OVARIANA App Privacy Notice
Version: OVA-LEGAL-APP-PRIVACY-EN-2026-10-25-r3
Effective date: 2026-10-25
1. Controller and contact
The controller is MEDAI sp. z o.o., ul. Prof. dr Mieczysława Michałowicza 12, 43-300 Bielsko-Biała, Poland, KRS 0000827308, NIP 5472217169, REGON 385526755.
Privacy, data-rights and account-deletion contact: privacy@ovariana.app.
privacy@ovariana.app is a privacy contact and is not described in this notice as the contact address of a Data Protection Officer. If MEDAI is required to publish the contact details of a formally designated DPO, those details will be stated in the current notice.
2. Scope
This notice applies to the OVARIANA patient web account. It does not cover the separate informational website ovariana.app or future Clinical services.
Clinical, direct in-app clinician sharing, research and predictive functions remain off in the current release.
3. Data categories
Depending on the functions used, MEDAI processes account/authentication data; profile and preference data; health data and data that may concern sex life; reports and source/completeness metadata; user-chosen Health Plan reminders; consent and legal evidence; plan/payment/billing data; correspondence; and technical/security data such as IP, request/session identifiers, timestamps and device/browser information within the actual infrastructure logging scope.
The current release does not use health data for advertising, sale of data, AI model training or scientific research.
Language data includes the expressly confirmed primary account language, interface language and report language. An additional language version also involves an order identifier, binding to an immutable source snapshot, target language, preparation and payment status, and the additional-version file. Its health content remains in the same category as the source report, rather than serving a new marketing purpose.
Commerce data may include buyer contact and billing details, customer/order/subscription identifiers, price, currency and tax, transaction-document references, and refund, dispute and transaction-support records.
4. Purposes and legal bases
Account, authentication, ordinary settings and contractual operation: Article 6(1)(b) GDPR.
Journal, reports, Health Plan and other special-category health functions: Article 6(1)(b) together with explicit consent under Article 9(2)(a).
Minimum evidence of consent/withdrawal, rights handling and legal obligations uses the applicable Article 6(1)(c) or (f) basis for the specific purpose. If a minimum retained record itself reveals special-category data, MEDAI must also have an applicable Article 9 condition; the entire journal is not retained as evidence.
Payments and Plus performance: Article 6(1)(b). Mandatory accounting/tax data: Article 6(1)(c).
Security, abuse prevention and minimised technical logging: Article 6(1)(f), taking user rights into account. Ordinary logs should not contain journal health content.
The additional language version uses the same health-content bases as the source report. Its order formation and performance, payment reconciliation, document entitlement, withdrawal, refund and transaction support use the appropriate contractual, legal-obligation or specific legitimate-interest bases described above. Health consent is not the basis for ordinary payment processing.
5. Explicit health consent
The release uses a versioned, separate health-data consent. Historical Preview consent 2026-08-1.0 is not automatically treated as release consent.
Consent is initially unchecked and separate from the Terms, the 18+ declaration and commercial declarations.
Withdrawal immediately blocks consent-dependent health functions and starts controlled erasure of data processed solely on that basis. The journal and reports are not kept active in case the user returns.
Health-consent withdrawal does not itself cancel Plus, constitute statutory contract withdrawal or erase required billing records.
6. Account deletion
Account deletion is a separate request. The controlled process includes health-data erasure, stopping future renewals and closing the authentication account.
If an external stage must be retried, the request remains recorded, health processing remains blocked and the user does not need to resubmit it.
MEDAI may retain only minimum data supported by another legal basis, including mandatory accounting/tax records, minimum evidence of rights fulfilment or evidence necessary for a specific claim. This does not permit retaining the health journal.
7. Under-18 review
Signup uses a separate 18+ declaration. A later credible indication of possible under-age status blocks health functions and creates a review state. The user may request correction and human review.
Only verified under-age status starts controlled closure. Data, correction, complaint and statutory settlement rights remain available.
8. Providers and recipients
The current architecture uses:
• Supabase for database, authentication and Storage; the current production project's core region is eu-north-1;
• Vercel for application hosting and server functions;
• Resend / Plus Five Five, Inc. for transactional email, including account confirmation; ordinary transactional messages should not contain health data;
• Stripe for payments, billing, payment portal, tax functions and fraud prevention; Stripe may act as processor or independent controller depending on the activity;
• LH.pl — separate hosting infrastructure for the independent, encrypted deletion ledger; the ledger contains no journal or report content.
• professional advisers, accounting providers and public authorities where supported by the applicable purpose and legal basis.
The current release does not send reports to clinicians through Clinical. A copy independently downloaded and sent outside the App is controlled by the independent recipient.
For purchases identified as Stripe Managed Payments, Stripe group services are used, including Sold through Link, LLC as merchant of record for the transaction. Roles depend on purpose: instructed activities may fall under processing arrangements; Stripe/Link entities may act as independent controllers for their own Link, payment, fraud-prevention, MoR, tax and compliance functions. Provider notice: https://stripe.com/privacy.
Only necessary neutral order data is supplied: technical account/order references, product/plan/price, necessary contact and billing details, amount, currency, tax, and transaction identifiers/status. Stripe/Link commerce metadata, descriptions, receipts and support payloads do not receive journal content, symptoms, Insights, measurements, Health Plan notes, report content or hashes of health sources. Identifying a language-version order does not require such content.
9. International transfers
Selecting a database region does not mean that every provider operation occurs exclusively in the EEA. Providers may use affiliates and subprocessors in other countries.
Where safeguards are required, the appropriate mechanism such as an adequacy decision or Standard Contractual Clauses applies according to the flow.
10. Retention
Consent-dependent health data is processed while the relevant functions are used. After withdrawal it enters controlled erasure without a return window, except where a specific minimum item has a separate lawful basis.
We retain evidence of consent while processing relies on that consent. After the related erasure is completed, we retain minimum evidence of consent, its withdrawal and the handling of the request for no more than three years, solely to the extent necessary to establish, exercise or defend legal claims. Unnecessary data are erased earlier. Longer retention is limited to a specific documented matter, with restricted scope and necessity review. We do not retain journal content, reports or Health Plan notes for this purpose. Contract evidence and mandatory billing records follow their own separate criteria.
Accounting and tax records are retained for periods required by applicable law.
Technical and security data is retained for the minimum period necessary for security, error handling and incident response.
Supabase makes daily database backups; standard access to daily backups on the Pro plan we use covers the last seven days. Erasure from the active database does not immediately erase an older backup. A minimum technical record in a separate encrypted LH.pl ledger helps prevent erased data from returning to active processing. It contains an account identifier, request time and erasure scope, without journal or report content; this does not automatically make it anonymous. We retain it only as long as necessary to protect copies that can actually be restored, checking completed erasure and available backups, clones and exports. We do not expire it solely by entry age. A restored environment remains isolated until required erasures have been reapplied and the source register has been checked. Database backups do not include files stored through the Storage API; erasure of those files is checked separately.
Payment for a language version creates no exception to consent withdrawal, account deletion or retention. Minimum neutral transaction evidence may be retained on a separate basis; the report is not kept merely to defend a payment. MEDAI cannot remove an independently downloaded and shared copy from an independent recipient's devices. Stripe/Link may independently retain records under their own legal obligations; deleting an OVARIANA account does not erase those records.
11. Rights
Subject to the GDPR, users have rights of access, copy, correction, erasure, restriction, portability, objection where applicable and consent withdrawal.
You may object to processing based on legitimate interests, including retention of minimum claims evidence. We assess objections under Article 21 GDPR.
Requests may be sent to privacy@ovariana.app. Where identity doubts are justified, MEDAI requests only information necessary for secure verification.
A complaint may be made to the Polish supervisory authority or the competent authority in the user's habitual-residence country.
MEDAI handles rights concerning the OVARIANA account and health data. The relevant Stripe/Link entity separately handles data for which it is controller. Where a request concerns both environments, MEDAI coordinates or routes the transaction-side action to the extent required and technically available.
12. Browser storage
The separate Cookies and Browser Storage Notice describes cookies, localStorage and sessionStorage.
13. Changes and effective date
This version applies from 25 October 2026.