Legal
Privacy Policy
Draft pending legal review. This policy is a working draft tailored to how ANVA operates; it must be reviewed by qualified counsel before launch. Items in [brackets] need confirming. Last updated: [set on publication].
This Privacy Policy explains how Tryingtodoart SRL (“ANVA”, “we”, “us”), [registered in Romania, reg. no. / address — to confirm], collects and processes personal data when you use the ANVA website and account area at this site and the ANVA mobile application. We are the data controller for that data.
Who ANVA is for
ANVA is a clinical tool for physical therapists and similar practitioners. Accounts are held by practitioners, not by their patients. Patients do not register on or buy through this website.
What we collect
- Account data — your name, email, optional clinic/organization, and a securely hashed password.
- Billing data — handled by our payment processor, Stripe. We do not store your card number; we keep a Stripe customer reference, your plan, and basic order/subscription status.
- Reports — assessment reports are generated and anonymized in the ANVA app and stored in our cloud storage (Supabase). The website only lists your report files and serves time-limited download links. The website does not store, open, or parse report contents, and holds no patient records.
- Technical data — server logs (IP, request data) kept for security and to operate the service.
Patient data & your responsibilities
Reports are anonymized by design (e.g. identifiers such as ANVA0001), and file names are kept free of patient names. As the practitioner, you are responsible for how you map ANVA identifiers to your own patients within your own systems, and for complying with the health-data and professional rules that apply to you.
Why we process it (legal bases)
- To provide your account, subscription, and report downloads — performance of a contract.
- To take payment — performance of a contract (via Stripe).
- To keep the service secure and meet legal obligations — legitimate interests / legal obligation.
- For any optional marketing emails — your consent, withdrawable anytime.
Who we share it with (processors)
- Stripe — payment processing and subscription billing.
- Supabase — storage of your anonymized report files.
- Hosting & email providers — to run the site and send account emails. [Confirm providers + locations.]
Some processors may be outside the EU/EEA; where that is the case we rely on appropriate safeguards (e.g. Standard Contractual Clauses). [Confirm transfer mechanisms.]
Cookies
We use only essential cookies needed to sign you in and keep your session secure. We self-host our fonts and do not load Google Fonts. We do not run third-party advertising or analytics trackers by default; if that changes, we will update this policy and request consent where required.
How long we keep it
We keep account and billing records for as long as your account is active and as required by law afterwards. Report files remain until you or your app delete them, or your account is closed. [Confirm retention periods.]
Your rights
Under the GDPR you may request access, correction, erasure, restriction, portability, and may object to certain processing. You can also withdraw consent and lodge a complaint with your supervisory authority (in Romania, the ANSPDCP). To exercise any right, email contact@anva.health.
Contact
Privacy questions: contact@anva.health. Support: support@anva.health. See also our Terms of Service.