Privacy – Oriveli (English)

1. Controller

Christian Hermann & Martina Hermann GbR, An Rainen 3, 72525 Münsingen, Germany; email: privacy@oriveli.app.

2. Data processed

All journal data stays on the device. Entries, symptoms, readings, medication, meals, notes, episodes, profile, drafts, reminders and settings are stored locally, encrypted with AES-256-GCM. The key is held in the device key store (Android Keystore or the iOS keychain, bound to this device) and never leaves the device. There is no account, no registration and no cloud sync. The only exception is the optional cloud backup with Plus: if you set it up, an end-to-end encrypted copy that we cannot read is also kept on our server (section 12). Android system backup and device transfer are switched off for Oriveli, and on iOS the app files are excluded from the device backup.

Two small stores sit outside that encryption because the operating system has to read them while the app is closed. The queue for medication confirmations tapped in a notification holds only the reminder id, the planned time and the time of the tap – neither a medication name nor a symptom, reading or note. As shipped, the home screen widget store holds only the recent days on which you logged something and the widget’s labels. If you switch on “Show values in the widget”, today’s most important value and that one field’s daily values for the last week are added; those values are then visible on the home screen to anyone who sees it, never on the lock screen. Switching it off or “Delete all data” removes them again.

If you switch on the import from Health Connect (Android) or Apple Health (iOS), Oriveli reads only the data types you release individually: sleep duration, resting heart rate, steps, weight, blood pressure and oxygen saturation. The operating system is asked for each data type separately, and everything is off as shipped. Oriveli only reads and never writes anything back; at most the last 30 days are read. The values are stored encrypted on the device like your own entries; we do not receive them; only if you start an AI analysis can summary figures from them be part of the summary (see below). You can switch the import off in the app and withdraw the permission in Health Connect or in the iOS settings under Health. Entries already imported remain until you delete them in the history.

Weather and pollen stay off until you switch them on. You pick the place yourself from a list shipped inside the app; that search runs entirely on the device and sends nothing. Oriveli requests no location permission. While the feature is on, the place rounded to 0.1 degrees – roughly 10 kilometres – goes to MET Norway in Norway at most once a day, together with an identification of the app consisting of name, version and a contact address, as that service’s terms require. The pollen file of the German weather service is fetched as a whole and without any location; the device works out the pollen region itself, and pollen values exist only for regions in Germany. As with any network request, your IP address is technically visible to both. No health information and no identifier is transmitted. If you switch the feature off, nothing is sent any more and the stored place is forgotten.

For purchase, restoration and the AI analysis quota, the app creates a random guest identifier and keeps it in the device key store. It holds no name and no email address and is not an advertising or manufacturer device ID, but it is a pseudonymous identifier within the meaning of the GDPR, because our server uses it to link the purchase and the counters to your device. Together with the store platform, the product ID and the store receipt it is sent to our AppCore backend so that the subscription can be verified and the entitlement stored. The guest identifier remains for purchase verification and restoration; we delete it on request to privacy@oriveli.app. We delete the AI analysis counters on our server immediately when you use “Delete all data”, and otherwise after 13 months.

Only if you have agreed to the usage statistics without an identifier (section 13), during purchase and restoration the app also sends fixed technical events to the same backend: event name, flow step, fixed error reason, platform, app version and product ID. They help us spot abandoned or failed purchases. No health information is included. With the same consent the usage statistics (section 13) count that you tapped the buy button or completed a purchase, there together with the installation channel. Without consent these events are not sent; the receipt check and the guest session for the purchase itself are not affected.

An AI analysis only transfers data after you have given explicit consent and confirmed that single request after a preview. The preview shows the content of the statements that are sent; technical details are sent in addition and are not shown in it: running entry numbers and labels. If the packet does not match the confirmed preview, the app aborts. Our AppCore backend receives: period, selected areas and field labels, the fact sentences formed on your device, help texts, entry identifiers and, for each entry, its calendar day (checked there only). Of this, Anthropic receives the labels, the complete fact sentences, the help texts and running entry numbers; our server removes the calendar days of the entries beforehand. The fact sentences contain the period, names of fields and areas (including conditions), counts of values and days, days without an entry, source labels such as “Health Connect”, units and, for the “connections” comparison, the number of days per group, mean, median, lowest and highest value (real measurements of yours), the difference and the length of the compared period. Note texts, photos, custom fields, name, email address, location and purchase data are not sent. Medication, meals, notes and sensitive areas are excluded by default; if you include them, the name and number of entries go along; for number fields you have included (sensitive ones too, such as pain during sex), the name of the field, the count, the mean, the median, the lowest and the highest value and the comparison groups go along as well, never the text of a note. The comparison itself is computed on the device; the model only selects from the finished sentences, and the app shows only those sentences.

Reminders and medication reminders are scheduled solely by the operating system on the device. Nothing is sent to a server for this. As shipped the text names neither a condition nor a medication, because it can appear on a lock screen; medication names show only if you switch that on explicitly. Tapping “Taken” in the notification creates an entry in the encrypted journal. As shipped, the home screen widget shows only whether and on how many days you logged, and no health value; it shows values only if you switch that on explicitly. With “Same as yesterday” in the notification or the widget you repeat yesterday’s daily check on the device, without anything being sent. The automatic insights “What Oriveli sees so far” are also computed entirely on the device. The suggestion cards on “Today” are produced entirely on the device by comparing fixed keyword lists with your own notes; nothing is sent in the process.

The PDF doctor report, the CSV and text export and the backup are produced on the device; no server is involved. You decide through the share sheet where the file goes. The backup is encrypted with your own passphrase (PBKDF2-HMAC-SHA256 with 600,000 iterations, AES-256-GCM); without that passphrase nobody can open it, including us. The report and the CSV export are deliberately unencrypted so that a practice can read them – treat them like a medical document. Values imported from Health Connect or Apple Health and the stored weather and pollen values are ordinary entries and are therefore included as far as they fall inside the chosen period and area. The PDF report carries the notice that Oriveli is not a medical device, that the report is not a diagnosis and that it does not replace a medical assessment; its footer reads “self-recorded, not a diagnosis”. The optional cloud backup with Plus is described in section 12.

The app contains no advertising, no third-party tracking or analytics SDKs, no advertising tracking and no usage profile. Usage statistics without an identifier run only after your consent and exclusively through our own backend, without any account, guest or device identifier and without health information (section 13). We build no profiles about you, sell no personal data and pass no health information to ad networks or data brokers.

3. Purposes and legal bases

The journal features run on the device; we process no data for you there. The same applies to values from Health Connect or Apple Health: they are read and stored by your device alone. Purchase, restoration and subscription entitlement are processed to perform the contract (Article 6(1)(b) GDPR). The guest session with a pseudonymous identifier and the quota counters serve security, abuse prevention and correct operation (Article 6(1)(f) GDPR). We store the cloud backup only if you set it up with Plus and explicitly consent when doing so, because it contains health information (encrypted) (Article 9(2)(a) in conjunction with Article 6(1)(a) GDPR); you can withdraw that consent at any time under Settings › Data › Cloud backup, with or without deleting the backup. We send the usage statistics without an identifier and the fixed purchase events (flow step, error reason) only with your consent (section 25(1) of the German TDDDG, Article 6(1)(a) GDPR), which you give at the question in the first run or in the settings and can withdraw at any time with effect for the future (details in section 13). Weather and pollen are only fetched if you switch the feature on; the basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by switching it off. The AI analysis processes health information and happens solely on the basis of your explicit consent (Article 9(2)(a) in conjunction with Article 6(1)(a) GDPR), which you give before the first analysis and can withdraw at any time with effect for the future under Settings › Privacy › AI analysis; processing carried out until then remains lawful. Buying Plus does not depend on this consent. Without these consents, every other feature keeps working.

4. Recipients and service providers

We use Cloudflare for our AppCore backend in the EU. It runs the guest session with a pseudonymous identifier, the store receipt check, the AI analysis quota and the forwarding of a confirmed analysis. To select the sentences we use Claude (model Claude Sonnet 5.5) from Anthropic; the recipient is Anthropic Ireland, Limited (Ireland) as our processor, and the processing takes place, depending on load, in various countries worldwide, including the USA and therefore outside the EEA. If you switch weather and pollen on, the app contacts the Norwegian Meteorological Institute (MET Norway, api.met.no) and the German weather service (opendata.dwd.de); MET Norway receives the rounded place, the DWD no location at all, and neither receives any health information. Apple and Google handle purchase and payment as independent providers. Health Connect and Apple Health are services of your operating system; the values read there stay on the device and never reach us – except as summary figures in an AI analysis that you start yourself. Cloudflare also holds, only after your consent, the counting events of the usage statistics without an identifier and, if you set it up, the end-to-end encrypted cloud backup (Cloudflare R2 storage located in the EU); Cloudflare processes this data as our processor and can no more read the backup than we can. We use no ad networks, data brokers or third-party analytics services.

5. International transfers

Our backend runs on Cloudflare in the EU; the cloud backup is kept in Cloudflare R2 storage located in the EU. MET Norway is based in Norway and the German weather service in Germany; both are inside the European Economic Area, so no third-country transfer takes place. Only the AI summary you confirmed is transferred to Anthropic, namely to Anthropic Ireland, Limited as our processor (Article 28 GDPR; data processing agreement as part of Anthropic’s Commercial Terms). The processing takes place, depending on load and the speed requested, in various countries worldwide, including the USA and therefore outside the EEA, by Anthropic, PBC and its sub-processors (list: trust.anthropic.com/subprocessors). Anthropic is not certified under the EU-US Data Privacy Framework. We therefore base the transfer on the EU Standard Contractual Clauses, which apply to the extent required under Anthropic’s data processing agreement, and additionally on your explicit consent. You can get a copy of the clauses and the agreement on request at privacy@oriveli.app; the agreement text is also available at anthropic.com/legal/data-processing-addendum. These countries, including the USA, do not offer a level of protection equivalent to EU law; authorities may be able to access data. Anthropic does not use the data for training. Without consent no transfer to a third country takes place.

6. Advertising and tracking

The app contains no advertising, no third-party tracking or analytics SDKs and no advertising tracking. Usage statistics without an identifier run only after your consent and exclusively through our own backend, without any account, guest or device identifier and without health information; the recipient is Cloudflare as our processor (EU), and your IP address is processed technically in the process but not stored (section 13). We do not build advertising profiles, do not sell personal data and pass no health information to ad networks or data brokers.

7. Retention and security

Local data stays on the device until you delete it in the app or through system settings. Cached weather data older than 48 hours is discarded by the app itself. Our server stores AI packets, questions and results nowhere and writes them to no log; only usage and cost counters without content are kept. Anthropic automatically deletes inputs and outputs of the AI analysis within 30 days; if Anthropic’s automatic safety check classifies a request as a possible violation of its usage rules, they may be kept for up to 2 years (classification results up to 7 years), and longer where the law requires it. We delete the daily counters of the AI analyses immediately on “Delete all data” and otherwise after 13 months. We keep the guest identifier and the subscription entitlement for as long as they are needed for purchase verification, restoration, abuse prevention and statutory evidence; we delete them on request. All transfers are encrypted in transit, local journal data with AES-256-GCM. We keep a cloud backup as its newest version plus one previous version until you delete it, at the latest until 18 months after its last update. Individual counting events of the usage statistics and the fixed purchase events are deleted after 7 days, daily counts derived from them after 120 days at the most.

8. Delete data and account

“Delete all data” in the settings removes entries, profile, drafts, reminders, settings, the backup and export files inside the app and the key on the device; anything left over is then unreadable. Scheduled reminders are cancelled, the queue of medication confirmations is emptied and the home screen widget forgets the day of the last check-in. “Delete all data” also deletes the AI counters on our server immediately (if there is no connection, the app repeats the deletion at the next start). The pseudonymous guest identifier remains for purchase verification; we delete it on request to privacy@oriveli.app. Analyses held by Anthropic are deleted by Anthropic automatically after the period stated above. There is no account that would have to be deleted. Files you already shared stay where you saved them. For requests about the guest session with a pseudonymous identifier or the subscription entitlement, email privacy@oriveli.app and include the platform and the approximate purchase date so that we can locate the record. The subscription itself is managed at Apple or Google. “Delete all data” also deletes a cloud backup you set up, including its previous version, on the server. If that fails for lack of a connection, you can delete it later with your recovery code; otherwise we delete it automatically after 18 months. Because we can only find a cloud backup through the identifier derived from the code, we do not search for it ourselves without the code; delete it in the app with “Delete cloud backup” (no code needed) or email privacy@oriveli.app with the platform and the approximate time of the last backup, and never email us the code or the passphrase (section 12). The counting events of the usage statistics carry no identifier and therefore cannot be linked to any person (section 13).

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI Baden-Württemberg). You can withdraw a consent at any time with effect for the future: AI analyses under Settings › Privacy › AI analysis, the cloud backup under Settings › Data › Cloud backup (with or without deleting the backup), the usage statistics with the switch in the settings. The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to object (Article 21 GDPR): Where we process data on the basis of legitimate interests (Article 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. To do so, write to privacy@oriveli.app.

10. Health Connect and Apple Health

Oriveli uses values from Health Connect and Apple Health solely for the features you switched on yourself: recording, showing and reviewing your values in your own journal on this device. In doing so we comply with the Limited Use requirements for Health Connect permissions on Google Play and with Apple’s rules for HealthKit.

Concretely: we do not transfer these values to our servers or to third parties – with one exception: if, after your consent, you start an AI analysis, the summary can contain counts and, for comparisons, summary figures (mean, median, lowest and highest value) of such values (section 2). We do not use them for advertising, marketing or resale, never to train AI models, and do not pass them to data brokers, information services, insurers or employers. Nobody here reads individual values; they are technically inaccessible to us. Oriveli only reads and writes nothing back to Health Connect or Apple Health.

If imported values become part of an AI analysis, that happens only when you confirm that analysis individually, and only the summarised information described in section 2 is transferred. You can withdraw the release per data type at any time: in the app with the respective switch and in the system through Health Connect or the iOS settings under Health.

11. Sources and licences

Weather: based on data from MET Norway (CC BY 4.0), combined into daily means. Pollen forecast index and pollen regions: Quelle: Deutscher Wetterdienst (CC BY 4.0). Place list: GeoNames (CC BY 4.0).

This information supports your own observation. These are forecast and index values for a region, not a measurement at your location, and we do not verify their accuracy.

12. Cloud backup (Plus)

The cloud backup stays off until you set it up with Oriveli Plus under Settings › Data › Cloud backup. You choose a passphrase and receive a recovery code of 128 random bits that only you know. From both, your device derives the key (PBKDF2-HMAC-SHA256 with 600,000 iterations and HKDF-SHA256) and encrypts your journal with AES-256-GCM before it leaves the device. The passphrase, the code and the key are never sent to us. After that the app backs up automatically at most once a day when something has changed.

Our server (AppCore on Cloudflare, stored in Cloudflare R2 located in the EU) holds only the encrypted backup document, the SHA-256 hashes of the backup id and the upload secret derived from the code, and the size and times of the backup. With every transfer the server technically processes your IP address and your guest session (abuse protection, check whether Plus is active). The IP address is used only briefly, as a peppered hash, to limit the number of requests and is not stored with the backup. For abuse protection we also count how many new backups a guest session or IP address sets up (each only as a peppered hash); that counter is not assigned to any backup and is deleted after 30 days. We cannot read the content of the backup.

The newest version and one previous version are kept. You can delete the backup in the app at any time, also with the code from another device; it and its previous version are then removed from the server immediately. “Delete all data” deletes it too. If Plus ends, no new versions are backed up; the existing backup stays retrievable and deletable. We automatically delete a backup that has not been updated for 18 months. If you revoke the consent without deleting, this device no longer backs up anything; the copy on the server stays until you delete it and is deleted automatically at the latest 18 months after its last update.

Your rights of access, rectification, erasure, restriction and data portability apply here too. In the app, under Settings › Data › Cloud backup, you can see whether and when the last backup was made and delete the backup there with “Delete cloud backup”, immediately and free of charge; this is the simplest route to access and erasure and needs no code. Because we can only find a backup through the identifier derived from the recovery code, we cannot search for it ourselves without the code (Article 11 GDPR). You can still write to privacy@oriveli.app and give the platform and the approximate time of the last backup; we will then check whether we can match the backup from those details. Never email us the recovery code or the passphrase; anyone who knows them can read the backup. If the code or the passphrase is lost, nobody can restore the backup, including us.

The legal basis is your explicit consent (Article 9(2)(a) in conjunction with Article 6(1)(a) GDPR), because the encrypted backup contains health information. You give it in a separate dialog when you set up the cloud backup (“Consent for the cloud backup”); without it no backup is made and all other features remain usable, including Plus. The backup exists only if you set it up yourself. You can withdraw the consent at any time with effect for the future under Settings › Data › Cloud backup with “Revoke consent” and then choose “Only revoke” (this device no longer backs up anything; the copy on the server stays until you delete it, at the latest 18 months after its last update) or “Revoke and delete backup” (the copy and its previous version are deleted from the server at the same time, always free of charge). Processing carried out until then remains lawful.

13. Usage statistics without an identifier

So that we can see which steps in Oriveli work and where people get stuck, the app sends fixed counting events to our own AppCore backend on Cloudflare in the EU (Cloudflare is our processor for this). No third-party tracking or analytics SDKs are involved. The statistics are off as shipped. They run only if you choose “Yes, count” at the question in the first run or switch them on yourself under Settings › Privacy › “Usage statistics without ID”. You can switch them off there at any time; after that the app sends none of these events and stops counting on the device as well. Without your consent the installation channel is not sent either. The switch also covers the fixed technical purchase events from section 2; the receipt check and the guest session for the purchase itself are not affected.

Only the fact that a step happened is counted: onboarding started and completed, something saved on a first, second and third day, the app opened on a later day or from the seventh day on, Plus invitation shown, Plus page opened, buy button tapped and purchase completed (each with the place the Plus page was opened from, such as the introduction; restoring a purchase is not counted), report shared, cloud backup set up, daily reminder switched on or off, the outcome of a rating request and the app’s start time in coarse steps. Platform, app version, language, whether it is a development build and the installation channel as a single fixed word (store, sandbox, testflight, sideload, prelaunch, debug or unknown) are sent along. To get it, the app checks locally which package installed it (Android) or what kind of receipt is present (iOS); only the word leaves the device, no device identifier. This keeps test runs by Google and Apple, development builds and test purchases out of the numbers for real use.

Entries, values, goals, symptoms, conditions, modules, medications or notes are never sent, and neither is any account, guest or device identifier. Your IP address is processed technically when the connection is made but not stored; it is only briefly hashed with a pepper to limit the number of requests. Individual events are deleted after 7 days, aggregated daily counts after 120 days at the most. Because the events carry no identifier, we cannot link them to any person; access to individual events or their targeted erasure is therefore not possible (Article 11 GDPR).

The legal basis is your consent (section 25(1) of the German TDDDG, the national implementation of Article 5(3) of the ePrivacy Directive, and Article 6(1)(a) GDPR). You give it voluntarily with “Yes, count” or with the switch in the settings and can withdraw it there at any time with effect for the future (Article 7(3) GDPR); processing carried out until then remains lawful, and withdrawing is as easy as giving it. With “No, thanks” or without an answer the statistics stay off and every feature of the app remains available unchanged.

Privacy when visiting this website

These additional notices apply to oriveli.app; the other sections describe the app. The controller is Christian Hermann & Martina Hermann GbR, identified above (privacy@oriveli.app).

We use Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, to host and protect this website. When pages and media are requested, Cloudflare processes the IP address, time, requested URL, HTTP status and browser and device information. The purposes are content delivery, troubleshooting and attack prevention. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website.

We use Umami to measure reach. The software runs exclusively on a server we operate in Frankfurt am Main, Germany (analytics.bitbeans.de); the data is not shared with third parties and is not combined across websites. We process the page visited, the referrer, the country of origin, device type, screen size, browser and operating system. We also count clicks on the App Store and Google Play buttons; only the store and the app concerned are transmitted, nothing about you personally. Umami sets no cookies and places no identifier on your device; visits are distinguished by a daily rotating, non-reversible hash value, and the IP address itself is not stored. No user profiles are created and no link to accounts is made. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the statistical evaluation of website use in order to improve what we offer. You may object to this processing at any time at privacy@oriveli.app. The measurement data is deleted after 14 months.

The analytics server runs in a data center of our hosting provider OVHcloud in Frankfurt am Main, Germany. OVHcloud acts as a processor and exclusively within the EU; the measurement data is not transferred to third countries. If your browser sends the “Do Not Track” signal, the visit is not measured. Independently of that, you can object to the reach measurement informally at any time at privacy@oriveli.app. The measurement is not required in order to use the website and has no effect on content or features.

Links to app stores and social networks connect to the provider only when opened. Depending on security checks, Cloudflare may use technically necessary cookies to prevent bots and attacks. Access to the device that is strictly necessary for this purpose is based on Section 25(2)(2) TDDDG.

Technical access data is processed only as long as necessary for delivery, troubleshooting and security, then deleted or anonymised unless statutory retention obligations apply. Cloudflare may process data in the United States. Further information about Cloudflare, international transfers and privacy rights is provided in the other sections and the provider information linked below.

Cloudflare: Privacy Policy · Data Processing Addendum