ArivitPrivacy Notice
Data Controller
The data controller is Andrea Gigante, acting as an individual. Contact: privacidad@arivit.app. During the private testing phase the controller is the individual named above. When the planned company (Azafea) is incorporated it will become the controller of this same data for the same purposes; we will tell you its identity before the change happens.
Purposes of Processing
We process your personal data for the following purposes: providing the Arivit personal safety service, detecting inactivity and emergencies through automated processing, sending safety alerts to your chosen trusted contacts, maintaining your account and subscription, and improving our service quality and reliability.
Data We Collect
We collect the following categories of personal data: name, email address, phone number (optional), battery level, heartbeat timestamps (used to derive inactivity), IP address and user agent (session data), device push notification tokens, device model and operating system (shown to your trusted contacts to help them provide support; no unique device identifier is collected), and medication reminder data (Art. 9 explicit consent required).
If someone has added you as a trusted contact
If someone who uses Arivit has added you as a trusted contact, we process your name and contact details (email and, if they provided it, phone number). Where they came from: the person who added you gave them to us; we did not collect them from you. What for: to send you their invitation and, if you accept, the safety alerts that person configures. Legal basis: our legitimate interest, and theirs, in their trusted contacts being reachable (Art. 6(1)(f) GDPR). How long: the invitation expires after 24 hours; if you do not accept it, your email address is removed from it 7 days after it expires. If you accept, we keep your details for as long as you remain a trusted contact. Your rights: those described below and, in particular, the right to object at any time to receiving alerts; you can stop being a trusted contact in the app.
Special Category Data (Article 9 GDPR)
We process special-category data under Article 9(2)(a) of the GDPR with your explicit consent. Emotional wellbeing data (currently active): we collect the mood you choose to share, picked from a small set of feelings, when you choose to share how you are feeling. This data is shared only with your nominated trusted contacts. In the app you can see a recent window of your own mood history (the length depends on your plan). A protected (blocked) copy is kept for no longer than a legal claim could still be brought about it, because the law may require us to answer one, and then it is deleted. Withdrawing consent stops sharing immediately and you can still see your own history. To withdraw consent, go to Settings > Privacy. Medication data (only if the medicines feature is enabled for your account): the medicines and schedules you record, which we use to remind you; this is health data and is processed on the same explicit-consent basis.
Legal Basis
We process your data on the following legal bases under GDPR Article 6: (a) your explicit consent for health data (Art. 9(2)(a)); (b) performance of the contract to provide the Arivit personal safety service, which includes detecting inactivity and the other events you configure and sending alerts to your trusted contacts; (f) our legitimate interest in preventing fraud, keeping the service secure and improving it, and in the trusted contacts you nominate being reachable.
Location Data
Arivit does not collect, store or process location data, and the app requests no location permission. If a location feature is introduced in the future, it will ship only after a completed Data Protection Impact Assessment (Art. 35) and with its own explicit opt-in.
Calendar
If you use the calendar, we store the events you create: the title, the place (optional), the date and time, and whether they repeat. We use them only to show and remind you of the events you schedule. The calendar is a general organiser, not a medical tool. Legal basis: providing the calendar feature you have chosen to use (Art. 6(1)(b) GDPR). We do not process special-category data. Retention: past occurrences are deleted automatically after ~90 days; events are kept until you delete them or close your account, at which point they are removed. Incidental health data: we do not ask for or analyse health information in the calendar. If you choose to write a health-related word in an event, we do not interpret or classify it. We recommend noting only what is essential.
Recipients and Processors
Your data may be shared with the following processors for the stated purposes: Firebase Cloud Messaging (Google) for push notification delivery to trusted contacts; Scaleway TEM for email alert delivery; Twilio for SMS alert delivery to trusted contacts who have verified a mobile number and have not opted out of SMS; and OVHcloud (France) for application hosting infrastructure. All processors are bound by Data Processing Agreements (DPAs) and process data only on our instructions.
International Data Transfers
Firebase Cloud Messaging (Google) may process push notification tokens on servers outside the EU. These transfers are protected by Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework. Twilio SMS delivery uses EU gateways for EU phone numbers with SCCs in the DPA. Scaleway TEM (email) and OVHcloud (hosting) are located in France, EU. No personal data is transferred outside the EU for hosting or email processing.
Automated Processing
Arivit uses automated processing to react to events you configure: inactivity detection (no heartbeat received beyond your configured threshold), battery-level monitoring, and the wellbeing thresholds you configure. These automated systems trigger notifications to your chosen trusted contacts - they do not make legal or similarly significant decisions about you (Art. 22). Your trusted contacts review the alerts and decide what action to take.
Data Retention
We retain your personal data as follows: heartbeat data for 90 days (automated monthly pruning); emotional wellbeing (mood) data under a defined lifecycle: shown in-app for a recent window depending on your plan, then kept as a protected/blocked copy, for no longer than a legal claim could still be brought about it, and then deleted; alert history for the duration of your account; account and profile data for the duration of your account; session tokens expire on sign-out or after 30 days of inactivity; device push tokens are retained until account deletion or token rotation; trusted-contact invitations expire after 24 hours and, if not accepted, the invited email address is cleared from them 7 days after expiry. On account deletion, all personal data is anonymized or deleted immediately. Admin actions performed on your account (e.g. account suspension, GDPR rights request fulfilment) are logged to an internal audit register. We retain these records for 7 years under Article 5(1)(e) GDPR storage-limitation principle and Article 30 record-keeping requirements. In an active investigation or legal proceeding, specific log ranges may be preserved for up to 10 years under a documented legal hold. You can request a summary of audit-log entries pertaining to your account via our standard rights-request flow.
Your Rights
Under GDPR Articles 15-22, you have the right to: access your personal data (Art. 15), rectify inaccurate data (Art. 16), request erasure of your data (Art. 17), restrict processing (Art. 18), data portability (Art. 20), and object to processing (Art. 21). Where processing is based on your consent, you have the right to withdraw consent at any time (Art. 7(3)) without affecting the lawfulness of processing carried out before withdrawal. To exercise any of these rights, contact us by email at privacidad@arivit.app.
Supervisory Authority
You have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) at www.aepd.es, which is the competent supervisory authority for Spain. If you reside in another EU member state, you may also lodge a complaint with your local data protection authority.
Contact
For any questions about this privacy notice or to exercise your data protection rights, please contact our data protection team by email at privacidad@arivit.app.
This website uses no cookies. It stores only your light or dark mode preference in your browser's local storage, and only when you change it. No analytics or tracking cookies or technologies are used.