Privacy Policy
Last updated: September 30, 2026
1. Who we are
Vivea Woman is a wellbeing app and website for women navigating perimenopause and menopause. The data controller is Vivea Woman (Francisco Venda), Portugal. Contact for privacy matters: privacy@viveawoman.com.
2. Scope
This policy applies to the Vivea Woman mobile app (iOS and Android), the web version of the app and the public website viveawoman.com.
3. Data we collect
Account data (name, email, language and a hash-protected password); profile data (age, height, weight, country, menopause stage and goals); health data you voluntarily log (symptoms and their intensity, diary notes and wellbeing metrics such as sleep, energy, mood and stress); conversations with the Sofia assistant; subscription metadata (Stripe/RevenueCat identifiers — never your card details); support data (messages you send us); and technical data (sessions, notification tokens and security audit logs). We do not use third-party analytics or advertising SDKs.
4. Purposes and legal bases
We process your data to: provide the service and manage your account and subscription (performance of contract); show your history and reports, compute the Vivea Index, generate Sofia's personalized suggestions and prepare consultation reports (explicit consent for health data); send transactional emails such as verification and password recovery (performance of contract); and ensure security and fraud/abuse prevention (legitimate interest). We never sell your data or use it for advertising.
5. Health data (special category)
Your health data is processed only with your explicit consent (GDPR art. 9), given when you log it in the app. It is encrypted at rest (AES) in our database and transmitted over HTTPS. You may withdraw consent at any time by deleting your records or your account, or by contacting us.
6. Artificial intelligence and Sofia
The messages you send to Sofia, and the context needed to personalize them, are processed by AI model providers (currently OpenAI and, for image features, Google) under applicable data-processing arrangements. We do not use this data for advertising. Sofia does not make automated decisions with legal or similarly significant effects about you and does not replace professional medical advice.
7. Processors and third parties
Stripe (web payments — we never see your card details); Apple and Google (authentication and app-store purchases/subscriptions); RevenueCat (mobile subscription management); Resend (transactional emails); AI model providers (section 6); cloud hosting providers that operate our application and database; and an email-forwarding service (ImprovMX) for our contact addresses.
8. International transfers
Some of these providers may process data outside the European Economic Area (for example, in the USA). Where this happens, processing relies on applicable legal transfer mechanisms, such as standard contractual clauses or adequacy decisions.
9. Retention
We keep your data for as long as your account exists. When you delete your account, your app data — including health data, Sofia conversations and support requests — is deleted immediately. Security audit logs are retained for a limited period for fraud and abuse protection.
10. Your rights
You have the right of access, rectification, erasure, portability, restriction of processing, objection and withdrawal of consent. In the app: Settings → Export my data (exports your profile and your symptom and wellbeing logs) and Settings → Delete account. To exercise any right, including requests about data not included in the export, contact privacy@viveawoman.com. You also have the right to lodge a complaint with your supervisory authority — in Portugal, the CNPD.
11. Account deletion and subscriptions
Deleting your account erases your data in Vivea Woman, but it does not automatically cancel active subscriptions made through the App Store, Google Play or Stripe. You must cancel the subscription directly on the relevant platform (App Store or Google Play settings, or the billing portal for web subscriptions).
12. Security
We apply encryption at rest and in transit, secure authentication, attempt limiting, audit logging and backups. No staff member accesses your health data without a legitimate, logged reason.
13. Minors
The app is intended for users aged 18+.
14. Vivea Ambassador program
If you participate in the Vivea Ambassador referral program, we additionally process: your invitation code; the referral relationship between your account and the invited account (through internal identifiers — we never show another user's email or name); attribution dates; the verification status of the invited account's Premium purchase (by reference to the Apple/Google provider via RevenueCat, or Stripe — never card details); the 7-day validation period; and reward accounting (progress, earned, saved, active and used rewards), kept in an audit ledger. Purposes and bases: operating the program and reward accounting (performance of contract — the Program Rules); fraud and abuse prevention (legitimate interest). Referral qualification includes automated, fact-based validation (verified purchase and validation period); suspicious activity may be temporarily held for review, and you may request human review or contest a decision via support@viveawoman.com. When you delete your account, your Ambassador profile, code and rewards are deleted and referral relationships are pseudonymized; minimal pseudonymized economic records may be retained for fraud prevention and legal obligations. Your Ambassador data is included in the data export. Full rules: Vivea Ambassador Program Rules (in the app and at viveawoman.com/ambassador-rules).
15. Changes
We may update this policy; relevant changes will be announced in the app or on the website. The latest version is always available on this page.