Privacy policy
Last updated: 29 July 2026
This translation is provided for convenience. If interpretations differ, the German original prevails. Deutsch
Elvunea requires no user account. Health and tracking data is normally processed on your iPhone. There is no advertising, advertising tracking, or marketing profiling. Apple Health, weather data, and reminders are optional and can be enabled or declined independently.
Controller
Maximilian KluckerIm Hopfengarten 22B
54295 Trier
Germany
Email: support@elvunea.com
1. Scope and data in the app
This policy covers the Elvunea iOS app and elvunea.com. Depending on the modules you choose, the app may process check-ins, notes, migraine and headache information, endometriosis symptoms, cycle and bleeding information, mood, medication and supplement intake, sleep, stress, caffeine, alcohol, movement, meals, and hydration. These entries may constitute health data under Article 9 GDPR and are used only for the documentation, history, estimate, statistics, and export functions you select.
2. Storage and analysis on your device
App data remains in local storage on your iPhone and is excluded from automatic device backups. Elvunea operates no own user or health-data server and cannot access data stored only on your device. Statistics, cautious associations, cycle estimates, and PDF reports are calculated on the iPhone. No external AI service is used. Results are not automated decisions and do not provide diagnosis or treatment.
3. Optional Apple services
With separate permission, Elvunea reads only step count, Apple exercise time, and resting heart rate from HealthKit and writes nothing to Apple Health. Weather tracking uses an approximate location once per check-in to request local WeatherKit data; coordinates are not stored. Local reminders contain no health data. Apple controls these services under the terms of your Apple Account.
4. Purposes and legal bases
Selected app functions are provided under Article 6(1)(b) GDPR. Voluntary health data and optional health-related sources are processed with explicit consent under Articles 6(1)(a) and 9(2)(a) GDPR. Consent can be withdrawn for the future by disabling the feature or system permission. Secure website operation and abuse prevention rely on Article 6(1)(f) GDPR.
5. Recipients and international transfers
Data is not shared for advertising, marketing, or data trading. Apple provides the App Store and TestFlight, HealthKit, WeatherKit, location, and notification services. IONOS SE hosts the website and email under a data-processing agreement. Apple may process data outside the EEA using the safeguards described in its privacy documentation.
6. Retention and deletion
Local app data remains until you delete it or remove the app and its data. Local health data is excluded from automatic device backups and currently cannot be restored automatically after the iPhone or app data is lost. PDF files are temporary. Contact email is deleted once the request is completed unless legal retention duties apply.
7. Website and feedback
The website uses no cookies, analytics, advertising trackers, social-media plug-ins, or externally hosted fonts. IONOS processes technical access data needed for secure delivery. The app-only feedback form requests a category and message, but no email address, app version, or identifier. Do not enter names, contact details, or health data. A temporary pseudonymous IP hash limits abuse and is retained for no more than one hour.
8. Security
Protection includes iOS security mechanisms, file protection for local storage, an optional app lock, encrypted transmission to Apple services, and HTTPS for the website. No electronic system can guarantee absolute security.
9. Your rights
Where the legal requirements are met, you have rights of access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests, and withdrawal of consent for the future under Articles 7 and 15–21 GDPR. Data stored only locally cannot be viewed by the controller; you can access, correct, export, and delete it in the app.
10. Complaints and changes
You may complain to a data protection authority. The authority responsible for the controller is the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, Germany. This policy is updated when functions, data flows, providers, or the law change. Material changes requiring new consent do not become effective merely by updating this text.