Pavuno Privacy Policy

Effective date: October 31, 2026

This Privacy Policy explains how H23Rx, LLC, a Wyoming limited liability company ("H23Rx," "we," "us," or "our"), collects, uses, discloses and protects personal information when you use the Pavuno mobile application, website and related services (the "Service"). If you live in Washington, Nevada or another state with a consumer health data law, our Consumer Health Data Privacy Policy also applies to you and controls for consumer health data.

1. Our commitments

We do not sell your personal information, including your health information.
We do not use your health information for targeted or cross-context behavioral advertising, and we do not share it with advertisers or data brokers.
We do not use information from Apple HealthKit or Android Health Connect for advertising or marketing, and we do not disclose it to third parties except to service providers that help us operate the features you turn on.
We use your health information to provide the features you ask for, keep the Service secure, improve Pavuno, and comply with law. When we use it for research or product development, we first de-identify and aggregate it, as described in Section 5.

2. Information we collect

Information you provide:

Account information: email address, name or nickname, sign-in credentials (passwords are handled by our sign-in provider and stored in hashed form), your age confirmation, and your acceptance of our Terms and consents.
Age and guardian confirmation (for users 13 to 17): your confirmation that a parent or guardian has reviewed and agreed to our Terms, and the date and time you confirmed it.
Health and tracking information: medications, doses, schedules, dates and times taken, injection sites, symptoms and side effects, weight and body measurements, water, protein, fiber, activity, goals, daily check-ins, notes and imported historical records.
Food scanning information: barcodes you scan, food photos you submit, the nutrition estimates returned, and the portion and record you confirm.
Support communications: information you include when you contact us.

Information from connected sources (only if you turn them on):

Apple Health (HealthKit) and Android Health Connect: the specific data types you approve on your device's permission screen, such as weight, steps, activity, active energy, workouts, sleep, heart rate, resting heart rate, heart rate variability, nutrition and water.
App stores, RevenueCat and Stripe: purchase and subscription information, such as the plan, transaction identifiers, renewal status and the country of purchase. We do not receive or store your full payment card number.
Wearables and health services (when available and only if you connect them): services such as Oura or WHOOP. We receive only the data types you authorize, such as sleep, heart rate, heart rate variability and activity, under that service's terms.

Information collected automatically:

Device and usage information: device type, operating system, app version, language, time zone, IP address, approximate location derived from IP address (city or region, never precise location), app and device identifiers, and how you use the app (for example, screens viewed, features used, taps and session length).
Diagnostic information: crash reports and performance data, if diagnostic tools are enabled.
Marketing and referral information: if you arrive at Pavuno from an advertisement, link or partner, information about the campaign or source (for example, which ad or website referred you). This information does not include your health information.
Cookies and similar technologies on our website, as described in our Cookie Notice.

3. How we use information

To create and manage your account and confirm eligibility.
To provide the Service: saving, displaying and charting your records, sending reminders you set, scanning food, syncing with health platforms you connect, and creating reports and exports you request.
To process subscriptions and payments and manage your access to paid features.
To send product news, tips and offers by email or notification. You can opt out at any time; we do not send marketing to users under 18, and marketing never uses the content of your health records.
To measure the effectiveness of our marketing and understand which campaigns bring people to Pavuno, without using your health information.
To respond to support requests and send service, security, billing and legal notices.
To secure the Service, prevent fraud and abuse, and fix errors.
To understand how the Service is used, measure what works, and develop and improve Pavuno, including new features and our own AI and machine-learning models, using usage data and de-identified, aggregated data (see Section 5).
To comply with legal obligations, enforce our Terms and protect rights and safety.

We will ask for your consent before using identifiable health information for any purpose not described in this Policy.

4. Food scanning and AI processing

When you scan a barcode, the barcode number is used to look up product information in the Open Food Facts database and, if no match is found, the U.S. Department of Agriculture's FoodData Central database. These lookups do not include your name, email or health records. When you submit a food photo, the photo is sent to Google's Gemini API to generate a nutrition estimate. We use Google's paid API service, under which Google does not use the content we submit to train its models. We do not keep the photo after the estimate is returned. The estimate is added to your records only if you tap Save.

5. De-identified data, research and insights

Like most health and wellness apps, we learn from how Pavuno is used so we can make it better and contribute to a better understanding of GLP-1 and peptide experiences.

What we create. We may create de-identified, aggregated information from the information we collect, for example average weekly protein intake among people on a weekly GLP-1 medication, or how often a symptom is logged in the first month. Before data is used this way, we remove names, email addresses, account and device identifiers, notes and other free-text fields, and food photos, and we combine it with other users' data so it cannot reasonably be linked to you.
How we use it. To improve and develop Pavuno, train and evaluate our own features and models, publish insights and reports, and support population-level research into medication, nutrition, activity and wellness trends.
Who we share it with. We may share de-identified, aggregated information with research partners, academic institutions, healthcare and life-sciences organizations, and the public. Recipients must agree not to try to re-identify anyone. We do not attempt to re-identify de-identified information.
Apple Health and Health Connect data. Data imported from Apple Health or Android Health Connect is not used for research or shared with research partners, even in de-identified form, unless you separately opt in.
Your choice. You can turn off the use of your data for research and insights at any time in Settings > Privacy. Insights already created from de-identified data before you opt out cannot be removed, because they can no longer be linked to you.
Identifiable research. If we ever invite you to take part in a research study that uses identifiable information, we will describe the study and ask for your separate, express consent first. Taking part is always optional.

6. How we disclose information

We disclose personal information only as described below:

Service providers that process information on our behalf under contracts that limit their use of it to providing services to us. These include cloud hosting and database providers, sign-in and authentication providers (such as Clerk), RevenueCat (subscription management), Stripe (web payments), Google (AI food-photo analysis), food databases (Open Food Facts and USDA FoodData Central, which receive barcode numbers only), email and notification delivery providers, customer support tools, and analytics, crash-reporting and marketing-measurement providers. We configure analytics, crash-reporting and marketing-measurement tools so that they do not receive the content of your health records, medication names, doses, symptoms, weight, food photos or nutrition records. A current list of our main service providers is available at pavuno.app/legal/service-providers.
App stores (Apple and Google) for purchases you make through them.
Services you connect. If you connect a wearable or health service, we exchange information with it as needed to provide the connection you asked for.
Research partners and others (de-identified data only), as described in Section 5.
People you choose. When you export, print or share a report, it goes to the recipient you choose.
Legal and safety reasons: when required by law, subpoena or court order, or when we believe in good faith that disclosure is needed to protect the rights, property or safety of you, H23Rx or others. Where the law allows, we will notify you before disclosing your health information in response to legal process.
Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this Policy's protections. We will notify you before your information becomes subject to a different privacy policy.

7. HIPAA

H23Rx is not a healthcare provider or health plan, and Pavuno is a consumer app that you use for yourself. In most cases, information you enter in Pavuno is not protected by the Health Insurance Portability and Accountability Act (HIPAA). It is protected by this Policy, the Consumer Health Data Privacy Policy, and applicable consumer privacy and health data laws, including the Federal Trade Commission's Health Breach Notification Rule.

8. Security and breach notification

We use administrative, technical and physical safeguards designed to protect your information, including encryption of data in transit and at rest, access controls that limit employee and contractor access to what their role requires, and authentication requirements. No system is perfectly secure. If a breach of security affects your health information or other personal information, we will notify you, and the Federal Trade Commission and other authorities where required, as required by the FTC Health Breach Notification Rule and applicable state law.

9. Retention and deletion

Account and health records: kept while your account is active, until you delete them or your account.
After you delete your account: your account is closed right away. You are signed out, you can no longer sign in, and your sign-in is removed. Your records are locked: they are no longer shown in or used by the app, and they are not used for marketing or shared. We keep locked records only as long as needed to meet legal obligations, resolve disputes and protect our legal rights, and then delete them. Where the law gives you the right to have your records erased rather than locked, email support@h23rx.com and we will erase them within 30 days of confirming your identity; backup copies are overwritten within 90 days after that.
Food photos: not stored after the estimate is returned.
Purchase and tax records: kept for up to 7 years as required for accounting and tax purposes.
Security and audit logs: kept for up to 12 months unless needed to investigate an incident.

We may keep information longer when required by law or to resolve a dispute, and we may keep information that has been de-identified so it can no longer reasonably be linked to you. We will not attempt to re-identify de-identified information.

10. Your choices and controls

Access, correct and export: view and edit your records in the app and export them as PDF, CSV or JSON.
Delete: delete individual records, or delete your account in the app (You > Delete Account). See section 9 for what happens to your records, and pavuno.app/legal/delete-account. Deleting your account does not cancel a subscription; see the Subscription, Trial and Cancellation Terms.
Health platform permissions: change or revoke Apple Health or Health Connect access in your device settings. Revoking access stops future syncing but does not delete data already imported; you can delete that data in the app.
Camera and notifications: manage these in your device settings.
Research and insights: turn off the use of your data for research and insights in Settings > Privacy.
Analytics and marketing measurement: turn off optional analytics and marketing measurement in Settings > Privacy.
Email: we send service and account emails. If we send promotional emails, each one will include an unsubscribe link, and we will not send them to users under 18.

11. Your state privacy rights

Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with consumer privacy laws), you may have the right to: know what personal information we collect, use and disclose; access a copy of it; correct it; delete it; receive it in a portable format; and opt out of the sale of personal information, targeted advertising and certain profiling. We do not sell personal information or use it for profiling that produces legal or similarly significant effects. If our marketing-measurement tools count as "sharing" or "targeted advertising" under your state's law, you can opt out in Settings > Privacy, by emailing support@h23rx.com, or with a Global Privacy Control signal; these tools never receive your health information. Where required, we obtain your consent before processing sensitive personal information, such as health information, and you may withdraw that consent.

How to make a request. Use the privacy controls in the app or email support@h23rx.com. We will verify your identity by confirming control of the email address on your account and may ask for additional information if needed. You may use an authorized agent, who must provide written permission from you; we may still ask you to verify your identity. We will respond within 45 days, and may extend that period by 45 days where permitted by law with notice to you.

Appeals. If we deny your request, you may appeal by replying to our decision or emailing support@h23rx.com with the subject line "Privacy Appeal." We will respond to the appeal within the time required by law. If you are not satisfied, you may contact your state attorney general.

Non-discrimination. We will not deny you service, charge you a different price, or provide a different quality of service because you exercised a privacy right.

Global Privacy Control. Our website and app treat a Global Privacy Control signal as a valid request to opt out of the sale or sharing of personal information and of targeted advertising.

California "Shine the Light." We do not disclose personal information to third parties for their own direct marketing purposes.

12. Users aged 13 to 17

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it promptly. If you believe a child under 13 has used the Service, contact support@h23rx.com.

Users aged 13 to 17 may use the Service if they confirm that a parent or guardian has reviewed and agreed to our Terms. For these users, we do not send marketing, sell their information, use it for targeted advertising or marketing measurement, include their information in research and insights, or offer peptide tracking features. A parent or guardian may contact support@h23rx.com to ask for access to or deletion of the minor's account after we verify their identity and authority, subject to any confidentiality rights the minor has under applicable law.

13. Where information is processed

H23Rx is based in the United States, and the Service is intended for users in the United States. Your information is processed in the United States and may be processed in other countries where our service providers operate, subject to contractual protections.

14. Changes to this Policy

We will post any changes to this Policy with a new effective date. If a change materially affects how we use or disclose health information collected earlier, we will notify you in advance and, where required by law, ask for your consent.

15. Contact us

H23Rx, LLC 777 Brickell Ave, Suite 500, Miami, FL 33131 Email: support@h23rx.com (please use the subject line "Privacy request" for privacy matters) Website: pavuno.app