CARDIVO PRIVACY POLICY Effective date: 24 July 2026

Cardivo (“we”, “us”, “the app”) is a wellness and fitness app. It is not a medical device and must not be used to diagnose, treat, cure, or monitor disease.

Contact: [email protected] Support: [email protected]

1. Summary

• We collect the health and account data described below so you can measure, journal, sync, and see wellness insights in Cardivo. • Weekly “AI summary” insights are generated on your device from your Cardivo data. We do not send your personal or health data to a third-party generative AI provider (for example OpenAI, Google Gemini, Anthropic, or similar) to create those summaries. • If you use an account session, some data may sync to our cloud hosted by Google Firebase. • Apple Health (HealthKit) data is read or written only after you grant permission in iOS, only for the types you allow, and only to power Cardivo’s wellness features. We do not sell HealthKit data or use it for advertising or data mining.

1. What data we collect

A. Data you create in Cardivo • Camera-based wellness readings (for example heart rate / BPM, estimated blood pressure, estimated SpO₂, HRV, and related values shown in the app) • Journal entries (mood tags, notes, optional vitals, blood sugar values and context you enter yourself) • Health-plan progress and reminder preferences • Profile details you provide (for example display name, optional age and sex) • App settings (for example whether Apple Health sync is enabled, notification preferences)

B. Account and authentication data • If you continue as a guest: a technical account identifier needed to run the session • If you Sign in with Apple: identifiers and any name/email Apple shares with us based on your Apple choices • If you Sign in with Google: identifiers and basic profile information Google shares with us based on your Google choices

C. Apple Health (HealthKit) data — only if you connect Apple Health With your permission in the iOS Health permission sheet, Cardivo may: • Read: heart rate, resting heart rate, heart-rate variability (HRV / SDNN), step count, oxygen saturation (SpO₂), and body temperature • Write: heart-rate samples from Cardivo camera measurements back into Apple Health

We request only the HealthKit types needed for Cardivo’s wellness features. You can change or revoke Health access anytime in iOS Settings → Privacy & Security → Health → Cardivo (or Health → Sharing → Apps).

D. Device permissions • Camera: used only for fingertip photoplethysmography (PPG) measurements. We process the live camera signal to estimate vitals. We do not upload or permanently store raw video or photos of your finger. • Notifications: used only if you enable reminders.

E. Technical data • Basic app diagnostics needed to operate authentication and cloud sync (for example Firebase user ID and timestamps). We do not use your data for third-party advertising.

1. How we collect data

• Directly from you when you measure, journal, edit your profile, or choose settings • From the device camera during a measurement you start • From Apple Health only after you grant HealthKit permission • From Apple or Google when you choose those sign-in options • From on-device processing for weekly insight summaries (no third-party AI API call)

1. How we use data

We use your data to: • Provide measurements, journal, charts, health plans, widgets, and related wellness features • Generate on-device weekly insight / “AI summary” text from your recent Cardivo measurements and journal notes • Optionally sync your Cardivo profile, measurements, and journal across devices via our cloud • Authenticate your account (guest, Apple, or Google) • Optionally enrich on-screen wellness context with Apple Health values you allowed (for example steps or SpO₂) • Optionally write Cardivo heart-rate readings to Apple Health when Health sync is on • Respond to support or deletion requests • Comply with law where required