Privacy Policy

Version 1.0 · Effective 7 November 2026

This Privacy Policy explains how we handle personal data when you visit edeeva.io, join the Edeeva waitlist or use the Edeeva app. Edeeva gives you health information. It does not diagnose, treat or replace a doctor.

The short version

• Your health data is used only to give you Edeeva, and only after you explicitly consent to it.
• We never sell your data. No advertisers, no data brokers, no exceptions. We make money from subscriptions.
• Your data is encrypted in transit and at rest.
• You can ask to see, export or delete your data at any time.
• This website uses no advertising or tracking cookies.

Who we are

Edeeva is a product of QSX SOFTWARE DOO NOVI SAD, a company registered in Serbia, which is the controller of your personal data.

• Address: Milutina Bojića 2, Novi Sad, Serbia
• Company registration number: 21677400
• Tax ID: 112452808
• Email: hello@edeeva.io

What we collect

When you visit this website

• Technical data that every website receives: your IP address, browser, device type and the pages you request. Our hosting provider processes it to deliver pages and keep the site secure.
• Anonymous usage statistics: page views, the site that referred you, your country and device type, counted without cookies and without identifying you.

When you join the waitlist

• Your email address, to save your spot and to write to you about Edeeva.
• Your referral details: the invite link you arrived with, if any, the personal invite link we create for you, how many people joined through it and your place on the list.
• Spam protection signals: when you submit the form, Cloudflare Turnstile checks your browser and IP address to tell people from bots.
• A keyed hash of your IP address, to limit how many sign-ups come from one connection. It cannot be turned back into your address, and we delete it after one day.

When you use the app

• Account: your email address and an account ID. If you sign in with Apple or Google, they share your name and email address with us.
• Profile: your name and, if you add one, a profile photo.
• Health profile: your age, sex, height, weight and main goal, and the medications and supplements you list.
• Lab results: the reports you upload, as PDFs or photos, and the values read from them. Photos are stored without their metadata, such as location.
• Connected health data: if you connect Apple Health or Health Connect, the data you choose to share, such as sleep, activity, heart rate and blood pressure.
• Daily check-ins: your mood, stress, energy and any note you write.
• Questions to Edeeva's AI, when you use AI features (see below).
• Purchases, once paid plans exist: what you bought, linked to your account.
• Crash reports: when the app crashes, a report of what went wrong, linked to your account ID. It is scrubbed on your device first, so it holds no health data, request contents, email addresses or screenshots.
• Notification token, once notifications launch: an identifier for your device, so we can deliver them.

Why we use it, and on what legal basis

• To give you Edeeva, as our contract with you: your account, your profile and the app's features.
• To process your health data, with your explicit consent (GDPR Article 9(2)(a) and the matching provision of the Serbian Law on Personal Data Protection). You give it with a separate box in the app, never pre-ticked. Without it, Edeeva stores and processes no health data.
• To keep you on the waitlist and send you updates, with your consent, which you give by joining. You can leave at any time.
• To keep Edeeva secure and working, as our legitimate interest: spam protection, crash reports and anonymous website statistics.
• To prove what you agreed to, as a legal obligation and our legitimate interest: we keep a record of each version of these documents you accepted, and when.

AI features

Edeeva reaches its AI models through OpenRouter, an AI gateway. When you use an AI feature, what you send goes to OpenRouter and on to the company whose model answers, which processes it to produce the reply. Your name, email address and account ID are not sent.

Every AI feature asks for your permission before it sends anything, and you can withdraw that permission in your profile at any time. We do not use your health data to train AI models.

Who we share it with

We share personal data only with the companies that run parts of Edeeva for us, under contracts that let them use it for that purpose alone:

• Supabase: sign-in, database and file storage.
• Amazon Web Services (AWS): runs the Edeeva service.
• Vercel: hosts this website and counts its anonymous statistics.
• Neon: stores the waitlist.
• Resend: delivers our emails.
• Cloudflare: protects the waitlist form from spam.
• OpenRouter and the AI model providers: only when you use AI features.
• Sentry: receives crash reports.
• RevenueCat: handles purchases, once paid plans launch.
• OneSignal: delivers notifications, once they launch.
• Apple and Google: if you sign in with them or connect Apple Health or Health Connect.

We do not sell personal data or share it for advertising. We disclose it to authorities only when the law requires it.

International transfers

Some of these companies process data outside Serbia and the European Economic Area, mainly in the United States. Where they do, we rely on the safeguards the law provides, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

How long we keep it

• Your account and health data: until you delete your account. Deleted data leaves our backups within 30 days.
• Records of your consents and acceptances: five years after your account is deleted, as proof of what you agreed to and when.
• Waitlist entries: until you leave the list, or 12 months after Edeeva launches publicly, whichever comes first.
• Crash reports: up to 90 days.
• Website statistics: kept only as anonymous totals.

Your rights

You have the right to access your data, correct it, delete it, receive it in a portable format, restrict or object to how we use it, and withdraw your consent at any time. Withdrawing consent does not affect what we did before you withdrew it.

To use these rights, email hello@edeeva.io. We answer within one month.

You can complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection, or to the data protection authority where you live, work or think your rights were infringed.

If you live in the United States, you have rights under your state's privacy laws, including the right to know what we collect, to delete it and to correct it. We do not sell personal data or share it for cross-context behavioral advertising.

How we protect it

Your data is encrypted in transit and at rest, and access to it is limited to the people who need it to run Edeeva.

Edeeva is not a healthcare provider, so the US HIPAA rules generally do not apply to it. We still protect your health data with care.

Children

Edeeva is for adults. You must be at least 18 to join the waitlist or use the app, and we do not knowingly collect data from anyone younger.

Cookies

This website sets no cookies for statistics or advertising.

Changes to this policy

When we change this policy, we publish the new version here with a new version number and effective date. If a change affects what you agreed to, the app asks you to accept the new version before you continue.

Contact

QSX SOFTWARE DOO NOVI SAD, Milutina Bojića 2, Novi Sad, Serbia, hello@edeeva.io.