What ORVI collects
Email
Display name
Preferences
Check-in data
Card interactions
Opt-in HealthKit or Health Connect
Trust is part of the product.
ORVI collects what it needs to plan your day, keeps it private, and never sells it or uses it for advertising.
DPA subject to legal reviewPrivacy-rights workflowManaged encryption at restRole-based authorization
What ORVI never does
No sale of personal data
No behavioral advertising
No health values in analytics records
No third-party behavioral analytics
Technical security
Practical controls for a wellness product.
| Measure | Detail |
|---|---|
| Encryption in transit | TLS, managed by the hosting providers |
| Encryption at rest | Managed by Supabase |
| Authentication | Email OTP and short-expiry JWTs |
| Data isolation | Backend role checks and per-account scoped queries |
| API security | Railway-hosted services with application rate limiting |
| Incident response | Notification under applicable law and signed agreements |
| Data retention | Authenticated account deletion and export workflows are available. |
| Data portability | Authenticated account-data export endpoint |
Compliance
Clear posture for privacy review.
| Framework | Status |
|---|---|
| HIPAA | Orvi is a consumer wellness service and does not claim HIPAA compliance or a business associate agreement. |
| SOC 2 | Not currently certified; reassess when enterprise demand justifies the operating cost. |
| GDPR | Data-access and deletion workflows are available; DPA terms require legal review before an enterprise contract. |
| CCPA/CPRA | Orvi does not sell or share personal information for cross-context behavioral advertising; consumer-rights workflows are available. |
| Accessibility | Accessibility is tested as part of release review; no external conformance certification is claimed. |
| Payment cards | Apple and Google process marketplace billing, RevenueCat manages entitlements, and Stripe may process separately enabled payment flows; Orvi does not store full payment-card details. |
Data Processing Agreement
Documents for legal review.
A Data Processing Agreement is not published yet. Request the current draft for review; terms require legal review before a pilot or enterprise agreement.
Request DPA reviewInfrastructure processors
SupabaseRailway
Product integrations and service providers
AppleGoogleRevenueCatStripeOpenAIAnthropicVoyage AIMux
Security questions? Email security@orvi.ai