Raava Privacy Policy

Service: Raava (the "App")

Controller: Mana Cores Limited ("Mana Cores", "Raava", "we", "us"), Suite 11341, 26/27 Upper Pembroke Street, Dublin 2, D02 X361, Ireland; incorporated in Ireland

Privacy contact / Data Protection contact: legal@heyraava.com

Last updated: 14 October 2026

This Privacy Policy explains what personal data we collect, why, how we use and share it, how long we keep it, and the rights you have. Because the App processes health and other sensitive data, please read the sections on special category data and your rights carefully.

---

1. A note on sensitive health data

Raava is a health and fitness tracking app. Some of the data you choose to provide is special category or sensitive personal data under laws such as the GDPR (Article 9), including data about your health, injuries, medical clearance, supplements or medication, and, if you choose to use those features, your reproductive status, pregnancy or lactation, and menstrual cycle. We use it only to provide the features you have chosen. We never use it for advertising and we never sell it.

We ask for your consent separately for each kind of sensitive data, and you can take each one back on its own. The previous version of this policy said that only one health consent was recorded and that the rest of this data reached us because you typed it into a feature you opened. That was true when it was written and it is no longer what the App does.

There are five of these consents. Four cover the data you enter yourself: your cycle and reproductive data, your prescription medicines, your weight and body measurements, and your daily check ins. The fifth covers reading records from your phone's health platform. For each one:

• We ask before we save. The first time you do something that would store that kind of data, we tell you what we would store, what we would use it for, and that we never use it for advertising, never sell it and never show it to anyone else in the App. You choose whether to agree. Choosing Not now cancels that one save and nothing else; the rest of the App keeps working exactly as before.
• We record what you agreed to and when, with the version of the wording you were shown, so we can show you the same thing later.
• You can take it back at any time, under Settings, Privacy, Health data permissions. Each one is listed separately with the date you gave it.
• Taking it back deletes what we stored under it. We say exactly what will be deleted before you confirm, and we do the deleting and the recording of it in one step, so one cannot happen without the other. Section 7 says what each one removes.

Two things we would rather be plain about. We ask when you next save, not when you look. If you were already using one of these features before we started asking, everything you logged is still there and still yours to see, export and delete; the question comes the next time you add something. And agreeing is not the price of the App: every one of these can be declined and the rest of Raava keeps working.

Before the App will generate a training program you also accept a medical disclaimer and answer the health screening questions, and we record that acceptance with its version.

The Article 9 condition that covers each of these categories is still a question we have not settled. What has changed is that we now have a record of your consent to point at, rather than a gap to admit.

You can stop using any of these features, export your data, or delete your account at any time.

---

2. The data we collect

We collect data you provide, data generated as you use the App, and a limited amount of technical data.

A. Account and identity

• Email address and authentication identifiers (via email/password, Google sign in, or Apple sign in). Apple/Google may share your name and email when you choose those sign in methods. If you sign in with Apple, we also keep the token Apple gives us for that sign in, only so that we can end the link when you delete your account.
• Display name, birth month and year (we never ask for the day), and sex assigned at birth. Accounts created before 16 September 2026 may hold no birth month and year.

B. Body metrics

• Weight, height, and optionally body composition figures; derived calorie and macronutrient targets.

C. Health and medical data (sensitive)

• Health screening answers (the standard readiness questions: heart conditions, chest pain, dizziness or fainting, bone, joint or soft tissue problems, blood pressure or chronic condition medication, pregnancy complications, and any other reason not to exercise) and the safety flags derived from them.
• Whether you have attested physician clearance to exercise.
• Injuries you report (body area, severity, notes) and muscles you choose to ease off.
• Reproductive status and, if applicable, pregnancy trimester or lactation stage, and menstrual cycle settings (cycle length, period length, last start date).
• Supplements and medication you log (name, dose, schedule), including any items you mark as medicine. For an item marked as medicine you can also record, all optionally, whether it is a prescription, the name of the prescribing doctor, the name of your pharmacy, a refill date, and a free text description of the condition it treats (the "Treats" field). These are among the most sensitive fields in the App: they can name a third party and state a diagnosis.
• Daily check ins: your self reported sleep quality, fatigue, stress, muscle soreness and mood, optional hours slept, and the readiness score and band we compute from them. (The check in record can hold a written note, and nothing in the App asks you for one today. If we add a place to write one, this section will say so before it ships.)

D. Training and activity data

• Goals, fitness level, equipment, weekly schedule, target muscles; your weekly sport schedule; workouts, logged sets (weight, reps or the time or distance of the set, perceived effort), sessions, and activity logs; training programs generated by AI and the safety decisions recorded for them (consent version, exclusions and limits applied, validator outcome).
• Training history you bring in from another app. If you choose to, you can import your workout history from Strong or Hevy. You export the file from that app and pick it yourself; the App reads it on your phone, shows you what it found, and saves the sessions and sets to your account marked as imported. We take the dates, the exercise names, the weights, the reps, the time or distance where the file records one, and the perceived effort. We do not take any notes you wrote in the other app, and we do not take any body measurement from the file. You can undo a whole import afterwards, which deletes those sessions. One thing to know: to read the file, your phone copies it into the App's own storage, and that copy stays on your phone after the import. It is not on our systems. Clearing the App's storage or deleting the App removes it, and your phone may clear it on its own.

E. Nutrition data

• Meals and food items you log, including meal dates and times, calories and macronutrients, custom foods, saved meals, and favorites. If you photograph a nutrition label or type a food to estimate, that image or text is processed to extract nutrition facts (see Section 4).
• Water, caffeine and alcohol intake you log.
• When you search for a food or scan a barcode, the search term or barcode is sent from your device to the public food and supplement databases described in Section 5. Your account identifier is never sent with it.

F. Subscription and billing data

• Subscription status, tier, trial/renewal state, and purchase events, processed through the app store and our billing provider. We do not receive or store your full payment card details.
• Club codes. If you enter a code from a sports club, we check it and, if it is valid, record that your account can use our Founder prices. We count how many times each club's code has been used. We do not record which code you entered or which club you belong to.

G. Technical, usage, and diagnostic data

• App and device information, product analytics events about how you use features, and crash and error diagnostics. No health reading and no free text you wrote is ever put in an analytics event, and a test in our build fails if anyone tries.
• We do not tell the analytics tool who you are. It is given no account identifier and no email address, so it has no profile of you to hold; it sees a random identifier its own software creates for the app on your device. Analytics events record that something happened, such as a workout logged or onboarding finished, and the only facts about you attached to any of them are your sex and a five year age band, on the single event that records finishing onboarding. Your birth month and year, and your exact age, are never sent. Versions of the App from before 17 September 2026 did tell the analytics tool who you were, and until 25 September 2026 asking for a copy of your data told it your account identifier; Section 7 says what that means and how it is erased.
• The analytics tool works out an approximate location, usually the country, from the network address your device connects with, as described at the end of this section.
• Exercise demonstration videos. When the App shows a demonstration video for an exercise, your phone loads it from Cloudflare, which we use to deliver them (Section 5). That request carries your device's IP address and the basic details any phone sends when it loads a video, such as its type, operating system version and language. It names only the video. It carries no account identifier, email address or health data, and we keep no record of which demonstrations you open.
• All of it is subject to your privacy choices (Section 9).

H. Health and fitness records from Apple Health or Health Connect

• If you choose to connect it, the App can read a limited set of records from Apple Health on an iPhone or from Android Health Connect on an Android phone: sleep, resting heart rate, heart rate variability, steps, active energy, body weight and workouts. For a workout that means the kind of workout, when it happened, how long it lasted and, where your phone recorded one, the distance. We ask for your explicit consent before reading any of it, on a screen of its own and separately from anything else in this policy, because it is health data. We read nothing else.
• Two separate choices, and both are yours. Your consent to us is recorded in your account with the version of the wording you were shown. The permission in your phone decides which of those records the App can reach, and you can allow some, all or none of them there. Turning that permission off stops future reads; withdrawing your consent in the App also deletes what we already imported.
• When we read. Only the last 30 days, when you open the App and when you ask it to sync. It never reads in the background and never writes anything to Apple Health or Health Connect. With each reading we keep its date and the name of the app or device that recorded it, so the next sync does not import it twice.
• What we use it for. Sleep, resting heart rate, heart rate variability, steps and active energy are shown back to you, day by day, on a readings screen under Settings, Health data sources, and today's sleep, steps and resting heart rate are also shown on your Home screen, which you can switch off on that same Settings screen. They do not change your training guidance or anything else in the App. Imported weigh-ins join your weight history: they appear on your Body and Home screens and feed the calorie target suggestions the App makes from your weight trend. Imported workouts join your activity history and, once you add how hard one felt, count toward your training load like the ones you log, and training load shapes the App's training guidance, including whether a week of a program it builds for you should be lighter. Nothing else.
• What we never do with it. We do not use it for advertising, marketing or data mining. We do not sell it or give it to data brokers, insurers or employers. We do not use it to train any artificial intelligence model. No reading or record from Apple Health or Health Connect is sent to our AI provider, our analytics provider or our crash diagnostics provider: when the App builds a program, the AI provider can be told that a week should be lighter, which is a yes or no and never a reading (Section 4), and the analytics provider is told only how many records a sync saved or skipped. Nothing we import is shown to other people in the App, including your groups. The one provider that holds it is our database host, Supabase, in Ireland, on our behalf (Section 5). We do not store it in iCloud.
• Our use of information received from Health Connect adheres to the Health Connect Permissions policy, including its Limited Use requirements. Our use of information read from Apple Health follows Apple's rules for health data in the App Store Review Guidelines.
• Watches, rings and other wearables. We are not connected directly to any wearable maker, including Garmin, Whoop and Oura. If your device writes its readings into Apple Health or Health Connect, for example through the sharing setting in Garmin Connect, we can read them from there like any others, and that is the whole of the link. Readings a maker keeps only in its own app, such as Garmin's Body Battery, never reach us.
• A reading is only as accurate as the device that took it. We do not check them. The App uses them for training and nutrition guidance only; it does not diagnose, treat or monitor any medical condition.
• Taking it back. You can withdraw at any time under Settings, Health data sources, with Disconnect and delete my health data; the Health data permissions screen under Settings, Privacy points you there. Withdrawing deletes everything we imported from Apple Health or Health Connect and keeps what you typed in yourself (Section 7). To stop access at the phone as well, turn it off in the Health app on an iPhone, or in Health Connect on Android.

I. Groups

• Groups are private training groups you create or join. Anyone using the App can find a group by its name and see its name, description and member count, and nothing else. Only its members can see who is in it and what happens inside it.
• What you share with a group. When you create a group, accept an invite or ask to join one and are let in, you agree to share your completed workouts with its members: when you trained, how long for, how many sets you did, which muscle groups you trained most, and how many personal records you set. Members also see your username and display name, whether you trained on each day of a group challenge, and group totals that include your workouts. Members can react to each other's workouts. We record this agreement in your account, with its version and a timestamp, when you take that action.
• What a group never sees. The weights you lift, the exercises you did, your nutrition, your body measurements, your cycle data, anything we read from Apple Health or Health Connect, and any other health information.
• Stopping sharing. Leave a group at any time from the group's screen and your workouts stop showing to its members. If you own the group, it passes to the member who has been in it longest, or is deleted if you are the last member. The owner can also remove members. Blocking someone does not remove either of you from a group you are both already in, so leave the group if you no longer want them to see your workouts.
• Deleting your account removes your memberships and your group activity. Groups you own pass to the member who has been in them longest, or are deleted if you are the last member.

J. Your profile, connections, blocking and reporting

• Your username. To use the App's social features you choose a username, 3 to 20 letters, numbers or underscores. You can change it once every 30 days. Some names are reserved and cannot be taken. You do not need a username to use the rest of the App.
• Who can find you. Anyone signed in to the App can search for you by your username or display name and see both. Accounts that do not have a username never appear in search. If you block someone, or they block you, neither of you appears in the other's search, profile or requests.
• Connections. A connection is always mutual: when it is made, each of you is connected to the other. Someone who wants to connect with you always sends a request that you accept or decline, whether your account is private or public. Removing a connection removes it for both of you.
• What your profile shows. Anyone signed in who opens your profile sees your username, your display name and whether your account is private. Your connections, and anyone at all if your account is public, also see the month you joined and how many connections you have. Your profile does not show your workouts, training statistics, nutrition or any health information to anyone else.
• Blocking. Blocking someone removes any connection between you, withdraws pending group invites between the two of you, and stops each of you finding or contacting the other. We do not tell the person you block. It does not remove either of you from a group you are both already in (part I). You can undo a block under Settings, Privacy, Blocked accounts.
• Reporting. You can report another user for harassment, spam, inappropriate content, impersonation or another reason, with an optional note of up to 1,000 characters, and block them in the same step. We keep the report, who made it, who it is about, where in the App it came from and, for a group, which group, so that we can review it and act on it. We do not tell the person you report who reported them. You can make up to 20 reports a day. A report is deleted if either account is deleted.
• Deleting your account removes your username, display name, connections, requests, blocks and reports in both directions.

K. Your phone's calendar

• Only if you turn it on. Phone calendar is off until you set it up under Settings, Phone calendar. It then adds your planned workouts and sport sessions for the next two weeks to a calendar on your phone and keeps them up to date as your plan changes. Each event holds the session's name, its day, its time or the whole day, a short note such as "Planned in Raava. About 50 min." and, on an iPhone, a link back into the App. A session you finish on its day has "Done:" added to its name.
• Which calendar. You choose: a new calendar called Raava that the App makes, or one of your own calendars. The App asks for your phone's calendar permission first. On an iPhone that is full access, because Apple's write-only access does not let an app change or remove an event once it has added it. On Android, a Raava calendar left on the phone from an earlier setup is replaced by the new one.
• What the App reads. The events it added itself, including anything you add to them, such as an alert or a location, so it can keep them up to date without losing your changes; the names of your calendars, so you can choose one; and the events in a Raava calendar for the next two weeks, so it never adds a session twice, for example one that another of your Apple devices already added. It never reads your other events.
• Nothing from your calendar is sent to us. The events are made on your phone from the plan already in your account, and what the App reads stays on your phone. If the calendar you choose belongs to an account such as iCloud or Google, that account copies the events to its servers and your other devices, as it does with any event you add yourself; that is between you and Apple or Google. Anyone you share that calendar with can see the events.
• Your changes stay. If you change an event's time, name or notes in your calendar, the App leaves your change as it is, and an alert or location you add stays when the App updates the event. If you delete an event, move it to another calendar or make it repeat, the App leaves it alone and does not add it again. If you move a workout to another day in the next two weeks, the App asks you, in the App, whether to move it in your plan too or put the event back.
• Turning it off. Turning Phone calendar off removes the upcoming events the App added, and if the App made the Raava calendar, deletes that calendar with the past events in it. The same happens without asking when you sign out, when you are signed out, and when you delete your account, so the next person to use the phone does not see your sessions. The setting belongs to the phone, not your account: another phone starts with it off.

L. Our website's launch list

• Only if you join it. On heyraava.com you can leave your email address to hear when Raava launches. It is saved only if you tick the box agreeing to that.
• What we keep. Your email address, the time you agreed and a reference code we create for your entry, in our database in Ireland (Section 6). Only we can read it. Joining creates no account and is not linked to one.
• What we use it for. One email when Raava launches, with the launch date and our Founder prices. We have sent nothing yet and send nothing else.
• Leaving the list. Email legal@heyraava.com and we remove your address. If you later make a Raava account with the same address, deleting the account removes it too, and a copy of your data includes it.
• How long. We keep the list until 1 January 2027 and then delete it. If you ask to leave before then, we remove your address earlier.

We do not knowingly collect precise location data, contacts, or biometric identifiers. We never ask your device for its location, and the App holds no location permission. Our analytics provider does work out an approximate location, usually the country and sometimes the region or city, from the network address your device connects with. That is an estimate drawn from the connection itself, not a reading from your phone.

---

3. Why we use your data and our legal bases

Purpose	Data used	GDPR legal basis
Provide core tracking and account features	A, B, D, E	Performance of a contract
Generate training programs and apply the safety screening and limits	A to D, including health	Contract for the service. Before a program can be generated you accept a medical disclaimer and answer the screening questions, and we record that acceptance with its version. Which Article 9 condition covers the screening answers is not settled yet (Section 1)
Estimate nutrition from a label photo or food text	E (image/text)	Performance of a contract / consent
Reproductive, pregnancy or lactation, and cycle features	C	Explicit consent (Art 9), asked before anything is saved, recorded with its version, and withdrawable under Settings, Privacy, Health data permissions. Taking it back deletes your cycle history (Section 7)
Record supplements and medication, including prescriber, pharmacy and condition treated	C	Explicit consent (Art 9) for prescription medicines, asked before the first one is saved, recorded with its version, and withdrawable in the same place. Taking it back deletes your prescription medicines and their logs (Section 7). An ordinary supplement is not a medicine and is not behind this consent
Daily readiness check ins and the recovery guidance derived from them	C	Explicit consent (Art 9), asked before the first check in is saved, recorded with its version, and withdrawable in the same place. Taking it back deletes your check ins (Section 7)
Store the weights you type in and the body measurements you record	B and C	Explicit consent (Art 9), asked before the first one is saved, recorded with its version, and withdrawable in the same place. Taking it back deletes what you typed in (Section 7). Weights that came from your phone's health platform are covered by the consent in the row below instead
Read sleep, resting heart rate, heart rate variability, steps, active energy, weight and workouts from Apple Health or Health Connect	C and H	Explicit consent (Art 9), asked on a screen of its own, recorded with its version and withdrawable in the same place
Look up a food or a supplement you searched for or scanned	E	Performance of a contract
Share your completed workouts with the members of a group you create or join	A, D, I	Consent, given when you create a group or join one, recorded with its version, and withdrawn by leaving the group (Section 2, part I). The groups themselves are a feature you ask for: performance of a contract
Your username, profile, search and connections	A, J	Performance of a contract: they are features you choose to use
Blocking and reporting other users, and reviewing reports	A, J	Legitimate interests: keeping the App safe for the people who use it, and your protection from people you do not want contact with
Add your planned sessions to your phone's calendar, if you turn it on	D, K	Performance of a contract: a feature you choose to use. The events are made and kept on your phone
Email you when Raava launches, if you join the website launch list	L	Consent, which you can withdraw by leaving the list
Keep the App secure and prevent abuse	A, G	Legitimate interests / legal obligation
Product analytics to improve the App	G	Consent where required, otherwise legitimate interests; controlled by your opt out
Crash and error diagnostics	G	Consent where required, otherwise legitimate interests; controlled by your opt out
Billing and subscriptions	A, F	Performance of a contract / legal obligation
Develop new products and services, and improve our existing services (under Mana Cores Limited)	Anonymised, aggregated data only: no user identifier, no device identifier, no free text and no exact dates. Never cycle, reproductive or pregnancy data, in any form	Our legitimate interest in improving the App. The data used no longer identifies you, and there is no fallback to identified data for this purpose
Comply with law and defend legal claims	as needed	Legal obligation / legitimate interests

We do not sell your personal data, we do not share it for advertising, and we do not use your data to train any artificial intelligence model, ours or a vendor's. We do not use your health data for advertising of any kind.

We may use data to develop new products and services and to improve our existing services under Mana Cores Limited. When we do, the data is anonymised and aggregated, always: no user identifier, no device identifier, no free text you wrote, no exact dates, and counts or averages across a group of people rather than a row about any one person. There is no fallback to identified data for this purpose, and cycle, reproductive and pregnancy data are never used for product improvement in any form. If we ever intend to use your data in a materially different way, we will tell you first and obtain your consent where the law requires it (see Section 14). We do not send your inputs to any provider to train their models (see Section 4).

---

4. AI processing (Anthropic Claude and Google Gemini)

Five features use an AI model through its maker's API. We use two AI providers, Anthropic (the Claude model) and Google (the Gemini model), and either one can handle any of the first three features. Each request goes to one of them, chosen by availability and cost, and if that one is unavailable the same request can be sent to the other so that the feature keeps working. The fourth and fifth features use Anthropic only. Both receive only what is described here.

• Nutrition label reading: when you photograph a nutrition label, the image is sent to the AI provider, which reads the panel and returns the facts for you to confirm before logging.
• Food estimation: when you type or say what you ate, the text is sent to the AI provider, which returns an estimated breakdown for you to confirm. Speech is turned into text on your phone, so audio never leaves your phone. If you choose to photograph a meal, the photo is sent instead; a photo can show people or private surroundings, so keep them out of the frame or type the meal instead. We do not keep the photo, and you review every item before anything is logged.
• Training program generation: a structured description of your training parameters, which names nobody, and an exercise menu we vetted first are sent to the AI provider, which picks exercises and writes notes in plain language. A fixed engine, not the AI, sets every safety number, and a validator on our server checks the result again. Your injuries, your screening answers, your sex, your age, your weight and your account identifier are not in what is sent.
• Filling in missing vitamins and minerals: when a food you log is missing some vitamin or mineral values, its name, brand, serving size and the nutrition values it already has are sent to the AI provider, which estimates the missing amounts. This includes foods you created yourself, so please do not put personal details in a food's name. Your account, your meals and when you ate are not sent. For a food from our shared food database, the estimates are stored on that food for everyone who logs it; for a food you created, they are stored only on your copy. So that the same food is not estimated twice, we also keep its name, brand, approximate energy and the estimates in a store only our server can read, with no link to you or anyone else. The App marks estimated values as estimated.
• Raava AI Agent (Beta): only if you agree to it in the App. The message you write is sent to Anthropic together with today's date, your time zone and the list of requests you allowed, so it can pick one of a fixed set of requests, such as showing your plan or your food totals or starting a meal entry. Your records are not sent to Anthropic; Raava reads only the categories you allowed and shows the answer in the App. Nothing is changed until you confirm. Chats are kept only in the App while it is open. We keep your agreement and the date, type and outcome of each request for 90 days, or while your agreement is active, and include them in your data export and account deletion. You can stop it at any time in the chat menu.

Anthropic. Anthropic Ireland, Limited processes these requests for us as our processor, under Anthropic's commercial terms and the data processing addendum that is part of them. Under those terms, Anthropic does not use them to train its models. It deletes them within 30 days, unless its safety systems flag a request as breaking its usage policy, in which case it may keep that request for up to 2 years.

Google. On the terms that apply to Google's paid API tier, inputs are not used to train the model, and Google keeps them only for a limited period to detect and prevent misuse. That is the tier we intend to be on. ⚠ We are confirming with Google in writing which tier our key is on and what retention and training terms attach to it, and we will say here what comes back rather than leave you to assume it.

Both providers may process these requests outside the EEA, including in the United States (see Section 6).

---

5. Who we share data with (processors and recipients)

We share personal data with service providers that process it on our behalf under contract, and as required by law. We do not sell personal data.

⚠ Adapty's hosting region is still being confirmed. We would rather name the processing and leave the region open than state one we have not verified. It is named here so the processing itself is disclosed, the detail will be completed before this policy is relied on, and any transfer outside the EEA will be covered by the safeguards in Section 6.

Resend sends our account emails. When you create an account, reset your password or change your email address, the email comes from no-reply@heyraava.com and is sent through Resend. Resend receives your email address and the message, which holds a one-time link, and nothing else from the App. We do not track whether you open the email or click its links. Our website's launch list still sends no email.

Open Food Facts and NIH DSLD are public reference databases, not services we operate. The lookup is sent from your device, so those services see your device's IP address and the term or barcode, and nothing that identifies your account. We send them no health data of any kind.

We may also disclose data to comply with law, enforce our Terms, protect rights and safety, or in connection with a merger, acquisition, or asset sale (with notice where required).

---

6. International data transfers

We are established in Ireland, so we sit under the EU rules, and our primary data store (Supabase) is hosted in the European Union, in Ireland (eu-west-1). Our analytics and error reporting providers (PostHog and Sentry) are also hosted in the European Union.

Until 24 September 2026 our primary data store was in the United Kingdom (London). We moved it to Ireland that day, and on 26 September 2026 we deleted the London database, backups included. Until then, the copy it held relied on the European Commission's adequacy decision for the United Kingdom.

Some processing takes place outside the EEA. Anthropic may process AI requests in the United States or elsewhere outside the EEA, under the Standard Contractual Clauses in its data processing addendum. Google Gemini and Expo/EAS are based in the United States, the NIH DSLD supplement label lookup is a US government service, Formspree handles our website contact form from the United States, and Google Workspace carries our business email. Cloudflare serves our website, including this policy, routes email to our published addresses and delivers the exercise demonstration videos in the App, across a global network from a company established in the United States. Resend, which sends our account emails from Ireland, is a company established in the United States.

Where personal data is transferred outside the EEA, we rely on an appropriate safeguard. Transfers to the US and elsewhere rely on Standard Contractual Clauses or an equivalent mechanism.

---

7. How long we keep data

• We keep your personal data while your account is active and as needed to provide the App.
• Some "remove" actions in the App hide a record rather than erase it. When you remove a supplement or medication from your stack, we mark it as archived and stop showing it and its reminders; the record itself, including any prescribing doctor, pharmacy and condition treated text you entered, remains stored for the life of your account so that your past adherence history stays intact. It is erased when you delete your account. You can change or clear those three fields at any time by editing the medicine, and when you remove a medicine from your stack you can choose to erase them at the same time. You can also delete your account, or email us at legal@heyraava.com and we will erase those fields for you without deleting the rest of your record.
• One thing stays on your own phone rather than on our systems. If you import a workout history from another app, your phone keeps the copy of that file it made in order to read it. Deleting your account clears the App's saved settings and any writes still waiting to be sent, and it does not clear that file. Clearing the App's storage or deleting the App removes it.
• Taking back one of the five health consents deletes what was stored under it, without touching the rest of your account. You do it under Settings, Privacy, Health data permissions, and the App tells you exactly what will go before you confirm.
  • Cycle: your cycle history and your cycle settings, and we clear whether you are pregnant or breastfeeding and switch cycle tracking off.
  • Prescription medicines: those medicines and the record of when you took them. If any medicine details are left anywhere else on an item, we clear those too. This reaches medicines you had already removed from your stack, which the ordinary remove action does not.
  • Weight and measurements: the weights you typed in and your body measurements. Weights that came from your phone's health platform are not touched here; they belong to the health platform consent below.
  • Daily check ins: all of them.
  • Apple Health or Health Connect: everything we imported from it, including weigh-ins and workouts.
  • We keep the record that you gave the consent and the record that you took it back, because that pair is how we can show what we were allowed to do and when that stopped. It holds no health data of its own.
• When you delete your account, everything you created in the App is deleted from our main database in one cascading operation: your profile, your training, nutrition, body, cycle, supplement, check in and health platform records, your consent records and your billing entitlement. One billing receipt row is kept rather than deleted, but it is emptied and your account identifier is removed from it, because the store's own event reference is what stops the same purchase being processed twice. We may also keep limited data where we must, to comply with law, resolve disputes, or enforce our agreements. If one of the deletion steps below does not finish, we keep a short record of your account identifier, when you asked, and which steps are done, so that we can finish the deletion by hand. It holds nothing else, and we delete it as soon as the deletion is finished, or after 90 days at the latest.
• Deleting your account also reaches our subscription provider, our analytics provider and, if you signed in with Apple, Apple. We ask our subscription provider to erase the profile it holds for you, and we ask our analytics provider to erase any profile it holds for you. The App stopped telling the analytics tool who you are on 17 September 2026, and asking for a copy of your data stopped telling it on 25 September 2026, so it creates no such profile today. It may still hold one made before then: a version of the App from before 17 September 2026 gave it your email address, and a request for a copy of your data before 25 September 2026 gave it your account identifier. This request is what erases it. If you signed in with Apple, we also ask Apple to end the link between your Apple ID and the App. You can end it yourself at any time in your Apple ID settings, under Sign in with Apple.
• One thing that deletion does not reach, and we would rather say so. Our crash diagnostics provider cannot delete one person's reports on their own, so the reports it holds, which carry your account identifier and no email address, are not erased when you delete your account. The provider deletes them when its retention period ends. We are confirming that period and will state it here once it is confirmed.
• Backups. Our hosting provider keeps backup copies of our database. Copies of deleted data can remain in our hosting provider's backups for up to 30 days after deletion, after which the backups holding them are overwritten. We use those backups only to restore the service after a failure. The database we used in London until 24 September 2026 was deleted, backups included, on 26 September 2026. We are still confirming how long our providers keep their service logs, and we will state that period here once it is confirmed, rather than print a number we have not verified.

---

8. Your rights and choices

Depending on where you live, you have some or all of the following rights. You can exercise many of them directly in the App, or by contacting legal@heyraava.com.

Available in the App:

• Export your data: download a copy of your data (you run it yourself).
• Delete your account: permanently delete your account and associated data (cascading deletion).
• Privacy controls: turn product analytics and crash diagnostics on or off, and manage other privacy preferences.
• Health data permissions: see each of the five health consents, when you gave it, and take any of them back. Under Settings, Privacy, Health data permissions. Taking one back deletes what was stored under it, and Section 7 says what that is for each.

On request (GDPR / UK GDPR and similar laws):

• Access, rectification, erasure, restriction of processing, data portability, and objection to processing.
• Withdraw consent at any time (including for health features and analytics), without affecting processing done before withdrawal. For the five health consents you can do this yourself in the App, and you do not need to ask us.
• Lodge a complaint with your data protection authority. Our lead supervisory authority is Ireland's Data Protection Commission (dataprotection.ie). EU/UK users can also contact their own local supervisory authority.

US state privacy rights (for example, California CCPA/CPRA):

• Right to know, access, correct, and delete personal information, and to limit the use of sensitive personal information. We do not sell or "share" personal information for advertising that follows you across other companies' services. You will not be treated worse for exercising your rights.

We respond to verified requests within the timeframes required by law.

---

9. Analytics and diagnostics choices

Product analytics (PostHog) and crash diagnostics (Sentry) are governed by your in app privacy preferences. They carry no health reading and no free text you wrote. Analytics is not told who you are: no account identifier and no email address reach it, so it holds no profile of you, only a random identifier its own software creates for the app on your device (Section 2, part G). Crash diagnostics are different, as the next paragraph explains: those do carry your account identifier. You can turn analytics and crash diagnostics off in the App's privacy settings.

One limit worth stating plainly: turning "Crash & diagnostics" off stops the App from sending error reports, but it does not stop reports generated when the App itself crashes at the operating system level. Those are produced by the crash reporting component before the App's own settings can be read. They contain a technical stack trace and your account identifier, no health data and no email. For the same reason it does not stop that component from sending a short record of each time you use the App, called a session: when it started, how long it lasted and whether it ended in a crash, with your account identifier. That identifier is pseudonymous, not anonymous: it is the same identifier your own records are keyed on, so it stands in for your name, which is why the Sentry row in Section 5 says the same thing. We accept this limit because the alternative is to delay crash reporting at every start up, which would mean losing exactly the crashes that happen while the App is opening.

---

10. Security

We use technical and organizational measures to protect personal data, including authentication, access controls, encryption in transit, restrictions applied row by row so that a signed in person reaches only their own records, and primary storage hosted in the EU (Ireland, eu-west-1), with analytics and error reporting also hosted in the EU. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your credentials safe and notify us of any suspected compromise.

---

11. If personal data is breached

We keep a record of every personal data breach: what happened, what data it touched, and what we did about it. Where a breach is likely to result in a risk to people, we notify Ireland's Data Protection Commission within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to you, we tell you without undue delay and in plain language: what happened, what it means for you, and what you can do about it.

If you think your account or your data has been exposed, write to legal@heyraava.com and tell us what you saw. We would rather hear about it twice than not at all.

---

12. Decisions the App makes automatically

Two things in the App are produced automatically rather than by a person: the training program the App generates for you, and the readiness guidance built from your daily check in. A fixed engine, not the AI model, sets every safety number, and a check on our server goes over the result again before you see it.

Workouts you import from Apple Health or Health Connect count toward your training load like the ones you log, and training load is part of what the training guidance and the programs the App builds take into account. The other readings you import, such as sleep and heart rate, change neither.

These are informational suggestions. They decide nothing legal about you and have no similarly significant effect: no price changes because of them, nothing is granted or refused, and nothing is reported about you to anyone. You are free to ignore them, and our Terms say plainly that they can be wrong. If you would like a person involved in something the App suggested, write to legal@heyraava.com.

---

13. Children and young people

The App is not directed to anyone under 18. We do not knowingly collect personal data from anyone under that age. If you believe someone under 18 has given us their data, contact legal@heyraava.com and we will delete it. You must be at least 18 to use the App. An age below 18 is rejected at sign up, in Settings, and by the database.

That is a check rather than a complete gate, and we would rather say so plainly. You cannot finish setting up the App without entering your birth month and year, so the minimum age is checked for every account. An age you enter is not verified.

---

14. Changes to this policy

We may update this Privacy Policy. If we make material changes, we will tell you at least 14 days before they take effect (for example, in the App or by email) and, where required by law, obtain your consent. The "Last updated" date shows the current version, and the version history at the end of this policy records what changed in each one.

---

15. Contact us

Questions or requests about your privacy: legal@heyraava.com

Mana Cores Limited, Suite 11341, 26/27 Upper Pembroke Street, Dublin 2, D02 X361, Ireland.

No Data Protection Officer has been appointed, and no EU or UK representative has been designated. Mana Cores Limited is established in Ireland, so no Article 27 representative is required for the EU.

---

Version history

Kept because the "Last updated" date alone tells a reader that something changed, not what. A published policy that names a controller, an erasure route and a set of processors should be able to show how each of those has moved.

Date	Version	What changed
14 October 2026	4.2	Every connection needs your approval. Part J used to say that if you switched your account to public, anyone signed in could connect with you straight away. Now someone who wants to connect with you always sends a request that you accept or decline, whether your account is private or public. Connections you already have are not changed. Nothing else changed.
13 October 2026	4.1	Who sends our account emails. The emails that confirm a new account, reset a password or confirm a change of email address now come from no-reply@heyraava.com and are sent through Resend, from Ireland. Resend receives your email address and the email itself, which holds a one-time link, and nothing else from the App, and we do not track opens or clicks. The Resend row in Section 5 and Section 6 say the same.
13 October 2026	4.0	Meal photos, spoken meals and the Raava AI Agent. Section 4 now says that food estimation also works from what you say, turned into text on your phone so audio never leaves it, or from a meal photo you choose to send, which we do not keep. A new part describes the Raava AI Agent (Beta): only with your agreement, the message you write is sent to Anthropic with the date, your time zone and the requests you allowed, your records are not sent, nothing changes until you confirm, and request details are kept for 90 days and included in export and deletion. The Anthropic row in Section 5 says the same.
13 October 2026	3.9	Filling in missing vitamins and minerals for foods you create. Section 4 now says the vitamin and mineral estimate also covers foods you created yourself: the food's name, brand, serving size and known nutrition values are sent to Anthropic, without your account, your meals or when you ate, and we ask you not to put personal details in a food's name. Estimates for your own foods stay on your copy. A store only our server can read keeps the food's name, brand, approximate energy and the estimates, with no link to anyone, so the same food is not estimated twice. The Anthropic row in Section 5 says the same.
11 October 2026	3.8	Filling in missing vitamins and minerals. Section 4 now describes a fourth AI feature: when a food in our shared food database is missing some vitamin or mineral values, its name, brand, serving size and known nutrition values are sent to Anthropic, which estimates the missing amounts. Nothing about you is sent. The estimates are stored on that food and the App marks them as estimated. The Anthropic row in Section 5 says the same.
9 October 2026	3.7	A second AI provider, Anthropic, and meal times. Section 4 now names two AI providers, Anthropic (Claude) and Google (Gemini), says that either can handle any of the three features, that a request goes to one of them chosen by availability and cost, and that it can go to the other if the first is unavailable, and says what each does with it: Anthropic does not train on it and deletes it within 30 days unless its safety systems flag it, when it may keep it for up to 2 years. Section 5 lists Anthropic, and Section 6 names it among the transfers outside the EEA. The Gemini paragraph no longer says images are not retained after processing: Google keeps paid tier inputs for a limited period to detect misuse, and the paragraph now says so. Section 2 part E now says the meals you log include their dates and times. Nothing else changed.
7 October 2026	3.6	You must now be 18, and you can now edit or clear medicine details. Section 13 now sets the minimum age at 18; it was 16. Section 7 now says you can change or clear the prescribing doctor, pharmacy and condition fields by editing the medicine, and erase them when you remove it; it used to say they could not be edited after they were added. Nothing else changed.
6 October 2026	3.5	A short record is kept when a deletion does not finish. Section 7 now says that if a deletion step does not finish, we keep your account identifier, when you asked and which steps are done, so we can finish it by hand, and delete that record when the deletion is finished or after 90 days at the latest. Nothing else changed.
6 October 2026	3.4	The website's launch list has a deletion date. Part L now says we keep the launch list until 1 January 2027 and then delete it. It used to say we kept it until you left the list or we closed it, and that we had set no closing date. Leaving earlier works as before. Nothing else changed.
4 October 2026	3.3	The website's launch list. Part L says what we keep when you join the launch list on our website, what we use it for and how to leave it. Section 3 gains the matching row, and Section 5 no longer says the list is switched off. Nothing else changed.
4 October 2026	3.2	Phone calendar. Part K says what happens when you turn on Phone calendar: which events the App adds to your phone's calendar and keeps up to date, what it reads there and what it never reads, that nothing from your calendar is sent to us, and what turning it off, signing out and deleting your account remove. Section 3 gains the matching row. Three corrections come with it. Sections 6 and 7 now say the London database was deleted, backups included, on 26 September 2026, where they said it still held a copy until 24 October 2026. Section 1 and a Section 3 row now say which Article 9 condition applies is not settled yet, where they said the question was with our lawyers. Section 9 now says that turning crash diagnostics off does not stop session records either. Nothing else changed.
4 October 2026	3.1	Club codes. Section 2 part F now says what happens when you enter a code from a sports club: we check it, record that your account can use our Founder prices, and count how many times each club's code is used, without recording which code you entered or which club you belong to. Nothing else changed.
28 September 2026	3.0	Profiles, connections, blocking and reporting. The App has let you choose a username, find other people and connect with them since July 2026, and this policy never described it. Part J now says who can find you, what your profile shows, how connections, blocking and reporting work, and what deleting your account removes. Section 3 gains the matching rows. Part D also says that a logged or imported set can record a time or a distance instead of reps. Part I now says that when you delete your account, groups you own pass to the member who has been in them longest, as they already did when you leave.
27 September 2026	2.9	Exercise demonstration videos. The App can show a short video demonstrating an exercise. Those videos are delivered by Cloudflare, which already served our website and routed our email, so it is not a new recipient, but it now also receives your device's IP address and basic device details when the App loads a video. Section 2 part G, the Cloudflare row in Section 5 and Section 6 say so. The request names only the video and carries no account identifier, email address or health data. Nothing else changed.
27 September 2026	2.8	Groups. The App has let you create and join private training groups since July 2026, and this policy never described them. Part I now says what a group's members see of your workouts and what they never see, that creating or joining a group records your agreement to that sharing, and how leaving, blocking and deleting your account affect it. Section 3 gains the matching row.
26 September 2026	2.7	Health readings on your Home screen, and syncing when you open the App. Part H now says that today's sleep, steps and resting heart rate are also shown on your Home screen, which you can switch off, and that the App reads the last 30 days when you open it as well as when you ask it to sync; it still never reads in the background. It also corrects 2.6: an imported workout counts toward your training load only once you add how hard it felt, because Apple Health and Health Connect do not record effort.
26 September 2026	2.6	Apple Health, and exactly what we do with what we read from your phone. Part H used to say that Android Health Connect was the only health platform we read and that we were not connected to Apple Health, and promised to say so here before Apple Health shipped. This is that version. The App can now read Apple Health on an iPhone as well as Health Connect on Android, and part H names the seven kinds of reading, says the App reads only when you ask it to sync and only the last 30 days, and says what each one is used for: sleep, resting heart rate, heart rate variability, steps and active energy are shown back to you on a readings screen and change nothing else in the App, imported weigh-ins join your weight history and the calorie target suggestions drawn from it, and imported workouts count toward your training load. It adds what we never do with this data, including the Health Connect Limited Use statement, that no reading goes to our AI, analytics or crash diagnostics providers, that nothing we import is shown to other people, and that we do not store it in iCloud, and it says plainly that a reading is only as accurate as the device that took it. Sections 3, 7 and 12 were brought into line with part H. As at this version nothing has been read from any phone's health platform.
25 September 2026	2.5	Our database moved from London to Ireland, and several statements about deletion and our providers were wrong. On 24 September 2026 we moved our primary database from the United Kingdom (London) to the European Union (Ireland). Sections 5, 6 and 10 now say Ireland. Section 6 no longer describes every write as a transfer out of the EEA, and says that the London database keeps a copy of the data as it stood on the day of the move, relying on the adequacy decision for the United Kingdom, until we delete it. Section 7 said four things were not reached when you delete your account. Three of them are now reached: deleting your account asks our subscription provider to erase your profile, asks our analytics provider to erase any profile it holds for you, and, if you signed in with Apple, asks Apple to end that sign in link. Section 2 now says we keep the token Apple gives us for that. That bullet also said the analytics profile carries your email address, which contradicted Section 2 of the same policy; the App stopped telling the analytics tool who you are on 17 September 2026, so only a profile made by an earlier version can carry it. Analytics: until 25 September 2026, asking for a copy of your data told the analytics tool your account identifier. It no longer does, and Sections 2 and 7 say so. Crash diagnostics: our provider cannot delete one person's reports, so Section 7 now says that, and that they are deleted when its retention period ends, in place of a promise to ask it by hand. Backups: Section 7 now gives the period, up to 30 days after deletion, and says when the London copy will be deleted. Adapty: the Section 5 row now names your device's IP address and an identifier for the app on your device, which it receives and the row left out. Nothing else changed.
18 September 2026	2.4	The App now asks for your consent before it stores each kind of sensitive health data, and lets you take each one back, so this policy stops saying that it does not. Version 2.2 admitted, and 2.3 kept, that only one health consent was recorded and that cycle data, prescription medicines, body measurements and daily check ins reached us simply because you opened the feature and typed them in. That admission was in your favour and it is now false. This version is about two things only, asking and taking back. Section 1 is rewritten to describe the five consents, how each is asked for at the moment before something is saved, that declining cancels that one save and nothing else, that each is recorded with the version of the wording you were shown, and that each can be taken back on its own. Four rows of the legal basis table in Section 3 move from "you entered it into the feature" to explicit consent, and a fifth row is added for the weights and measurements you type in, which the table had never listed separately. Section 7 gains what each withdrawal deletes, category by category, including the point that taking back the medicines consent reaches medicines you had already removed from your stack, which the ordinary remove action does not. Section 8 names where all of this lives. Nothing else changed. We are not claiming anything new about analytics, crash diagnostics, deletion of your account, our providers or transfers; those sections read exactly as they did in 2.3. ⚠ One thing this version does NOT claim: we ask when you next save, not when you look, so anything you logged before this was in the App is still there and you are not asked again in order to see it.
17 September 2026	2.3	Two changes. The App stopped telling the analytics tool who you are, so this policy had to stop saying that it does, and your birth month and year are now required. Version 2.2, written the day before, described analytics accurately as it then worked: your email address sat on a profile in the analytics tool, and some events carried a coarse fact about which features you use, such as whether you track a cycle, whether you set a mood that day, or how many injuries you had recorded. All of that has now been removed from the App. The call that identified you to the analytics tool is gone, so no account identifier and no email address reach it and it holds no profile of you. The cycle logging event was removed outright, and the mood, injury count and diet facts were removed from the events that carried them. What is left is that something happened, plus your sex and a five year age band on the single event recording that onboarding finished. ⚠ This policy therefore described MORE collection than the App performs. That is the safer direction to be wrong in and it is still wrong, which is why this version exists rather than waiting for the next change. Crash diagnostics are unchanged and still carry your account identifier, and Section 9 still says so. Separately, your birth month and year are now required. Section 13 said that entering an age is optional and that an account can be created without one. The App now asks for your birth month and year before you can finish setting up, so the minimum age of 16 is checked for every new account. Section 2 now names what we collect, a birth month and year and never the day. Both sections say plainly that accounts created before this change may hold no age at all, and that an age you enter is not verified.
16 September 2026	2.2	We were promising more than the App does, and this version says what it actually does. Section 1 used to say we process sensitive health data "only with your explicit consent", and the legal basis table claimed explicit consent for cycle features, for supplements and medication, and for daily check ins. Only one health consent is recorded today, the one for reading your phone's health platform. The rest of that data reaches us because you typed it into a feature you opened, and we now say exactly that, name the separate consent records we are still building, and stop claiming a basis we cannot evidence. Section 7 used to say deletion removes your data through a cascading deletion, full stop. The cascade is real, but it does not reach four places, and all four are now named: your profile with our analytics provider, which carries your email, our crash diagnostics provider, our subscription provider, and the Apple sign in link. The line saying backups and processor logs "are deleted on a rolling basis" was never verified by anyone, so it is gone; we now say the copies are our hosting provider's, that we are confirming the periods, and that we will print them when we have them. Section 9 called the identifier in a native crash report "opaque" while Section 5 of the same document said it is not anonymous; Section 5 was right and Section 9 now agrees. Product improvement is tightened rather than loosened: anonymised and aggregated always, with no identified fallback, and never cycle, reproductive or pregnancy data. We also say that we do not sell personal data, do not share it for advertising, and do not use your data to train any AI model. Two sections are new: what we do if personal data is breached, and what the App decides automatically. And the description of analytics is more honest, because some events carry a coarse fact about which features you use, on a profile that holds your email. ⚠ One correction to the entry below: the new part H reads from Android Health Connect only. Apple Health is not connected and is not built.
6 September 2026	2.1	What we disclose about who receives your data, and about your phone's health platform. Three recipients were missing and are now listed: Cloudflare, which serves this page and routes email to our published addresses; Formspree, which delivers our website contact form; and Google Workspace, which carries our business email. A new part H describes reading sleep, heart rate, heart rate variability, steps, active calories, weight and exercise from Android Health Connect, with your explicit consent and nothing written back; no public release has it switched on yet. We now say plainly that our analytics provider estimates an approximate location from your network address, even though the App never asks your device where it is. The Resend row changed from an unconfirmed region to what is actually true, that it is set up and has never sent anything. The Gemini row now says the food description is the text you type in your own words rather than a parameter. The Sentry row no longer calls your identifier opaque, because it is the same identifier your records are keyed on. Section 6 now names every recipient outside the EEA and states that our Irish establishment plus a UK database means a cross border transfer on every write. And a daily check in note was described as something you could write when nothing in the App asks you for one. Revised again later the same day, and kept under the same version date because the App stamps that date on consent records: part D now describes importing a training history from Strong or Hevy, which no version of this policy had ever mentioned even though the feature ships, and part H no longer offers Apple Health beside Health Connect, because Health Connect is the only health platform the App is built against and no wearable maker is connected directly. Section 7 now also says plainly that the copy of an imported file stays on your own phone and is not on our systems.
5 September 2026	2.0.1	Notes addressed to our lawyers were removed from the published text of this policy and the Terms; they were never meant to be part of either document and are now kept separately. In the Terms, the warranty disclaimer and the limitation of liability still disclaimed on behalf of MANA and were corrected to RAAVA. ⚠ Recorded here on 6 September. These changes went live on 5 September without an entry in this table and without the "Last updated" date moving, which is the thing this table exists to prevent.
1 September 2026	2.0	The product was renamed from Mana Unlimited to Raava. Trademark clearance found the MANA name unavailable across the classes covering software, training and nutrition. The controller is unchanged: Mana Cores Limited, same registration, same registered office. Contact addresses moved from @manacores.com to @heyraava.com. Separately: the Expo / EAS entry was corrected , because it disclosed over the air updates and push notifications, neither of which the app has, so no update or device tokens exist to be processed. The minimum age is now stated as 16 rather than left blank. The children and young people section states plainly that this is a check and not a complete gate, because entering an age is optional, the database CHECK was never validated against rows that already existed, and there is no verifiable parental consent route; an earlier draft of this revision claimed the minimum was enforced in the app and in the database, which overstated it. The position on a Data Protection Officer is stated explicitly rather than left as an editorial note.
6 August 2026	1.0	First published version.