Devotion — Consumer Health Data Privacy Notice

Consumer health privacy notice

This section is Devotion’s consumer health data privacy notice. Health data includes the optional physical and mental wellness observations, reproductive health and life-stage information you supply, and calendar estimates derived from those observations. Sources are your entries and any supported device-health import you explicitly authorize. We do not buy health data or collect it from a partner in secret.

Collection and sharing are separate

Choose each health module before its data is collected. Collection supports only the requested recordkeeping and wellness tools. Partner sharing requires a separate category-level choice. General Guidance exposes only exact text you approve; Explicit Sharing exposes only selected records. You can revoke sharing or disconnect at any time. Data already viewed or copied by a recipient cannot be recalled from that person’s device or memory.

Service providers and recipients

Google Firebase Identity Platform and Google Cloud provide accounts, storage, security and optional push delivery. Google Cloud Vertex AI processes an AI prompt and the context you choose when you request AI assistance. RevenueCat and the relevant Apple, Google or web payment provider verify purchases. Google AdMob supplies non-personalized mobile ads; Android’s consent flow controls permitted ad requests. These providers receive only the data needed for their respective functions. Your linked partner receives only information you authorize or intentionally place in the shared space. We do not sell consumer health data, disclose it for advertising, or use health-location geofencing.

AI choices

Newly collected health, physiology and life-stage fields do not automatically enter AI context. Private saved memories require an explicit Use in Companion choice. Shared memory use also requires your own opt-in. Generated suggestions may use your preferences and support text your partner approved. You can edit or delete saved context and revoke permissions. AI output is optional guidance, not a medical conclusion or a statement of your partner’s hidden feelings.

Access, withdrawal and deletion

• Use Your space to export your own records and view or change sharing. Export and account deletion require a recent sign-in.
• Revoke a sharing category or disconnect to stop future partner access. Turn off a wellness module to stop using it, and delete its existing records if you also want that history removed.
• Delete individual entries or your account in Devotion. You can also request access, withdrawal, deletion or an appeal at [email protected] with the subject Devotion privacy request. Do not send your health history or password by email; we verify account ownership before acting.
• If a request is denied, you may appeal by replying with Devotion privacy appeal. We explain the outcome and any applicable regulator complaint route. Statutory privacy rights are not limited by these instructions.

Retention and security

Records persist until you delete them or a chosen expiry applies. Saved AI conversations and memories default to 90 days and support a shorter expiry; the current maximum is one year. Sharing grants default to 30 days. Security events expire after 30 days; reported shared evidence has a 90-day retention window. Account deletion immediately revokes account, invitation and partner access. Private and shared records are then physically erased in bounded background jobs; identity deletion retries if a provider is unavailable. Notification registrations expire after 30 days; billing audit records after 90 days. Purchase providers may retain transaction records under their obligations. Backup retention and deletion propagation will be verified and disclosed before public launch. Transport and cloud storage use encryption; Devotion does not claim end-to-end encryption.

Children and optional device access

Devotion is intended for adults. Family reflections do not create accounts for children. Notifications and supported device-health access are optional OS permissions, requested only for the relevant feature. Device permission is additional to, and does not replace, Devotion’s health and partner-sharing choices.

Service location

Soft Flourish is a brand of Fenul LLC in California, United States. The service is being configured in Google Cloud’s United States region. Data processed by service providers may be subject to their international processing terms. Launch jurisdictions and processor settings will be confirmed before accounts open.