How we keep your data safe
The short version
- Your record is encrypted in transit and at rest, on servers in the United Kingdom.
- We never sell your data. Not to anyone, ever.
- We never share your health information with advertisers, employers, or insurers.
- Only your signed-in account can read your logs, documents, and reports.
- Your journal is encrypted on your device before it is saved.
- Analytics records which screens you open - page views only - and stays off unless you turn it on.
- You can export or permanently delete everything from Settings.
How your data is protected
Orvella stores your symptom logs, daily entries, medications, documents, and reports in the United Kingdom (London). Data is encrypted in transit with TLS, and encrypted at rest with AES-256. That includes files you upload. Encryption at rest is always on and cannot be turned off.
This is the same protection that applies to the rest of your Orvella account. We do not ask you to manage an extra encryption key for documents or logs.
Who can reach it
Access is limited to your signed-in account. Database rows are scoped to you, so another user cannot read your logs. Documents sit in a private store, in a folder named for your account. Opening a file uses a short-lived signed link that expires after ten minutes.
Staff at Orvella do not look at your health record as part of day-to-day work. Support can only help with what you choose to send us.
The encrypted journal
Journal entries are encrypted on your device before they are saved. Orvella stores only the encrypted text, so we cannot read it. The key stays on this device. If you lose the device or reinstall without a backup that includes that key, those entries cannot be recovered by us. Journal entries also stay out of doctor reports, patterns, and trends.
What we never do
- We never sell your personal information, to anyone, for any purpose.
- We never share your health information with advertisers, employers, or insurers.
- We do not show ads, and we do not use your health entries to advertise to you.
- We do not use your health entries to profile you or to train AI models.
- Reports and patterns are calculated from your own log. They are not generated by an AI model.
Analytics and crash reports
Product analytics is off unless you turn it on. When it is on, it records which screens you open and which published community articles you read - page views only. It never includes logs, notes, names, symptoms, or any health information. Session replay is off.
Crash and diagnostic reports stay on so we can keep the app stable. They never include health information, names, or notes. You can turn both of these off in Settings > Privacy.
Suppliers we rely on
We use a small number of suppliers to run the app: hosting and storage, crash reports, optional product analytics, and subscription billing. They act only on our instructions. They are not given your data to sell or advertise with. The full list is in our Privacy Policy.
Your controls
- Export a copy of your data from Settings > Account.
- Permanently delete your account and logged data from Settings > Account.
- Turn analytics and crash reports on or off in Settings > Privacy.
- Lock the app with Face ID, a fingerprint, or your device passcode.
- Use discreet notifications so lock-screen copy does not name what a reminder is about.
How to report a security issue
If you think you have found a vulnerability, email privacy@orvellaapp.com. Please do not post details in a public place. We will acknowledge your report and work to fix any confirmed issue.
For account or privacy questions, use the same address or our support form.