Skip to content

Draft for review — not yet reviewed by a lawyer.

Privacy policy

Effective 22 October 2026 · Last updated 22 October 2026

This policy explains what information YadaVia collects, why, who it’s shared with and the choices you have. It covers the YadaVia website (www.yadavia.com), the YadaVia app at app.yadavia.com and the YadaVia Android app. We’ve tried to write it plainly. If anything is unclear, email privacy@yadavia.com.

1. Beta: no real patient health information yet

YadaVia is in beta. Clinics should not put real patients’ health records into YadaVia until a business associate agreement (the contract HIPAA requires) is signed between the clinic and YadaVia, and YadaVia has the same kind of agreement with each service provider that would handle that information. Until then, the patient records clinics keep in YadaVia (for example in Outcomes, Care management and Journeys) are made-up test data.

Some personal wellbeing features are already used by real people for themselves, mostly clinic staff in early beta: for example step counts, breathing sessions, a private journal and training logs. That information is about you, is entered or synced by you, and is handled as described below.

2. Clinics and YadaVia

Clinics use YadaVia to work with their patients, members and teams. For the records a clinic keeps about its patients, the clinic is in charge (the “controller”, and under HIPAA the covered entity). YadaVia processes that information on the clinic’s behalf and only to provide the service to the clinic. If you’re a patient and want to see, correct or delete what your clinic keeps, contact your clinic first; we’ll help them respond.

Some features are personal: your own breathing sessions, journal, training data, connected devices and Health Connect values. These belong to you. Your clinic doesn’t see them unless you choose to share something (for example a progress report or a journal entry).

3. What we collect

  • Account details: your name, email address, role and clinic; a hashed (scrambled) password; and two-step sign-in settings if you turn them on.
  • What clinics and teams create: education resources, screen playlists, events, programs, team notes, messages and similar work content.
  • Records a clinic keeps about people it serves: such as program progress, check-in answers and outcome measures (test data only during the beta; see section 1).
  • Answers you send through a link: when a clinic sends you a check-in, survey or registration link, we store what you submit. Event registration asks for your name and email.
  • Your own wellbeing data: steps, breathing sessions, journal entries, training logs and files you import (for example a Garmin .fit file). Imported files are read in your browser and only the values needed are saved.
  • Video messages: the video, and a written transcript of its audio (see section 7).
  • Technical information: basic request logs kept by our hosting provider (such as IP address, browser type and time), a sign-in cookie, and, if you turn them on, a push-notification subscription for your device. When someone opens a clinic’s QR code link we count the visit per day; we don’t build a profile of the person.

The website you’re reading collects nothing beyond the hosting provider’s standard request logs.

4. Health Connect (YadaVia Android app)

The YadaVia Android app can read data from Health Connect, Android’s on-phone health data store, only after you allow each type on Android’s permission screen.

What we read, and why

  • Steps: your daily total for Everyday steps and the steps challenges you’ve joined, shown there the way you chose when you joined (for example a nickname on a leaderboard).
  • Weight, body fat, resting heart rate, heart rate variability and sleep: only if personal health data (Fitness → Devices) is turned on for you, as a private record for you to see your own trends.

How it’s handled

  • One number per day. Your phone works out one value per day for each type and sends it, with the name of the app it came from (for example Garmin Connect), to your own YadaVia account. Individual raw readings stay on your phone.
  • How it’s sent. The app syncs when you open it and, if you allow background access, about every three hours. It uses a device token that can only send these daily values. The token is stored scrambled, is listed in Fitness → Devices where you can remove it, and stops working if your login is turned off.
  • Who sees it. Steps appear in the step groups and challenges you joined, as described above. The other values are private to you; your clinic doesn’t see them unless you choose to share a report.
  • What we never do with it. We don’t sell Health Connect data, use it for advertising or ad targeting, share it with data brokers, or use it to decide credit, insurance or employment. We don’t use it to train AI models. It is used only to provide the features above.
  • Google’s rules. Use of information received from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements.
  • Stopping and deleting. Choose Stop syncing in YadaVia, or remove YadaVia’s access in Health Connect. You can delete stored Health Connect values in Fitness → Devices, and leave a step group with the option to erase your steps.

5. Withings and Oura

If personal health data is turned on for you, you can connect your own Withings or Oura account. You sign in with them and approve access; YadaVia then receives measurements such as weight and body composition (Withings) or sleep, heart rate variability, readiness and steps (Oura). We keep the access keys they give us so new measurements arrive by themselves. The values are private to you. You can disconnect at any time, and choose to delete the data that came from that account.

6. How we use information

  • To run YadaVia: sign you in, show you and your clinic the right information, send the messages and reminders you asked for, and keep the service secure.
  • To produce summaries for clinics. Results a clinic shows or publishes are counts and averages, and are hidden when a group is too small (generally fewer than five people) so no one can be singled out.
  • For research exports, which leave out names; where a program asks for research consent, only people who said yes are included.
  • To fix problems and improve YadaVia. We don’t use your personal or health information to train AI models.

7. AI features

  • Speech to text. Video messages are transcribed with Whisper running on Cloudflare Workers AI, so the conversation can be read and searched. The Dictate button works the same way; its audio isn’t stored.
  • Writing help. Some features can ask Anthropic’s Claude to draft or summarise text, for example drafting an education resource, summarising a team meeting, suggesting notes from a conversation, or giving feedback on a journal entry when you ask for it. Only the text needed for that request is sent, and only when someone chooses the feature. Results are suggestions that a person reviews. Under Anthropic’s commercial terms, this text isn’t used to train its models.
  • Generated audio. Clinics can generate background music or a voice guide for breathing sessions with ElevenLabs. Only the description or script written for that purpose is sent, never personal information.

8. Service providers

We use a small number of companies to run YadaVia. They may only use the information to provide their service to us.

  • Cloudflare: hosting, database and file storage, video streaming for live events, and speech to text.
  • Resend: sending email, such as event confirmations and reminders and short notices. Emails don’t include health details.
  • Anthropic: the AI writing help in section 7.
  • ElevenLabs: generated music and voice guides (no personal information).
  • Your browser’s push service (for example Google or Apple), if you turn on notifications. Our notifications are sent empty; your device then fetches the short message from YadaVia.
  • Services you or your clinic choose to connect, such as Withings, Oura or Health Connect for you, or accounting and practice tools for a clinic. Information is exchanged with them only as needed for that connection.

We may also disclose information if the law requires it, to protect people’s safety, or as part of a merger or sale of YadaVia (in which case this policy’s promises continue to apply).

9. Cookies, storage and notifications

  • One cookie. When you sign in, YadaVia sets a single sign-in cookie (regenisys-access). It can’t be read by page scripts (HttpOnly), is sent only to YadaVia, and lasts up to 8 hours. Signing out removes it.
  • No trackers. We don’t use analytics, advertising or social-media trackers, or third-party cookies. This website sets no cookies at all.
  • On your device. The app keeps some preferences and unsaved drafts in your browser’s local storage so you don’t lose your place. They stay on that device.
  • Notifications are optional. You can turn them off in the app or in your device settings; signing out offers to stop them on that device.

10. What we never do

  • We don’t sell personal information.
  • We never use identifiable or sensitive health information to target advertising.
  • Sponsored content is always labelled, and there are no ads inside questionnaires.
  • Credits and rewards are never tied to patient referrals.

11. Keeping, exporting and deleting

  • We keep information while the clinic or your account uses YadaVia, and delete it when it’s no longer needed, unless the law or the clinic’s record-keeping duties require it to be kept longer.
  • Clinic administrators can download all of their clinic’s data at any time (Settings → Download all clinic data), so a clinic is never locked in. That download leaves out passwords and keys, and people’s private personal data (such as journals, breathing, training and connected-device data).
  • Many personal items can be deleted directly in the app (for example connected-device data and step history). For anything else, ask your clinic or email privacy@yadavia.com.

12. Security

Connections are encrypted (HTTPS). Passwords, device tokens and many kinds of access link are stored scrambled (hashed). Two-step sign-in is available and clinics can require it. Access inside a clinic depends on each person’s role, and sensitive actions such as a full data download are recorded. No system is perfectly secure; if we learn of a breach affecting you, we’ll tell you and your clinic as the law requires.

13. Your choices and rights

You can ask to see, correct, download or delete your information, and to stop optional uses such as research or notifications. Depending on where you live you may have further rights under the law. For records your clinic keeps, the clinic answers the request and we help. For your own personal features, email privacy@yadavia.com. We won’t treat you differently for asking.

14. Children

YadaVia isn’t meant for children under 13 to use on their own, and we don’t knowingly collect information from them directly. A clinic may keep records about younger patients as part of their care, under the clinic’s responsibility.

15. Changes and contact

We’ll update this policy when YadaVia changes, and change the date at the top. If a change is significant we’ll tell signed-in users in the app before it takes effect.

Questions or requests: privacy@yadavia.com.