Privacy policy

Who we are

Adaven is made by Avalen LLC. Write to us at hello@adaven.ai about anything in this policy.

What Adaven holds

• Your account. The name and email address of the Google account you sign in with. Adaven never stores a password.
• Your health record. Results and records you connect from a provider, collect from your phone’s Health app, upload as a document, or type in yourself.
• Technical logs. Which actions happened and when, with a random reference number. Logs never contain health information.
• An access log you can read. Every time your record is read or written, by you or by the system on your behalf, is recorded, and that record is kept where it cannot be edited.

What Adaven does with it

• Keeps your record and shows it to you, and to any person you explicitly name.
• Reads from the providers you connect. Connections are read-only; Adaven never changes anything at a provider and never sees your provider password.
• When a document you upload is read by software to pull out the values, that software is Google Cloud’s enterprise service configured to keep nothing, and every value it finds waits for you to confirm it before it enters your record.

What Adaven will never do

• Sell your information, or use it for advertising.
• Share it with anyone you have not named.
• Read more from a provider or a device than you allowed.
• Keep a readable copy after you delete your record.

Where it lives and how it is protected

Your record is stored on Google Cloud in the United States under a healthcare data agreement (a Business Associate Agreement) between Avalen LLC and Google. Each person’s record is encrypted with its own key, created for that person alone. The system reaches a record only through a short-lived credential tied to that one person, so a mistake in one place cannot expose another person’s record.

Your rights

• See everything. Your record and the access log are yours to read in full.
• Take it with you. Your record is kept in the open medical standard (FHIR) and can be exported in that form.
• Disconnect a provider at any time. The records already collected stay in your record until you remove them.
• Delete your record. Deletion destroys the key your record was encrypted with. Nothing readable is left behind, including in backups.

Cookies and technical data

Adaven sets one cookie: the signed-in session. There are no advertising or analytics cookies and no third-party trackers. Our servers record the usual technical information needed to run a website (such as your IP address, browser type and the time of a request) for security and troubleshooting, and keep it only as long as needed for that.

Service providers

Adaven runs on Google Cloud, which processes data on our behalf under a written agreement that includes healthcare data protections. Sign-in is provided by Google. We do not use any other company to process your health information. If that changes, this policy will be updated before it does.

Legal requests

We will disclose information only when a valid legal process requires it. Because your record is encrypted with a key that exists only for you, what we could hand over without your participation is limited, and we will tell you about any request unless the law forbids it.

Retention

Your record is kept until you delete it. Account details are deleted when you delete your record. Backups that held your data become unreadable when your key is destroyed, and are purged on their normal schedule.

Security

We use encryption in transit and at rest, per-person keys, short-lived credentials, an unalterable access log and independent cloud infrastructure protections. No system is perfectly secure, and we cannot promise that unauthorized access will never occur. If a breach affects your information we will notify you without undue delay and as the law requires.

Your choices under privacy laws

Wherever you live, you can see, export, correct and delete your information through Adaven itself. Residents of places with specific privacy laws (for example California or the European Economic Area) have those rights too, and can exercise them by writing to hello@adaven.ai. We do not sell or share personal information for advertising, so there is nothing to opt out of.

Children

Adaven accounts are for adults. Records for children will be handled through a parent or guardian in a later version, and this policy will say so when that is available.

Changes

If this policy changes, the new version is published here with its date. Changes that reduce what Adaven promises will be announced to signed-in people before they take effect. Continued use after a change means you accept it.

Contact

Avalen LLC, hello@adaven.ai.