Apps Privacy Policy identity: how Ovia collects, uses and shares personal data through the Ovia Services
This policy covers Ovuline, Inc., doing business as Ovia Health by Labcorp, a subsidiary of Labcorp, and the personal data collected through the Ovia apps, health coaching, surveys, and related social media and marketing activities, defined as the “Services”. It describes how that personal data is collected, used and shared. This is the Apps Privacy Policy, not the Non-App policy for the corporate website.
Details
Who
Ovuline, Inc., doing business as Ovia Health by Labcorp (“Ovia”), a Labcorp subsidiary
What it covers
personal data collected through the Ovia apps, health coaching, surveys, and related social media and marketing activities (the “Services”)
Supporting quotations
Ovia Health by Labcorp Apps Privacy Policy
Introduction and scope
“Policy”) describes how Ovuline, Inc., doing business as Ovia Health by Labcorp (“Ovia”) collects, uses and shares personal data
Ovia Health by Labcorp is a subsidiary of Labcorp, a global life-sciences leader.
Account & Service Control · Context
Two versions of the Services: free Consumer and paid Ovia+ (employer, health plan, provider benefit), applied separately
Different sections of this Policy apply only to Ovia’s free Consumer version and only to the enhanced paid Ovia+ versions, which are provided by employers, health plans and health care providers as a benefit. The full version of the Policy is reached with “Full Privacy Policy”, and the “Notice of Collection” is a shorter version required for California law. Combining provisions across versions without this qualifier would overstate what applies to each member.
Details not recorded for this card
Supporting quotations
Some parts of this Policy only apply to Ovia’s free consumer version of the Services, while others only apply to the enhanced paid versions provided as a benefit by employers, health plans and health care providers.
we refer to these different versions as the “Consumer” and “Ovia+” versions of the Services.
Account & Service Control · Restriction or exception
Policy does not apply to personal data collected outside the Services; business contacts covered by the Non-App Policy
The Policy is limited to personal data collected through the Services. Ovia’s Non-App Privacy Policy governs personal data collected outside that scope, such as from business contacts or through Ovia’s corporate website. Text of that linked policy was not supplied, so nothing from it is inferred here.
Details not recorded for this card
Supporting quotations
This Policy does not apply to personal data collected outside the scope of the Services.
For Ovia’s non-app Privacy Policy, which covers personal data collected by Ovia from business contacts or through our corporate website
Not stated here
The text of the linked Non-App Privacy Policy (https://connect.oviahealth.com/non-app-privacy-policy.html) is not supplied by this source; this card cannot say what that policy contains, only that it is where outside-the-Services data collection is covered.
Data Access & Collection · Context
“Personal data” defined: information that identifies you, including indirect identifiers such as IP address
The Policy defines “personal data” as information about the user that identifies them, and states it includes “direct identifiers” such as an email address as well as “indirect identifiers” that could be used to identify the person, such as the IP address and the Advertising ID of their mobile device.
Details not recorded for this card
Supporting quotations
“Personal data” means information about you that identifies you, like a name, telephone number or other bit of information that is used to tell us who you are.
Personal data includes “direct identifiers” such as your email address and also “indirect identifiers” that could be used to identify you such as the IP address and the Advertising ID of your mobile device.
Data Access & Collection · Company practice
Collects identifiers: contact details, device IDs (IP address, AdID, IDFA); Ovia+ also employer and employee ID
Row 2 of the collection table (this table has no marked header row; column labels come from the first row’s text as columnLabel) lists contact and device identifiers Ovia collects, and adds employer ID and employee ID specifically for Ovia+ members.
Details not recorded for this card
Supporting quotations
We collect the following categories of personal data in connection with our Services:
Identifiers
Name, email address, street address, postal address, mobile phone number
Device identifiers such as IP address, AdID, IDFA
For Ovia+ members, employer ID, employee ID
Personal Data We Collect
Qualifications & exceptions
Employer ID and employee ID are collected only for Ovia+ members.
Data Access & Collection · Company practice
Collects health data: fertility, pregnancy, sex-life and life-circumstance info in apps or coaching; child data
The table’s health-data row covers what the user inputs into the apps or discusses with health coaching services, adds child health and milestone information specifically in the Parenting app, and adds health insurance information for Ovia+ members. This is sensitive health data; the sensitive-information row is carded separately.
Details not recorded for this card
Supporting quotations
Date of birth, date of last period, due date, and other fertility, pregnancy, health, sex life and life circumstances information you input into the apps or discuss as part of health coaching services
In the Parenting app, health and milestone information for your child
For Ovia+ members, health insurance information
Qualifications & exceptions
Child health and milestone information is specific to the Parenting app.
Health insurance information is collected only for Ovia+ members.
Health data also comes from discussions as part of health coaching services, not only app input.
Data Access & Collection · Company practice
Collects protected classifications: race, gender, sexual orientation, pregnancy status, disability, medical condition
The collection table lists legally protected classifications as a collected category, with examples spanning race, gender, gender identity, age, ethnic group, nationality, sexual orientation, pregnancy status, disability and medical condition.
Details not recorded for this card
Supporting quotations
Legally protected classifications such as race, gender, disability or pregnancy status
Race, gender, gender identity, age, ethnic group, nationality, sexual orientation, pregnancy status, disability, medical condition
Data Access & Collection · Company practice
Treats synced wearable data as “biometric information”; states no biometric identifiers are collected
Ovia labels the sleep, health and exercise data synced from a wearable device, Apple Health or Google Health Connect to the user’s Ovia account as biometric information, while explicitly stating that it does not collect biometric identifiers such as fingerprints or voiceprints. Syncing is how that data arrives; the sync sources are carded at ovia-sources-sync-google-limited-use.
Details not recorded for this card
Supporting quotations
Sleep, health and exercise data that you sync from a wearable device, Apple Health or Google Health Connect to your Ovia account.
Ovia does not collect biometric identifiers such as fingerprints or voiceprints.
Qualifications & exceptions
Data arrives only when the user syncs a wearable device, Apple Health or Google Health Connect to their Ovia account.
Data Access & Collection · Company practice
Collects internet and app activity information and approximate geolocation (country, state, city, zipcode)
Two table rows cover online activity data and location. Geolocation is stated as approximate: country, state, city, zipcode and regional area.
Details not recorded for this card
Supporting quotations
App usage, browsing history, email opens and views
Device type, operating system, other device parameters
Approximate location by country, state, city, zipcode and regional area
Qualifications & exceptions
Geolocation is approximate (country, state, city, zipcode and regional area), not precise.
Data Access & Collection · Company practice
Collects photos and videos that the user uploads to their Ovia account
The collection table lists audio and visual information as photos and videos the user uploads to their Ovia account.
Details not recorded for this card
Supporting quotations
Photos and videos that you upload to your Ovia account
Data Access & Collection · Company practice
Collects professional and employment-related data: employment status, and name of employer for Ovia+ membership
The employment-related row states employment status generally and the name of employer in connection with Ovia+ membership.
Details not recorded for this card
Supporting quotations
Employment status, name of employer (for Ovia+ membership)
Qualifications & exceptions
Name of employer is tied to Ovia+ membership.
Inference & Profiling · Company practice
Derives inferences about the user: pregnancy trimester, fertile window, and health issues that may be relevant
The collection table’s inferences row lists pregnancy trimester, fertile window and health issues that may be relevant to the user, meaning Ovia computes or infers these from the collected data.
Details not recorded for this card
Supporting quotations
Pregnancy trimester, fertile window, health issues that may be relevant to you
Data Access & Collection · Company practice
Collects sensitive information: racial or ethnic origin, health information, sex life and sexual orientation information
The final collection-table row names sensitive information collected, consisting of racial or ethnic origin, health information, and sex life and sexual orientation information. Overlaps with the general health row are identities of collected data, not separate collection.
Details not recorded for this card
Supporting quotations
racial or ethnic origin, health information, sex life and sexual orientation information
Data Access & Collection · Company practice
Where data comes from: direct input into the apps and Services, stored in Ovia’s cloud computing environment
The sources table states Ovia collects the data users input into Ovia apps and Services and stores it in its cloud computing environment.
Details not recorded for this card
Supporting quotations
Where Do We Get the Information We Collect?
From direct input into our apps and Services
We collect the data you input into Ovia apps and Services and store it in our cloud computing environment
Data Access & Collection · Company commitment
Wearable/Apple Health/Google Health Connect sync collects only shared data; Google API Limited Use commitment
Two qualifiers matter: data from devices, Apple Health and Google Health Connect is collected only if the user syncs, and only the data they choose to share. Separately, Ovia commits that its use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements — a commitment by Ovia, not a description of Google’s policy contents.
Details not recorded for this card
Supporting quotations
If you sync a device, Apple Health or Google Health Connect with Ovia, we collect the data you choose to share
Ovia’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Qualifications & exceptions
Sync collection applies only when the user syncs the device or service with Ovia.
Only the data the user chooses to share is collected.
Not stated here
The text of the Google API Services User Data Policy is not supplied by this source; the card cannot describe what that policy or its Limited Use requirements contain, only Ovia’s stated commitment to adhere to them.
Data Access & Collection · Company practice
Receives identity data (name, DOB, employee IDs) from Ovia+ customers to verify Ovia+ service eligibility
Ovia collects the user’s communications with its care advocates and health coaches and in its Community feature as a source of personal data.
Details not recorded for this card
Supporting quotations
We collect your communications with our care advocates, health coaches and in our Community feature
Data Access & Collection · Company practice
Receives identity data (name, DOB, employee IDs) from Ovia+ customers to verify eligibility for Ovia+
Identity information for eligibility verification is supplied to Ovia by the organizations providing Ovia+ as a benefit. This is a data transfer from the employer or plan side into Ovia, not user input.
Details not recorded for this card
Supporting quotations
From our Ovia+ customers – employers, employer health plans, health insurers, providers
To verify your eligibility for Ovia+ services, we receive identity information (such as name, date of birth, employee ID numbers) from your organization
Qualifications & exceptions
Purpose limited to verifying eligibility for Ovia+ services.
Data Access & Collection · Company practice
May receive email addresses and contact information from referrals, co-promotions and list purchases
Data also arrives passively: automatically from the user’s mobile device or computer, and through cookies, tags, pixels and other tracking technologies collecting information about the user’s interaction with content and the Services generally.
Details not recorded for this card
Supporting quotations
We automatically collect from your device information such as IP address and technical identifiers
We also use cookies, tags, pixels and other tracking technologies to collect information about your interaction with content and the Services generally
Qualifications & exceptions
Tracking technologies collect interaction data about content and the Services generally.
Data Access & Collection · Company practice
Receives data the user submits through surveys
The sources table lists surveys as a source: Ovia collects data the user submits to it through surveys.
Details not recorded for this card
Supporting quotations
From surveys
We collect data you submit to us through surveys
Data Access & Collection · Company practice
May receive email addresses and contact information from referrals, co-promotions and list purchases
The sources table states Ovia may receive email addresses and contact information from referrals, co-promotions and list purchases. The modality is “may” — a possibility, not a guarantee — and the lists come from sources other than the user.
Details not recorded for this card
Supporting quotations
From friends referrals and lists purchases
We may receive email addresses and contact information from referrals, co-promotions and list purchases
Qualifications & exceptions
Stated as “may receive”: possibilities, not established receipt.
Use & Processing · Company practice
Uses personal data to provide, personalize and understand the Services; support, coaching, service emails and surveys
Core uses of personal data include providing the Services, understanding what content and ads the user views, and personalization. The stated example is hedged: if the user provides personal data indicating a certain health condition, Ovia “may” provide editorial content relevant to that condition. Health coaching depends on Ovia+ membership; service emails and survey solicitation are also stated uses.
Details not recorded for this card
Supporting quotations
Purpose of Collection and Use of Personal Data
We use your personal data to:
Provide the Services to you
Understand how you use the Services, including what content and ads you view
Personalize the Services by showing you content relevant to your health, interests and fertility, pregnancy and parenting journey
we may provide you with editorial content relevant to that condition
Provide support and troubleshooting
Provide you with health coaching if you are an Ovia+ member
Send you email communications about the Services
Solicit your participation in surveys and run surveys
Qualifications & exceptions
Health coaching is stated only for Ovia+ members.
The editorial-content example is expressed as “may”, not a guarantee.
Use & Processing · Company practice
Sends personalized data emails unless opted out in Settings; marketing subject to opt-in consent where required by law
Personalized emails derived from the user’s own input are the default unless the user opts out on the app’s Settings page; Ovia warns the emails may be intercepted and that opting out is how to avoid accepting that risk. Marketing communications for Ovia and its affiliates are subject to opt-in consent when required by law, not everywhere.
Details not recorded for this card
Supporting quotations
Send you personalized emails showing relevant data points derived from the personal data you input to our Services, unless you opt-out of such communications in the Settings page of the app.
Despite precautions, email communications may be intercepted; you should opt-out if you do not wish to accept this risk.
Send you marketing communications for Ovia and its affiliates, subject to your opt-in consent when required by law
Qualifications & exceptions
Personalized emails default on; opt-out is via the app Settings page.
Marketing emails are subject to opt-in consent “when required by law”.
Security & Safeguards · Company practice
Uses personal data to provide security for the Services and obtain analytics about app performance
Security of the Services and app-performance analytics are stated purposes for using the collected personal data.
Details not recorded for this card
Supporting quotations
Provide security for the Services and obtain analytics about app performance
Use & Processing · Company practice
Uses personal data to develop and improve products, including ML, LLM and other AI technologies
Product development and improvement purposes are stated expressly to include machine learning algorithms, large language models and other AI technologies. This is a use of personal data for AI development; whether any sale/share for AI training occurs is a separate section carded on its own.
Details not recorded for this card
Supporting quotations
Market, develop and improve Ovia’s and its affiliates’ products and services, including development and improvement of machine learning algorithms, large language models and other AI technologies (“AI”)
Not stated here
This card describes the use purpose only; the separate sell/share-for-advertising-or-AI-training section is carded in its own packet.
Use & Processing · Restriction or exception
Uses personal data to conduct clinical and scientific research, subject to informed consent where required by law
Clinical and scientific research is a stated use of personal data; the consent qualification applies where required by law, not as a blanket promise for all research.
Details not recorded for this card
Supporting quotations
Conduct clinical and scientific research, subject to your informed consent where required by law
Qualifications & exceptions
Informed-consent condition applies “where required by law”.
Inference & Profiling · Company practice
Uses personal data to create deidentified data, aggregated data and statistics (detail cross-referenced below)
One listed use creates deidentified and aggregated data and statistics, with a cross-reference (“as described further here”) to the linked detailed passage. That passage states deidentified data is no longer linked or linkable to the user, is not personal data, is for research and development purposes, and that Ovia may receive compensation for sharing deidentified or aggregated data. The creation purpose here is qualified by that detail; sharing with research partners and other named uses are carded at the Additional Information section.
Details not recorded for this card
Supporting quotations
Create deidentified data and aggregated data and statistics, as described further here
Deidentified Data and Aggregated Data: Ovia may use personal data to create deidentified data for research and development purposes. Deidentified data is not personal data as it is no longer linked or linkable to you.
Qualifications & exceptions
The detailed b147 treatment (research partners, sale/disclosure with compensation) is carded at the Additional Information packet; referenced here only as the qualifier of this use.
Uses personal data to comply with law, for security/investigation, litigation, or to protect rights or property
A protective purpose row covers compliance with law, security management and investigation, litigation, and protecting Ovia’s or third parties’ rights or property.
Details not recorded for this card
Supporting quotations
Comply with law, for security management and investigation, in connection with litigation, or to protect the rights or property of Ovia or third parties
Processing relies on one or more of five grounds: point-of-collection consent, contract performance, legal-obligation compliance, scientific research/statistics/public-health activities, and legitimate interests (Ovia’s, the user’s, or a third party’s) where not overridden by the user’s interests, fundamental rights or freedoms. Ovia states its legitimate interests include the lawful conduct of its business.
Details not recorded for this card
Supporting quotations
Lawful Processing. Our processing of your personal data is based on one or more of the following:
The consent you provide to us at the point of collection of your personal information;
The performance of the contract we have with you;
The compliance of a legal obligation to which we are subject;
The performance of scientific research, preparation of statistics or public health activities;
The legitimate interests of Ovia, you or a third party, where not overridden by your interests, fundamental rights or freedoms.
Qualifications & exceptions
Per the lead-in, one or more of these grounds applies; the list is not an all-purpose licence.
Use & Processing · Company practice
Purposes table: identifiers get all listed purposes except deidentified-data creation; health rows law-limited
For identifiers, the maximum use is the “Comprehensive Use” — all purposes listed in the purpose list above — but with deidentified-data creation carved out. Health-related and protected-classification rows add the qualifier “other than uses not permitted by law”. Employment-related data is tied to providing Ovia+ services. Sensitively, the same table rows for sensitive information appear in a separate card.
Details not recorded for this card
Supporting quotations
The table below describes the purposes for our use and collection by category.
All purposes listed under “Purpose of Collection and Use of Personal Data” above (“Comprehensive Use”), other than creation of deidentified data
General personal information including health information
Comprehensive Use, other than uses not permitted by law.
Legally protected classifications such as race, gender, disability or pregnancy status
Comprehensive Use, other than uses not permitted by law
Professional and employment related
To provide you with Ovia+ services
Qualifications & exceptions
Deidentified-data creation is a stated purpose generally, but is excluded for identifiers.
Health and protected-classification rows are limited to uses permitted by law.
Inference & Profiling · Company practice
Inferences except unlawful uses, primary use health content; biometric, activity and geolocation “Comprehensive Use”
The inferences row permits comprehensive use other than uses not permitted by law, with the stated primary use being provision of content relevant to the user’s health. The biometric, internet/app-activity and geolocation rows read simply “Comprehensive Use” — all of the purposes listed in the purpose list above.
Details not recorded for this card
Supporting quotations
Biometric information
Comprehensive Use
Internet and app activity information
Geolocation
Comprehensive Use, other than uses not permitted by law. Our primary use of inferences is to provide you with content relevant to your health.
Qualifications & exceptions
“Comprehensive Use” resolves to the section’s itemized purpose list; it is not an independent unlimited licence.
Use & Processing · Company practice
Uploaded photos/videos stored and displayed; sensitive information comprehensive except uses not permitted by law
The audio/visual row states the stored photos and videos uploaded by the user are stored and displayed. The sensitive-information row allows comprehensive use except uses not permitted by law.
Details not recorded for this card
Supporting quotations
Audio and visual information
Store and display the photos and videos you upload to your Ovia account
Comprehensive Use, other than uses not permitted by law.
Sharing & Disclosure · Company practice
Shares with service providers and contractors working on Ovia’s behalf: AWS, Helpshift, Salesforce.com, Alchemer, Zoom
The recipients table states Ovia’s data is processed and stored by service providers and contractors acting on Ovia’s behalf, naming Amazon Web Services (cloud), Helpshift (support), Salesforce.com (coaching platform), Alchemer (surveys) and Zoom Video Communications (coaching communications).
Details not recorded for this card
Supporting quotations
When We Share Personal Information, What Categories of Recipients Do We Share With?
Categories of Recipients
Ovia’s data is processed and stored by service providers and contractors working on Ovia’s behalf, including our cloud services provider Amazon Web Services, Helpshift (support services platform), Salesforce.com (coaching platform), Alchemer (survey platform) and Zoom Video Communications (coaching communications).
Qualifications & exceptions
Named as working “on Ovia’s behalf” — processer/service role, not recipients for their own purposes.
Sharing & Disclosure · Restriction or exception
Ovia+ sharing: may share with insurer, plan, employer, or their business associates; employer with express consent
For Ovia+ users, data may reach the health insurer, health plan, employer or their business associates and benefits management providers, as detailed under the “Ovia+ Data Sharing” heading (carded beside). The employer leg carries a double condition: sharing with the employer is limited to specific uses and requires express consent.
Details not recorded for this card
Supporting quotations
If you are an Ovia+ user, we may share data with your health insurer, health plan, employer, or their business associates and benefits management providers, as described below under the heading “Ovia+ Data Sharing”, provided that we share information with your employer only for specific uses and only if you expressly consent.
Qualifications & exceptions
Applies if you are an Ovia+ user.
Employer sharing: specific uses only + express consumer consent (see Ovia+ Data Sharing cards).
Sharing & Disclosure · Restriction or exception
Shares Ovia data with Apple Health, Google Health Connect or other devices only if you opt in, and only what you select
Outbound device sharing is opt-in and limited to the information the user selects to share; no automatic device sharing is stated.
Details not recorded for this card
Supporting quotations
If you opt-in to share your Ovia data with Apple Health, Google Health Connect or your other devices, we share the information you select to share.
Qualifications & exceptions
Requires user opt-in.
Only the data the user selects is shared.
Use & Processing · Context
The recipients table’s “From surveys” row repeats the collection-source wording, not a sharing provision
Row 5 of the recipients table carries the same text as the sources table’s surveys row — “We collect data you submit to us through surveys” — which describes collection, not a category of sharing recipient. It is carded as collection in ovia-sources-surveys (packet 0); no additional sharing statement is derived from it.
Details not recorded for this card
Supporting quotations
From surveys
Qualifications & exceptions
Duplicate of the sources-table survey row; no additional sharing claim derives from it.
Sharing & Disclosure · Company practice
People you invite see all of your personal data and can add others; every follower sees added content
Inviting someone gives them visibility of all of the user’s personal data in the Ovia apps, and invitees can add others to the account. Content added to an account is visible to everyone following that account — all-or-nothing, not selective.
Details not recorded for this card
Supporting quotations
The Ovia apps may allow you to invite others, such as your partner, to share your Ovia journey. If you invite someone, they will be able to see all of your personal data in the Ovia apps.
The people you invite are also able to add others to your account. If you add personal data or other content to an Ovia account, everyone who is following that Ovia account will see it.
Qualifications & exceptions
Scope is “all of your personal data” for invitees, not selected data.
Invitees can further add others to the account.
Sharing & Disclosure · Company practice
Profile image and name go in emails to invited followers, visible before acceptance; opt-in emails by law
A profile image or name entered — including for a child in the user’s care — is shared in journey emails to all invited followers of the account and is visible even before the invitation is accepted. The stated control is not to enter a profile picture or name at all; regular email updates themselves are subject to opt-in consent where required by law.
Details not recorded for this card
Supporting quotations
If you include a profile image or name for yourself or a child in your care, this profile image and name will be shared in emails to you and everyone who has been invited to follow your account.
The name and image will be visible even before the invitation is accepted. If you do not want the image or name to be shared, you should not enter a profile picture or a profile name.
Qualifications & exceptions
Visibility precedes invitation acceptance.
Profile image/name applies to the user or a child in their care.
Stated control: do not enter a profile picture or name.
Sharing & Disclosure · Company practice
May share data with parent Labcorp, common-control companies, and successors in merger/acquisition/asset sale
Ovia “may” share data with its parent Labcorp, companies under common control, and transactional successors in a merger, acquisition, asset sale or similar transaction.
Details not recorded for this card
Supporting quotations
We may share data with our parent company Labcorp and with companies under common control, and with any successors in the event of merger, acquisition, asset sale, or similar transaction.
Qualifications & exceptions
Expressed as “may share” — a permission, not a guarantee.
Legal Rights & Agreement Rules · Company practice
May provide personal data to courts, law enforcement, government authorities if required by law or to protect rights
Compelled and legally-necessary disclosures to courts, law enforcement, governmental authorities and other third parties are permitted. The policy cross-references a separate “How Does Ovia Respond to Data Requests” page.
Details not recorded for this card
Supporting quotations
Ovia may provide personal data to courts, law enforcement, and governmental authorities and other third parties if required by law, subpoena, directive from a regulatory authority or as otherwise necessary to comply with legal requirements or to protect the rights or property of Ovia or third parties.
Not stated here
The linked page “How Does Ovia Respond to Data Requests” is not supplied by this source; this card cannot say what it contains about responding to government requests.
Sharing & Disclosure · Company practice
Ovia+ via insurer/employer/plan includes data sharing with insurer, plan, employer, or their vendors per HIPAA
Where Ovia+ is received as a premium benefit through a health insurer, employer or employer health plan, the services include data sharing with the insurer, employer health plan, employer or their vendors — stated as in accordance with HIPAA and other privacy laws. Underlying condition: this matches Ovia+ procurement, not the free Consumer version.
Details not recorded for this card
Supporting quotations
Ovia+ Data Sharing
your Ovia+ services include data sharing with your insurer, employer health plan, employer, or vendors working on their behalf in accordance with HIPAA and other privacy laws.
Qualifications & exceptions
Applies to premium Ovia+ received through insurer/employer/employer health plan.
Sharing & Disclosure · Company practice
Data sharing does not occur for all Ovia+ clients; definitive account-level information via support email
Whether sharing occurs varies by Ovia+ client arrangement: the policy states sharing does not occur for all Ovia+ clients and directs users to support@oviahealth.com for account-specific facts.
Details not recorded for this card
Supporting quotations
Data sharing does not occur for all Ovia+ clients. If you would like definitive information on the data sharing for your account, please contact support@oviahealth.com.
Qualifications & exceptions
Account-specific variation acknowledged in the policy itself.
Sharing & Disclosure · Company practice
Ovia+ via insurer/provider: personal data shared with insurer/provider or business associates under HIPAA
For insurer/provider-provided Ovia+, personal data is shared with the health insurer/provider or their business associates under HIPAA for care and benefits management.
Details not recorded for this card
Supporting quotations
If you receive Ovia as a benefit from your health insurer or health care provider, Ovia is part of your care package and we share your personal data with your health insurer or provider, or their business associates, under HIPAA, for care and benefits management.
Qualifications & exceptions
Condition: Ovia received as a benefit from a health insurer or health care provider.
Sharing & Disclosure · Restriction or exception
Employer benefit: no health data to employer without express consent; plan/associates/vendors may be shared
For employer-provided Ovia+, Ovia’s stated rule is no sharing of health data with the employer absent express consent for a specific purpose (example given: an in-house care management team), limited to that purpose. “However”, personal data may still be shared with the employer health plan, its business associates (including the health insurer) and employee-benefits management vendors consistent with HIPAA or other privacy laws. The consent gate protects the employer entity, not the employer’s health plan.
Details not recorded for this card
Supporting quotations
If you receive Ovia as a benefit from your employer or your employer health plan:
we do not share your health data with your employer unless you expressly consent for a specific purpose;
this may occur, for example, if your employer offers you access to an in-house care management team.
If this occurs, we limit the sharing as necessary for the specific purpose to which you have given consent.
However, we may share personal data with your employer health plan and their business associates (including your health insurer), and with employee benefits management vendors, consistent with HIPAA or other privacy laws.
Qualifications & exceptions
Health data to the employer entity: requires express consent for a specific purpose.
Employer health plan, its business associates and benefits vendors: sharing permitted without that consent.
Consented sharing is limited to the consented purpose.
Not stated here
The linked page “Why do we ask for this?” (oviahealth.com) is not supplied by this source; this card cannot say what consent details that page explains.
Sharing & Disclosure · Company practice
Nurse care managers from your health plan may access personal data and may contact you for care management
Sharing with a health insurer can expose personal data to that plan’s nurse care managers, who “may” access the data and “may” contact the user for care management purposes.
Details not recorded for this card
Supporting quotations
When we share your data with your health insurer, nurse care managers from your health plan may also have access to your personal data and may contact you as a result for care management purposes.
Qualifications & exceptions
Expressed as “may” for both access and outreach.
Sharing & Disclosure · Company practice
May share limited identity info (name, DOB) with plan/employer to confirm Ovia+ benefit eligibility
At Ovia+ registration, limited identity information (such as name and date of birth) may be shared with the health plan or employer to confirm eligibility. This is narrower than the health-data rules above.
Details not recorded for this card
Supporting quotations
If you seek to register for Ovia+ premium services provided by a health plan or employer, we may share limited identity information (such as name and date of birth) with the health plan or employer to confirm your eligibility for Ovia+ benefits.
Qualifications & exceptions
Limited identity information only; purpose is eligibility confirmation.
Sharing & Disclosure · Restriction or exception
Care/benefits sharing passes a summary health snapshot; never sexual activity, MyQ answers, Community submissions
Care-and-benefits-management sharing described in the Ovia+ section is a “summary snapshot” of health data, and three categories are excluded outright: in-app sexual activity records, MyQ question answers, and Community feature submissions.
Details not recorded for this card
Supporting quotations
When we share health data for care and benefits management as described in this section, we share a summary snapshot of your health data.
We do not share any information you have recorded in the Ovia apps about sexual activity, any answers you have given to MyQ questions, or any submissions you make to our Community feature.
Qualifications & exceptions
Applies to the Ovia+ care/benefits-management sharing described in this section.
Hard exclusions: sexual-activity records, MyQ answers, Community submissions.
Sharing & Disclosure · Company commitment
As of June 2025: no advertising shown to Consumer users and no selling or sharing of personal data for advertising
The sell/share-for-advertising section states a June-2025 cutoff: Ovia no longer shows advertising to Consumer users and does not sell or share any personal data for advertising. A separately carded legacy block (ovia-legacy-ads-pre-2025) covers what happened before that business ended.
Details not recorded for this card
Supporting quotations
What Categories of Personal Information Do We Sell or Share for Advertising or AI Training?
As of June 2025, Ovia no longer shows advertising to our Consumer users and does not sell or share any personal data for advertising.
Qualifications & exceptions
Time-scoped: as of June 2025.
Stated for “our Consumer users” (the free version).
Cross-references
contrast (model-proposed): Historical: pre-June 2025, shared identifiers, app-activity data and inferred purchase interests with ad platforms — Both statements are time-scoped: the legacy ad-sharing card describes practice before the June 2025 advertising-business termination, while the no-advertising/no-sale commitment takes effect as of June 2025. They pull in different directions on the surface but do not conflict once the dates are read separately; neither is a contradiction.
No sale of personal data to third parties for training AI; but AI-tool vendors may use personal data to improve services
The no-sale commitment covers selling to third parties for AI training. Beside it, Ovia may — to the extent permitted by law — allow vendors that provide AI tools to Ovia to use personal data to improve their own services to Ovia. The commitment and the vendor-use permission are distinct statements and must not be merged.
Details not recorded for this card
Supporting quotations
Ovia does not sell personal data to third parties for the purpose of training AI.
We may, to the extent permitted by law, allow vendors who provide us with AI tools to use personal data to improve the services they provide to us.
Qualifications & exceptions
The commitment is limited to “sell” — not use per se.
AI-vendor use is subject to “to the extent permitted by law”.
To its knowledge, Ovia does not sell or share personal data of users under 16 and no longer shows advertising
For users under 16 the statement is knowledge-qualified: “to its knowledge”, Ovia does not sell or share their personal data — not an absolute guarantee — and Ovia no longer shows advertising.
Details not recorded for this card
Supporting quotations
No Selling or Sharing for Advertising of Personal Data of Consumers Under 16
To its knowledge, Ovia does not sell or share any personal data of Ovia users under 16. Ovia no longer shows advertising.
Qualifications & exceptions
Qualified by “to its knowledge”.
Sharing & Disclosure · Company practice
Purposes table: identifiers, geolocation, employment to cloud/analytics/vendors; audio/visual cloud-only
In the business-purposes table, identifiers, geolocation and professional/employment rows go to cloud computing providers, data analytics providers, and vendors providing email, support, admin, marketing, survey and scheduling systems, for internal operations (hosting, support, admin, marketing, analytics). The audio/visual row is narrower: cloud computing providers only, purpose hosting and support.
Details not recorded for this card
Supporting quotations
Categories of Personal Information Disclosed for Business Purposes
Business Purpose for Sharing
For internal operations (hosting, support, admin, marketing, analytics).
Geolocation
For internal operations (hosting, support, admin, marketing, analytics).
Cloud computing providers.
For internal operations (hosting and support).
Professional and employment related
For internal operations (hosting, support, admin, marketing, analytics).
Qualifications & exceptions
Audio/visual recipients are limited to cloud computing providers; purpose hosting and support only.
This table describes disclosure for business purposes (a specific narrower purpose set), not all sharing.
The health-information, protected-classification, internet/app-activity, inferences and sensitive-information rows of the business-purposes table add a second recipient group — Ovia+ customers and their vendors as described under the “Ovia+ Data Sharing” heading — and a second purpose: providing Ovia’s digital health solutions to Ovia+ customers, alongside internal operations.
Details not recorded for this card
Supporting quotations
General personal information including health information
Ovia+ customers and their vendors as described under the “Ovia+ Data Sharing” heading above.
To provide our digital health solutions to Ovia+ customers.
Legally protected classifications including race, gender, pregnancy status
Internet and app activity information
Inferences
Sensitive information
For internal operations (hosting, support, admin, marketing, analytics). To provide our digital health solutions to Ovia+ customers.
Biometric information
Qualifications & exceptions
The Ovia+ leg of these rows depends on Ovia+ membership; see the Ovia+ Data Sharing cards for its limits (e.g. employer consent gate and snapshot exclusions).
Sharing & Disclosure · Company practice
Historical: pre-June 2025, shared identifiers, app-activity data and inferred purchase interests with ad platforms
A time-limited legacy statement: prior to June 2025, Ovia shared identifiers, internet and app activity information and inferred purchase interests with its ad sales platform, advertising networks, platforms or ad-tech providers, to sell, administer, serve and purchase ads. This describes past practice; the current no-advertising commitment is carded separately.
Details not recorded for this card
Supporting quotations
Prior to the termination of our advertising business in June 2025, we shared identifiers, internet and app activity information and inferred purchase interests with our ad sales platform, advertising networks, advertising platforms or advertising technology providers to sell, administer, serve and purchase ads.
Qualifications & exceptions
Applies “prior to” the June 2025 termination of the advertising business — past practice only.
Cross-references
contrast (model-proposed): As of June 2025: no advertising shown to Consumer users and no selling or sharing of personal data for advertising — Both statements are time-scoped: the legacy ad-sharing card describes practice before the June 2025 advertising-business termination, while the no-advertising/no-sale commitment takes effect as of June 2025. They pull in different directions on the surface but do not conflict once the dates are read separately; neither is a contradiction.
Sharing & Disclosure · Company practice
May also share for business purposes with the recipients-table categories: invitees, followers, affiliates, authorities
The business-purposes section cross-references the recipients table: those recipient categories also apply — People You Invite, You and Your Requested Followers, Affiliates and Successors, and Government Authorities and Recipients of Compelled Disclosures. Those categories’ detailed rules are carded in the sharing-recipients packet; read with the qualifiers carried there (e.g. invitees see all personal data).
Details not recorded for this card
Supporting quotations
Ovia may also share personal data for business purposes in all of the above categories, as described in the table “When We Share Personal Information, What Categories of Recipients Do We Share With?”, with the following categories listed in that table: People You Invite, You and Your Requested Followers, Affiliates and Successors, and Government Authorities and Recipients of Compelled Disclosures.
Sharing & Disclosure · Company practice
Discloses personal data to processors acting for Ovia; Appsflyer may act as controller for its own security/compliance
Beyond the business-purpose disclosures, Ovia discloses personal data to processors acting on Ovia’s behalf; principal processors appear on a linked Subprocessors Page. Named exception: analytics vendor Appsflyer normally acts as processor but may act as a controller when using personal data for its internal security, error correction and compliance purposes.
Details not recorded for this card
Supporting quotations
Third Parties Receiving Personal Information for Their Own Business Purposes
Ovia discloses personal data to processors who act on Ovia’s behalf
Our analytics vendor Appsflyer provides its services to Ovia as a processor, but may act as a controller when using personal data for its internal security, error correction and compliance purposes.
Not stated here
The linked Subprocessors Page is not supplied by this source; the card cannot say which processors it lists beyond the named ones elsewhere in this policy.
Security & Safeguards · Company practice
Industry-standard security: background checks and encryption; Ovia+ HITRUST certified; database on AWS
Ovia states it protects personal data with industry-standard measures including background checks on all employees and encryption in transit and at rest; the Ovia+ product is certified to the HITRUST Common Security Framework; and the principal database is hosted by AWS. Incident notification is promised as required by law, and the user agrees that, when permitted by law, such notices may come by email.
Details not recorded for this card
Supporting quotations
Data Security
Ovia protects personal data with security measures that are consistent with industry standards, including background checks on all employees and data encryption in transit and at rest.
Ovia’s Ovia+ product has achieved certification to the HITRUST Common Security Framework.
Our principal database is hosted by Amazon Web Services, which maintains multiple security certifications.
We will notify you of security incidents as required by law, and you agree that, when permitted by law, such notices may be sent by email to the email address associated with your Ovia account.
Qualifications & exceptions
Incident notification is limited to “as required by law” — not an absolute promise for every incident.
The HITRUST certification is specific to the Ovia+ product.
Retention & Deletion · Company practice
Consumer retention: all data kept while account active plus 7 years, then automatically deleted
Standard Consumer retention is the active-account period plus 7 years, after which Ovia automatically deletes the data — it does not require the user to act.
Details not recorded for this card
Supporting quotations
Data Retention
If you are a Consumer user, we store your data (all categories) for the period that your account is active and then for 7 years after that. After this period, we automatically delete your data.
Qualifications & exceptions
Applies to Consumer (free-version) users.
Deletion after the period is automatic.
Retention & Deletion · Company practice
Ovia+ retention: stored during benefits; generally deleted after benefits end, with notice/conversion offer
Ovia+ data is stored during the benefits period and “generally” — not absolutely — must be deleted after benefits end. Ovia will notify before deletion and, where possible, offer conversion to a Consumer account to retain the data (which then follows the 7-year Consumer rule).
Details not recorded for this card
Supporting quotations
If you are an Ovia+ user, we store your data (all categories) during the period that you are receiving Ovia+ benefits. Ovia is generally required to delete your data after your Ovia+ benefits end.
We will notify you before your data is deleted and, where possible, offer you the opportunity to convert your account to a Consumer account and retain your data.
Qualifications & exceptions
Deletion after Ovia+ benefits end is qualified by “generally required”.
Conversion to a Consumer account is offered only “where possible”.
Retention & Deletion · User right or choice
Standard retention periods are stated, but the user can delete their data at any time
The automatic timelines are “standard” periods, not fixed minimums: the user can Delete data at any time per the choices section.
Details not recorded for this card
Supporting quotations
While these are our standard retention periods, you can delete your data at any time as described in the next section.
Qualifications & exceptions
User-initiated deletion overrides the timescales; it is described in the choices section.
The choices section opens with in-app self-service controls covering the listed rights: correcting data, opting out of marketing emails and push notifications, deleting data and account (subject to certain exceptions), obtaining a data copy, obtaining a summary statement of processing, withdrawing consent by deleting data, and — for non-US users — managing cookies. Menu navigation for each is carded separately.
Details not recorded for this card
Supporting quotations
What Are Your Choices?
Within the Ovia Apps
You can use self-service controls within the Ovia apps to exercise your data subject rights to:
Correct your data:
Opt-out of marketing emails and push-notifications
Delete your data and account, subject to certain exceptions
Obtain a copy of your data
Obtain a summary statement of Ovia’s data processing
Withdraw your consent to Ovia’s data processing by deleting your data
For non-US users, manage your cookies
Qualifications & exceptions
Deletion is “subject to certain exceptions” (see the deletion-exceptions cards).
Cookie management applies to non-US users only.
Not stated here
The summary statement of Ovia’s data processing is reached through an in-app choice that the block marks as a link to a separate document; that document’s text is not supplied by this source, so the card cannot say what the summary contains.
Account & Service Control · Procedure
Menu paths: correction under More > Account; export and processing summary under More > Settings
The correction control lives under More > Account (profile and health information). Data export (“export my data”) and the processing summary (“how is my data used?”) live under More > Settings.
Details not recorded for this card
Supporting quotations
Go to the “More” page of your Ovia app to the “Account” section to modify your profile and health information
Go to “More” then “Settings” and then “export my data”
Go to “More” then “Settings” and choose “how is my data used?”
Account & Service Control · User right or choice
Marketing opt-out via app Settings (email and push) or the unsubscribe link in marketing emails
Two opt-out channels are stated: the app’s Settings page for email subscriptions and push notifications, and the unsubscribe link inside marketing emails.
Details not recorded for this card
Supporting quotations
Go to the “More” page of your Ovia app, then choose “Settings”, to edit email subscriptions and opt out of email and push notifications
You can also opt out of marketing emails by using the unsubscribe link in the emails
Qualifications & exceptions
Opting out leaves account-management notices; see the other-relevant-information card.
Account & Service Control · Procedure
Deletion via More > Settings; withdrawing consent to processing is done by deleting your data
Deletion uses the two-step “reset or delete my account” → “delete my account” path in Settings. The same act is also the stated mechanism for withdrawing consent to Ovia’s data processing — no separate consent-withdrawal channel is described.
Details not recorded for this card
Supporting quotations
Go to “More” then “Settings” and choose “reset or delete my account”, and then “delete my account”
Go to “More” then “Settings” and choose “reset or delete my account”, and then “delete my account”
Qualifications & exceptions
The same deletion step serves withdrawal of consent.
Deletion is subject to certain exceptions carded elsewhere.
Account & Service Control · Procedure
Cookie management control exists for non-US users under More > Settings > Manage My Privacy Settings
The manage-cookies choice applies to non-US users via Settings → “Manage My Privacy Settings”.
Details not recorded for this card
Supporting quotations
Go to “More”, “Settings”, then “Manage My Privacy Settings”
Qualifications & exceptions
Stated for non-US users.
Account & Service Control · Company practice
No GPC “do not sell” signal inside the apps or in-app webviews; respected only on the corporate website
Browser-based Global Privacy Control signals are not received in the apps or in-app webviews, so a GPC opt-out does not take effect there. GPC signals are respected on the Ovia Health corporate website, which the policy states is governed by the Non-App Privacy Policy.
Details not recorded for this card
Supporting quotations
Opting Out Through Browser-Based Global Privacy Controls
Ovia does not receive a “do not sell” Global Privacy Control (GPC) signal when you are using Ovia’s mobile applications or viewing content through in-app webviews.
Ovia respects “do not sell” GPC signals that we receive on the Ovia Health corporate website at
Not stated here
The linked Non-App Privacy Policy’s text is not supplied by this source; this card cannot say how that policy handles GPC on the corporate website.
Account & Service Control · User right or choice
Email support to exercise listed and other legal rights; agents likewise; password verification may apply
Rights can also be exercised by emailing support@oviahealth.com — both for the listed rights and other rights provided by law. Authorized agents exercising rights on users’ behalf use the same contact. Ovia “may” require the user to verify identity by entering username and password.
Details not recorded for this card
Supporting quotations
Contacting Our Helpdesk, and Use of Authorized Agents
You may email Ovia at
Any authorized agents seeking to exercise data subject rights on behalf of any Ovia users should contact
Ovia may require you to verify your identity by entering your username and password in order to exercise data subject rights.
Qualifications & exceptions
Identity verification is stated as “may require”.
Account & Service Control · User right or choice
Users have the right not to be discriminated against for exercising privacy rights; contact the helpdesk if concerned
A non-discrimination right accompanies the privacy rights, with the helpdesk as the stated recourse.
Details not recorded for this card
Supporting quotations
You have the right not to be discriminated against for exercising your privacy rights. Contact our helpdesk if you are concerned that this has happened to you.
Account & Service Control · User right or choice
Refused requests: appeal by email to Ovia’s Legal Department, resolved within 30 days of receipt
Refused requests carry an appeal route to Ovia’s Legal Department by email, with a stated 30-day resolution deadline from receipt of the appeal email.
Details not recorded for this card
Supporting quotations
Appeal Rights
If your request to exercise any of your rights is refused, you may send your notice of appeal by email to
We will resolve your appeal within 30 days of the date of receipt of your email.
Retention & Deletion · Restriction or exception
Deletion exceptions: retention for records, law, security/investigation, litigation, protecting rights/property
The deletion control is qualified: Ovia “may” retain personal data despite a deletion request for proper business records, compliance with and as permitted by law, security management and investigation, litigation, or protecting the rights or property of Ovia or third parties.
Details not recorded for this card
Supporting quotations
Exceptions to Deletion
Even if you exercise your rights described above, Ovia may retain personal data to maintain proper business records, to comply with and as permitted by law, for security management and investigation, in connection with litigation, or to protect the rights or property of Ovia or third parties.
Not stated here
The linked page “How Does Ovia Respond to Data Requests” is not supplied by this source; this card cannot say what it adds about data requests.
Retention & Deletion · Restriction or exception
Notices continue after opt-out; all email stops only with deletion; public posts stay; research may delay
Four practical limits: opting out leaves account-management notices; the only stated way to stop all emails and push is account deletion; deleting data does not remove posts or comments already shared publicly on Ovia’s social media, community or chat features; and consented research participation may delay deletion until the study completes.
Details not recorded for this card
Supporting quotations
Other Relevant Information
If you opt-out of marketing emails and push notifications, you will still receive account management notices. To stop all emails and push notifications, you must delete your account and data.
If we delete your data, we will not delete the posts or comments you have shared publicly on Ovia’s social media, community or chat features.
If you have consented to participate in a research study and subsequently request deletion of your data, we may delay deletion until completion of the study.
Qualifications & exceptions
The 30-day appeal and research-delay statements are Ovia commitments in this policy, not external law.
Public posts/comments deletion gap persists after data deletion.
Account & Service Control · Procedure
Contact: privacy choices via in-app controls; designated DPO at the Westborough, MA address and legal@oviahealth.com
Exercising privacy choices routes back to in-app controls in the choices section. Ovia designates a Data Protection Officer, contactable for questions or complaints about processing at Ovuline, Inc. dba Ovia Health by Labcorp, 3400 Computer Drive, Westborough, MA 01581, and by email at legal@oviahealth.com.
Details not recorded for this card
Supporting quotations
How to Contact Ovia with Comments or Complaints?
To contact Ovia to exercise your privacy choices, please see “What Are Your Choices?” above.
Ovia has designated a Data Protection Officer.
Data Protection Officer Ovuline, Inc., dba Ovia Health by Labcorp 3400 Computer Drive Westborough, MA 01581
Account & Service Control · Procedure
EEA/UK data subjects may contact the DPO or Ovia’s EU and UK representative (dpo@labcorp.com)
Besides the DPO route, users located in the EEA or UK may contact Ovia’s EU and UK representative at dpo@labcorp.com.
Details not recorded for this card
Supporting quotations
Data subjects located in the EEA or UK may contact the Data Protection Officer at the address above or Ovia’s EU and UK representative at
Qualifications & exceptions
Applies to data subjects located in the EEA or UK.
Account & Service Control · User right or choice
Users may complain to a local consumer-protection or data-protection authority; Washington AG site linked
The right to complain externally is qualified: users “may also have” the legal right to lodge a complaint with a local consumer-protection or data-protection authority. For Washington State (US) residents the policy links the Attorney-General’s complaint website.
Details not recorded for this card
Supporting quotations
You may also have the legal right to lodge a complaint about Ovia’s data processing with your local consumer protection or data protection authority.
Qualifications & exceptions
Right stated conditionally: “may also have the legal right”.
The Washington example is specific to residents of Washington state.
Not stated here
The linked Washington Attorney-General complaint page is an external site not supplied by this source; the card cannot describe its contents.
Account & Service Control · Restriction or exception
Not responsible for third-party sites/apps’ privacy practices; users should review their policies
Links may lead to sites or apps operated by other companies; Ovia disclaims responsibility for those parties’ privacy practices and directs users to review their policies. The other companies’ policy texts are not part of this source.
Details not recorded for this card
Supporting quotations
Additional Information
Some links within the Services may interface with or take you to websites or apps that are operated by other companies. Ovia is not responsible for the privacy practices of others. You should review the privacy policies of those sites and apps.
Retention & Deletion · Company practice
Data kept on US AWS servers and possibly other US vendors; non-US users may face weaker safeguards; use means consent
Collected data is transferred to US servers of AWS; some personal data may also reach other US-based vendors (principal vendors are on a linked Subprocessors Page). Non-US residents are warned data may become subject to US jurisdiction, which may provide weaker safeguards and rights. Accepting the Policy, using the Services or providing data is treated as acknowledgment and consent to the transfer/processing described.
Details not recorded for this card
Supporting quotations
The data we collect is transferred to servers located in the US of our cloud computing provider, Amazon Web Services (AWS); some personal data may be transferred to other US-based vendors who provide services to Ovia, including the principal vendors listed
If you are resident outside the US, your data may as a result become subject to US jurisdiction which may provide you with weaker data protection safeguards and rights than you would enjoy in your home jurisdiction.
By accepting this Privacy Policy, using the Services or providing us with your personal data you acknowledge and consent to your personal data being transferred and/or processed as described in this Policy.
Qualifications & exceptions
Consent-by-use applies through accepting the Policy, using the Services or providing personal data.
The weaker-safeguards warning is directed at non-US residents.
Not stated here
The linked Subprocessors Page is not supplied by this source; the card cannot name the vendors listed there.
Data Access & Collection · Restriction or exception
No under-13 use or collection; parents may include child data at their responsibility for legal right
Two rules: the Services are unavailable to children under 13 (and to anyone else who requires parental consent under applicable law), and Ovia does not collect personal data from children under 13. Parents and guardians may enter personal data about their baby or child in their own account, and the parent or guardian is responsible for having the legal right to do so.
Details not recorded for this card
Supporting quotations
The Services are not available to children under 13 or who otherwise require parental consent under applicable law to use the Services or provide personal information to Ovia. Ovia does not collect personal data from children under 13.
Parents and guardians may include personal data about their baby or child in their Ovia account; the parent or guardian is responsible for ensuring they have the legal right to do so.
Qualifications & exceptions
The under-13 rule is age-based; above 13 it turns on applicable parental-consent law.
Child data in a parent’s account rests on the parent/guardian’s legal right, which Ovia does not verify here.
Sharing & Disclosure · Company practice
Deidentified data detail: unlinked, not re-identified, may reach research partners, CCPA-patient rule, compensation
The full linked detail: deidentified data is for research and development, is not personal data (no longer linked or linkable), and if a deidentified dataset is created it is maintained as such and will not be re-identified. Ovia may provide it to research partners such as universities and medical research institutions, and to other businesses that engaged Ovia to provide research services on deidentified or aggregated data. Ovia may even disclose or sell deidentified data derived from CCPA-defined patient information, with that patient information first deidentified per HIPAA safe harbor or expert-determination methods, and may receive compensation for sharing deidentified or aggregated data. Aggregated analytic data and statistics may be used internally or shared with third parties.
Details not recorded for this card
Supporting quotations
Deidentified Data and Aggregated Data: Ovia may use personal data to create deidentified data for research and development purposes. Deidentified data is not personal data as it is no longer linked or linkable to you.
If we create a deidentified dataset we maintain it as such and will not re-identify it.
We may provide deidentified data to our research partners, such as universities and medical research institutions for research, and to other businesses who have engaged us to provide research services on deidentified or aggregated data.
Ovia may disclose or sell deidentified data derived from patient information (as defined by the California Consumer Privacy Act); if so, such patient information is deidentified in accordance with HIPAA safe harbor or expert determination deidentification requirements.
We may use personal data to create aggregated analytic data and statistics, which we may use for Ovia’s internal purposes or share with third parties.
Ovia may receive compensation for sharing deidentified or aggregate data.
Qualifications & exceptions
Re-identification is excluded by commitment for deidentified datasets Ovia itself creates.
“Patient information” here is as defined by the California Consumer Privacy Act — the Act’s text is not supplied.
Named external laws (CCPA, HIPAA) are classified by name/syntax only; their contents are not supplied evidence.
Not stated here
This card treats CCPA and HIPAA deidentification methods as named external standards; the standards’ texts are not supplied by this source, so the card cannot verify what they require.
No collection of personal data via Ovia’s social media channels; channel providers’ policies apply
For Ovia content on social media channels: Ovia does not collect personal data through those channels, and the social media provider’s own privacy policy applies to the user’s usage there.
Details not recorded for this card
Supporting quotations
Ovia does not collect personal data through those channels, and the respective privacy policies of the social media provider will apply to your usage of those channels.
Not stated here
The respective social media providers’ privacy policies are not supplied by this source; the card cannot describe their contents.
Content & IP Rights · Company practice
Ovia may modify the Policy by posting an updated version; material changes are notified by email or in-app notification
Changes are made by posting an updated version; a notification (email or in-app) is promised when the change is “material” — non-material changes may occur without notification under this text.
Details not recorded for this card
Supporting quotations
Changes to this Policy
Ovia may modify this Policy from time to time by posting an updated version of the Policy. When we make material changes this Policy, we will notify users by email or in-app notification.
Qualifications & exceptions
Email/in-app notification is promised for material changes only.
Content & IP Rights · Context
Last updated date: June 26, 2026
The policy records its stated last-updated date: June 26, 2026.
Details not recorded for this card
Supporting quotations
Last updated: June 26, 2026
Content & IP Rights · Context
June 26, 2026 update: added AI-development statement; removed historical pre-2025 advertising use
Two principal changes are listed for this update: the AI-development use statement was added (matching the carded purpose list), and historical information about pre-June-2025 advertising data use was removed (a legacy advertising-use statement still appears in the source at the sell/share section).
Details not recorded for this card
Supporting quotations
The principal changes in this update were:
Adding statement that our use of personal data to improve products may include development of AI
Removing historical information on advertising data use that occurred before we terminated advertising in June 2025