How we handle your health data

Effective 9 August 2026 · Last updated 10 August 2026

1. About this policy

This Health Data Privacy Policy supplements our Privacy Policy and explains how we handle health data. Where the two documents address the same subject, this one is the more specific.

2. What counts as health data

Health data is information about your health that you provide in the app, comprising:

• the doses you record, including the amount, the medicine, the date and time, and the injection site;
• your dose schedule and dose history, which together describe how your treatment has been adjusted over time;
• your weights and body measurements;
• the symptoms you record, their severity, and any notes you add to them or to any other entry;
• the medicine you are taking and what you spend on it each month, which we treat as health data because an amount attached to a named medicine discloses something about your treatment.

This policy and the Privacy Policy refer to the above collectively as your health record.

3. Where it comes from

From you. All of it is information you choose to enter in the app. Veya does not import health data from Apple Health, Health Connect or any other app or service, and does not write data to them.

We do not purchase health data, and we do not obtain it from data brokers, advertising networks, pharmacies, prescribers or any other third party.

4. Where it is stored

On your device, in the app’s private storage, protected by the device’s file encryption. This is where the app reads and writes, which is why it works without a connection.

In your account on our servers, once you have an account. Our database is operated by Supabase and hosted in the United Kingdom (London)for all users, in every country in which Veya is available, including the United States. We do not separate storage by region. Access controls separate each account’s record from every other.

Your health record syncs once you have an account, and not before. If you use Veya without signing in, it is held on your device only. If you lose or replace your device, or delete the app, without first exporting your record, it cannot be recovered and we cannot recover it for you, because we hold no copy of it.

5. What we use it for

• Providing the app, including your history, your schedule, your reminders and your charts, and keeping your record available to you across devices.
• Supporting you where you contact us about your account or your record.
• Maintaining the app, including diagnosing faults and resolving reliability problems.
• Anonymised and aggregated analysis. We may use your record, with identifiers removed and combined with those of other users, to understand how well the app works and to publish general findings, such as the weight change or the symptoms typically recorded by people using Veya over a period. Never in a way that identifies you, and we do not attempt to re-identify information once anonymised.
• Complying with the law and responding to lawful requests.

We rely on your explicit consent under Art 9(2)(a) of the UK GDPR, together with your consent under Art 6(1)(a), to hold and use your health data in order to provide the core features of the app. You may withdraw that consent at any time. See §8.

6. What we do not use it for

We do not sell your health data, for money or for any other consideration. We do not share it for advertising or targeted advertising, and it is not used to target advertising to you. No part of your health record is provided to Meta, Google, TikTok, AppsFlyer or any other advertising or attribution provider.

We do not use it to make decisions about you. Veya records what you tell it and repeats it back. It does not recommend a dose, tell you when to inject, or interpret your results.

7. Who it is shared with

We share health data only in the following circumstances:

• Service providers required to operate the app. This is Supabase, which operates our database and authentication, permitted to use it only to provide that service to us and under a contract requiring it to protect it.
• Our product analytics provider, which receives information about your use of the app, including that an entry was recorded and the medicine type you selected, but not the content of your record. See §9.
• Support, where you contact us and the information is required to resolve your issue.
• Anonymised and aggregated information, as described in §5, which does not identify you.
• Where required by law, including a court order, subpoena or similar legal process, or where we consider disclosure necessary to protect rights, safety and security.
• A corporate transaction. If Veya is acquired, merged or reorganised, information may transfer as part of that transaction, and we will give notice where the law requires it.

Apple, Google, RevenueCat, Meta, TikTok and AppsFlyer receive no health data. What each of them does receive is set out in §7 of the Privacy Policy.

8. Your rights

You have the right to:

• confirm whether we hold health data about you, and access it;
• exportit, which the app’s settings will do on demand, including after your subscription has ended;
• correct it, which you can do in the app;
• delete it, together with a list of the parties with whom it has been shared;
• withdraw your consent to our collecting or sharing it, at any time and as easily as it was given.

Most of these can be exercised in the app’s settings. Otherwise email support@tryveya.app and we will respond within one month.

Verification and appeals. We may need to verify your identity before acting on a request, which will usually mean confirming access to the account in question. If we refuse a request we will tell you why, and you may appeal by replying to that response. If you remain dissatisfied you may complain to the Information Commissioner’s Office in the United Kingdom or, in the United States, to your state Attorney General.

What deletion means in practice. Deletion removes your health data from our live systems immediately. Copies persist in routine encrypted backups for up to 30 days before those backups are overwritten. Information that has already been anonymised and aggregated cannot be located or removed, because it is no longer linked to you.

9. Product analytics

We use a product analytics provider to understand how the app is used and whether it is working correctly. It receives information about your use of the app, such as that an entry was recorded and when, the medicine type you selected and the screens you viewed. It does not receive dose amounts, weights, measurements, symptom names, injection sites or notes.

We regard the information it does receive as health-related, which is why it is described here as well as in the Privacy Policy. §8 of the Privacy Policy sets this out in full, including your choices.

10. Children

Veya is intended for adults. It is not intended for anyone under 18 and we do not knowingly collect health data from children. If you believe a child has provided us with data, contact us and we will delete it.

11. Changes to this policy

This policy sits alongside our Privacy Policy, and the current version of each is always available at these addresses, with the effective and last-updated dates shown at the top. If we make a change that materially affects what you have consented to, we will notify you and ask you to accept the updated policy in the app, because consent to the processing of health data must be given actively and will not be inferred from your continued use.