Privacy Policy

Last updated: 14 July 2026

This policy describes what Suvo collects, how it is used, and your rights. It applies to the Suvo mobile app and this website.

Controller and contact

The controller for personal data processed under this policy is Ahmed Elzanaty, c/o IP-Management #10816, Ludwig-Erhard-Straße 18, 20459 Hamburg, Germany. Contact: hello@getsuvo.com. Our legal notice is available at getsuvo.com/impressum.html.

What we collect

• Account data: email address when you sign in.
• App data: supplements, doses, schedules, reminders, and intake records you add.
• Usage data: anonymized events about screens viewed and buttons tapped, used to improve the app.
• Device data: platform (iOS/Android), app version, and a randomly generated device identifier.

Managed-profile data

When an account holder creates a managed profile, we may collect:

• the profile's display name or nickname;
• age or date of birth, where provided;
• sex or other profile attributes used by Suvo's safety rules;
• the person's supplement stack, doses, schedules, reminders, and intake history;
• information entered for interaction, suitability, or safety evaluations;
• the relationship between the account holder and the managed profile; and
• records showing when the managed profile was created, changed, or removed.

Managed profiles do not receive separate login credentials. Their information is controlled through the account holder's authenticated account. Supplement use, health attributes, medications, conditions, and safety evaluations may be health-related data and therefore receive additional protection.

Children and managed profiles

Suvo accounts are intended for people aged 16 or older. Children may not create or independently operate a Suvo account.

An adult account holder may create a managed profile for a child where the adult is the child's parent, legal guardian, or is otherwise legally authorized to manage the child's information. The account holder controls the managed profile and is responsible for ensuring that they have the necessary authority to provide and manage that information.

We process information associated with a child's managed profile only to provide Suvo's supplement-tracking, reminder, safety-checking, and related account features. We do not use managed-profile information for targeted advertising.

Information provided about another person

When an account holder creates or manages a profile for another person, we receive that person's information from the account holder rather than directly from the person represented by the profile. The account holder must only provide information they are legally authorized to provide and manage. Where required, the account holder is responsible for making this privacy information available to the represented person or their legal representative.

How we use data and legal bases

We use ordinary personal data to create and operate accounts and managed profiles, provide requested app features, maintain security, prevent abuse, meet legal obligations, and improve optional analytics. The applicable GDPR Article 6 basis depends on the purpose and is performance of our service, our legitimate interests in secure operation and abuse prevention, consent where required, or a legal obligation.

Where managed-profile information or other app data qualifies as health data, we process it only for the requested safety and account features and rely on an applicable GDPR Article 9 condition. Where we rely on explicit consent, it may be withdrawn at any time; withdrawal does not affect processing already carried out before withdrawal. We do not use health-related data for targeted advertising.

What we do not collect

• We do not collect precise location data.
• We do not sell personal data to third parties.
• We do not run third-party advertising networks inside the app.

Third-party services

When you tap a product link inside the app, you leave Suvo and open the retailer's website (for example, Amazon). That retailer's privacy policy governs everything that happens after that point.

We use PostHog for product analytics. Analytics events must not contain managed-profile names, ages, supplement details, notes, intake history, or evaluation results.

How long we keep data

We keep account, app, and managed-profile data until it is deleted through the app or by a verified request, subject to the limited retention described on our deletion page. Encrypted disaster-recovery backups may retain residual copies for up to 35 days. Aggregated, anonymized security and operational records may be retained for up to 90 days.

Your rights and managed profiles

You may request access, export, correction, restriction, objection, or deletion of your personal data under applicable law. Exports include managed profiles associated with your account. An account holder can correct or remove managed-profile information through the app. A represented person or another lawful guardian may also contact us about their data.

We may verify identity and authority before disclosing, changing, exporting, or deleting managed-profile data. Authority disputes are not resolved automatically in favour of the person controlling the login; we may restrict or suspend access while the matter is assessed. You may also lodge a complaint with a data-protection supervisory authority, in particular the authority responsible for your habitual residence, workplace, or the place of an alleged infringement.

Use Settings → Your data in the app to export data or delete your account, or email hello@getsuvo.com if you cannot access the app. We respond to verified requests within 30 days where applicable law requires it.

Changes

We may update this policy. Material changes will be announced in the app before they take effect.