, is the controller of the personal data processed in the Evolu App and Site, under Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018).

Data Protection Officer (DPO): reachable at contato@appevolu.com.

In the App:

• Account data: name, email, date of birth and login credentials (or the Apple/Google social login identifier).
• Health and body data (SENSITIVE personal data, art. 5, II, LGPD): weight, height, body measurements, estimated body fat percentage, progress photos, completed workouts, logged meals, sleep, medications, supplements and treatments you log (for example, GLP-1 doses, with dose and site) and, when provided, menstrual cycle data.
• Evolu Ring data, when paired: heart rate, heart rate variability, blood oxygen, skin temperature, sleep, steps and activity.
• Location, in two cases: (a) during a GPS run, the activity's coordinates from start until you end it, including with the screen locked (so the route does not break with the phone in your pocket), to calculate distance, pace and route; outside an activity, the App does not collect location; (b) if you turn on the Evolu Ring's "Last seen", the point where the ring was last seen, kept only on your device.
• Integration data (only if you connect them): steps, calories, workouts, sleep and weight from Strava, Apple Health or Health Connect.
• Coach conversations: the messages you exchange with the Coach, its proposals and what you applied, a short AI-made summary of each conversation and what the Coach created for you (charts, panels and plans). For each conversation you choose whether the Coach may use its summary as context in future ones.
• Personal challenges: the goal you write, your answers to the Coach's interview (including pain, injuries and medical clearance, when you share them), the plan built and the sessions you log.
• Usage and device data: technical access logs (art. 15 of the Brazilian Internet Civil Framework), device model, operating system and identifiers required for operation. When the App fails, an error record: what failed, on which screen, the version and the device, without the content of your logs. When you use artificial intelligence, a cost record of each call: which feature, the model and the number of tokens, without the content, kept for 180 days.
• App usage records, only if you allow it under "Help improve Evolu": the days you open the App, screens opened, sign-up steps, how many messages you send to the Coach (not their text) and shares.

On the Site:

• Waitlist: name, email, phone (WhatsApp), interest, language, your consent and where the visit came from (campaign parameters and referring page).
• Purchases: what you enter at the Stripe checkout, such as name, email, phone and shipping address, the chosen plan and, for the ring, color and size. Card data stays with Stripe.
• Measurement cookies (Google Analytics and Meta Pixel), only after your consent in the cookie notice (section 6).
• Site access logs (art. 15 of the Brazilian Internet Civil Framework).

• To provide the App service (store what you log, build plans, diary, charts and reports): performance of a contract (art. 7, V) and, for sensitive health data, your specific and prominent CONSENT (art. 11, I), given on the "Your data, your choices" screen before first use.
• To generate analyses and plans with artificial intelligence and answer in the Coach: specific consent, separate from the one above. Only with it does the necessary information (for example, measurements, meals, sleep, Coach messages, check-in photos and photos you ask to analyze) go to the AI providers in section 5.
• To log a medication treatment (such as GLP-1): specific consent, given in the acknowledgment before you start logging.
• To improve the product with App usage records: consent, optional and off by default.
• Waitlist and sales and news notices by email and WhatsApp: consent (art. 7, I), given in the Site form. To leave, reply to any message or write to contato@appevolu.com.
• Purchases, delivery, warranty and support: performance of a contract (art. 7, V) and compliance with legal and tax obligations (art. 7, II).
• Measuring visits and ads on the Site: consent, given in the cookie notice. Without it, nothing is measured.
• Keeping the App working, fixing failures and controlling the cost of the service (error records and AI usage records): performance of a contract and legitimate interest (art. 7, V and IX).
• Service communications and support: performance of a contract and legitimate interest (art. 7, IX).
• Compliance with legal obligations and defense in legal proceedings: legal obligation (art. 7, II) and regular exercise of rights (art. 7, VI).

You can change the AI and improvement choices anytime under Privacy and data, and every choice is recorded with its date. Withdrawing consent does not affect processing already carried out; withdrawing consent for the App service means closing the account.

Your progress photos are encrypted on your device before upload and only appear in your account: they are not public or shared with other users. The key that opens the photos is kept on your device and, as a protected copy, in your account, so you can see your photos after changing phones or reinstalling the App. For that reason, encryption protects the photos in storage but does not hide them from the Company; technical access by the Evolu team is limited to what is needed to run the service. Photos go to the AI providers only with your consent to AI use, when you make a check-in with photos (the check-in analysis uses that day's photos) or request a body analysis, and only for as long as needed for processing. Any image is shared externally only when you yourself use the "share" feature.

We do not sell your personal data. We share it only with processors needed for the service:

• Infrastructure and database: Supabase (hosting, authentication and storage).
• AI processing, only with your consent to AI use: Google (Gemini models) and Anthropic (Claude models), which receive only the data strictly necessary for each AI feature you use. Under these providers' API contracts, the data is not used to train their models.
• Payments: Stripe, which processes purchases made on the Site.
• Site hosting: Netlify.
• Measurement on the Site, only with your cookie consent: Google (Analytics) and Meta (Pixel).
• Ring delivery: carrier or logistics operator, which receives your name, phone and shipping address.
• Accounting, for invoices and tax obligations.
• Integrations you connect (e.g., Strava), as you authorize.

Google, Anthropic, Meta, Stripe and Netlify process data outside Brazil, and Supabase may; international transfers comply with art. 33 of the LGPD, with your specific consent (for AI and cookies) and contractual safeguards. We may also share data under a court order or a request from a competent authority.

The Site uses cookies and browser storage of two kinds:

• Necessary: they keep your cookie choice and, during the visit, where it came from, to record it with the waitlist if you sign up. They do not identify you to third parties.
• Visit and ad measurement (Google Analytics and Meta Pixel): they only load if you tap "Accept" in the cookie notice. They count visits and show which ads bring people to the Site.

You can change your choice anytime under "Cookie preferences" in the Site footer. The App does not use advertising cookies.

We adopt technical and administrative measures consistent with the state of the art: encryption in transit (TLS) and at rest, additional encryption of progress photos, per-user access control (account isolation), secure authentication and access logging. No system is 100% secure; in the event of an incident posing relevant risk, we will notify you and the ANPD under art. 48 of the LGPD.

In the App, we keep your data while your account exists. When you delete your account, your personal data is erased from active systems, except for records that must be kept by law (for example, access logs for the period required by the Brazilian Internet Civil Framework and tax documents) and anonymized data, which is no longer personal. App error records are kept for 90 (ninety) days. Coach conversations stay in your history until you delete each one (in the Coach itself) or delete your account. Your device keeps only a copy of the open conversation so it opens faster; when you sign out, it and the other data kept on the device are erased.

On the Site, waitlist data is kept for as long as the pre-sale and launch last, or until you ask to leave; purchase data, for the period required by tax and consumer protection law; access logs, for 6 (six) months (Brazilian Internet Civil Framework, art. 15).

You can, at any time: confirm whether processing takes place; access your data; correct it; request anonymization, blocking or deletion; request portability; obtain information about sharing; and revoke consent.

How to exercise them: use "Export my data" (portability and access) and "Delete my account" (deletion) on the App's Privacy and data screen, or write to contato@appevolu.com. On the same screen you can change the AI and improvement choices and view or delete the AI memory (what the Coach kept about you). Deadlines and details at appevolu.com/lgpd. You can also file a petition with the National Data Protection Authority (ANPD).

Evolu is not intended for anyone under 16, and we do not knowingly collect their data: sign-up checks the date of birth and does not continue below that age. If we identify an account belonging to someone under 16, the account and data will be deleted. Parents or guardians can contact contato@appevolu.com.

This Policy may be updated. Significant changes will be announced in the App and on the Site. The date of the last update appears at the top of the document. Continued use after the new version takes effect indicates awareness of it.