YOUR DATA, YOUR CHOICES
Privacy Policy
1. Your records and photos stay on your device. They go to the cloud only if you turn on backup.
2. On iPhone, backed-up photos are end-to-end encrypted. Health records in the cloud have the provider's encryption, not end-to-end encryption.
3. AI meal analysis sends only the photo or text you choose, and only after you allow it.
4. We do not sell your data, we show no ads, and we never use health data for advertising.
5. In the app you can correct, export and delete your data. Anything else, you can ask us by email.
Read our Consumer Health Data Privacy Policy (section 20), which covers Washington, Nevada, Connecticut and the rest of the United States, and section 19, which covers HIPAA, health breach notification, your state privacy rights and California.
1. Who is responsible for your data
leve is an app for adults taking GLP-1 class medications. It records your treatment, weight, routine and side effects, and gives you readings based on those records.
leve is developed and operated by Carlos Henrique Borges, an individual residing in Brazil who does business as Alvor Labs. He is the controller of the personal data processed in leve under Brazil's General Data Protection Law (Law No. 13,709/2018, the LGPD). Address: Rua Doutor Guomide, 002. Email: alvorlabs@icloud.com.
He is also the data protection officer under article 41 of the LGPD, at the same email.
This policy covers the leve iPhone app, the web demo version of the app and the website useleveapp.com.br. There is no Android app yet. It describes our practices under the LGPD without excluding any mandatory privacy right you have where you live. If you live in the United States, sections 19 and 20 add what U.S. laws require. If you live in Mexico, the Spanish version is also our full privacy notice under Mexican law.
2. What data we process
We process only what the app needs to work and the purposes in section 4. An account is optional: without one, your records stay only on your device.
2.1. Health data (sensitive personal data)
The LGPD treats data about health as sensitive personal data (article 5, II). This is the health data the app handles:
| Category | What it includes |
|---|---|
| Treatment | medication, dose, frequency, injection day and time, start date, dose changes and tracking pauses |
| Injections | date, time, dose and site of each injection |
| Body | weigh-ins, height, age (the number only), sex, estimated body-fat percentage, starting weight and goal weight |
| Side effects | the side effects you log, with intensity and date |
| Routine | foods and protein you log (name and grams), water, sleep, exercise and strength training, steps and active energy (when they come from Apple Health) and weekly check-ins |
| Conditions you report | your setup answers about type 2 diabetes, high blood pressure, high cholesterol or triglycerides, sleep apnea, polycystic ovary syndrome (PCOS), kidney or liver disease, severe reflux or gastroparesis, family history of medullary thyroid cancer (or MEN2), pancreatitis, gallbladder problems, pregnancy or breastfeeding, and use of insulin or sulfonylureas; they are used to adapt guidance, the protein goal and your report |
| Plan | goals and commitment chosen at setup, chosen pace, strength-training level, protein goal, and whether you already take the medication or are about to start |
| Progress photos | pictures of your body, with the date |
| Meal photos | the meal photo you save in a food entry |
At setup, your date of birth is used only to calculate your age, and your profile keeps only the age. The setup draft, which keeps your answers until you finish, stays on your device and is deleted when you finish, start over, or after 7 days.
2.2. Account data (only if you create an account)
| Account type | What we process |
|---|---|
| "Save to cloud" | a random identifier only; this account has no email and no name |
| Sign in with Apple | your Apple identifier, the email Apple provides (it may be Apple's relay address if you choose to hide yours) and your name, if you share it |
| Sign in with Google | your Google identifier and the email and name provided by Google |
| Sign in with email | your email address and the 6-digit code we send to confirm access |
"Protect with Apple" links your Apple account to the account created by "Save to cloud", keeping the same identifier. On iPhone, your account session is kept in the device Keychain.
2.3. Usage and technical data
| Category | What it includes |
|---|---|
| Usage statistics | the events listed in section 8, each with a random device code, the app version and the operating system; no health values |
| Analysis request code | a random device code sent with each meal analysis request |
| Connection data | as with any internet connection, our service providers receive your IP address and technical connection data when the app or the website talks to them |
2.4. Subscription data
Purchases are made on Apple's App Store. We do not receive, see or store your card number, bank details or billing address. Through RevenueCat we receive your subscription status (active, in free trial, canceled or expired), the product, the dates and the transaction identifier. RevenueCat also receives your answer to "How did you hear about leve?", the referral code you typed and, on iPhone, Apple's ad attribution token (AdServices), which tells whether you came from an ad on the App Store, without an advertising identifier.
2.5. Support
If you write to us, we process your email and your message to reply and keep a record of the conversation.
2.6. What we do not process
The app does not use your location, does not read your contacts and does not use the iPhone advertising identifier (IDFA). We do not track you across other companies' apps or websites, which is why the app does not ask for the iPhone tracking permission. Your device language and region are read on the device to choose the app language and emergency numbers; when the app is in English or Spanish, the language goes with a meal analysis request so the answer comes back in that language.
3. Where the data comes from
- From you, at setup and in every entry you make.
- From your device, for the usage and technical data in section 2.3.
- From Apple Health, only if you allow it, type by type, on the iPhone permission screen. leve can read weight, height, body-fat percentage, sleep, workouts, exercise minutes, active energy, steps, water and protein; the first time it reads, it looks back up to 60 days. With your permission, it also writes to Apple Health the weigh-ins, sleep, workouts, water and protein you log in leve. You can turn each type off in Profile › Settings › Privacy and integrations › Apple Health and revoke access in the iPhone Health app. We never use Apple Health data for advertising, marketing or data mining.
- From Apple and RevenueCat, for your subscription status and App Store ad attribution.
- From Apple or Google, when you sign in with one of those accounts (section 2.2).
We do not buy lists, we do not enrich your profile with third-party data, and we do not scrape data from the internet.
4. How we use data and on what legal basis
The LGPD requires a legal basis for each purpose. For health data, the bases are those in article 11.
| Purpose | Data used | Legal basis (LGPD) |
|---|---|---|
| Make the app work on your device: keep your records, calculate trends, projections, pace and readings, send the reminders you turned on and build the PDF report | health, treatment, body, routine, conditions and plan (section 2.1) | this data stays on your device and does not reach us (section 4.1); the app uses it there to provide the service you signed up for: performance of a contract (art. 7, V) and, for health data, the regular exercise of rights under a contract (art. 11, II, "d") |
| Keep a cloud backup and let you switch devices | your records and, with separate authorization, progress photos and saved meal photos | consent (art. 11, I), given by an action of yours, with the authorization sentence next to the button (section 5.1) |
| Estimate the foods and protein in a meal | the photo or text you send at that moment | consent (art. 11, I), requested on the "Use AI to analyze your meals?" screen before the first analysis (section 6.1) |
| Read and write Apple Health data | the types you allow | consent (art. 11, I), given on the iPhone permission screen, type by type |
| Usage statistics: know whether the app works, where people give up and how many subscribe | usage events with a random device code, with no health values (section 8) | legitimate interest (art. 7, IX), with minimization and pseudonymization; you can object (section 8.1) |
| Know where subscriptions come from | your answer to "How did you hear about leve?", the referral code you typed and Apple's ad attribution token, without an advertising identifier | legitimate interest (art. 7, IX); you can object by email (section 12.2) |
| Create and keep your account, if you create one | the data in section 2.2 | performance of a contract (art. 7, V) |
| Grant and keep your subscription, prevent fraud and abuse | subscription status, account or purchase identifier and, at the analysis service, your IP address, used only to limit attempts | performance of a contract (art. 7, V) and legitimate interest (art. 7, IX) |
| Tell people who asked on the website when the Android app launches | email, platform, source and page (section 15) | consent (art. 7, I), given when you send the form |
| Reply to you and keep a record of support | email and message | performance of a contract (art. 7, V) and legitimate interest (art. 7, IX) |
| Comply with legal obligations and defend rights in legal proceedings | the minimum necessary | art. 7, II and VI; art. 11, II, "a" and "d" |
4.1. Health data that stays on your device
The health data you enter at setup and in your entries is stored on your device. While it stays there, we do not receive it and have no access to it. Today the app has no dedicated consent screen for this data, so we do not present consent as the basis for using it on your device. It leaves your device only through an action of yours: turning on backup (section 5) or asking for a meal analysis (section 6). Each of these asks for your permission, with a notice on the screen, and you can withdraw it whenever you want (section 12).
4.2. If you say no
Without the basic treatment data (medication, dose and weight), the app cannot build your plan or readings. You can decline the optional features (account, backup, photos in backup, meal analysis, Apple Health, reminders and trend sharing) and keep using the rest of the app.
We do not sell your data. We show no ads. We do not use your data for targeted advertising, ours or anyone else's. We do not share health data to obtain an economic advantage, which article 11, §4 of the LGPD prohibits. We do not send your data to insurers, health plans, employers, pharmaceutical companies or data brokers. We do not use your data to train artificial intelligence models. The app contains no advertising or tracking SDKs.
5. Cloud backup and photos
5.1. When backup turns on
- "Save to cloud", at setup or in Profile › Settings › Account and backup: creates an account with no email or name and turns on records backup. On iPhone, it also turns on photo backup with end-to-end encryption. The sentence next to the button says so before you tap: "By tapping Save to cloud, you authorize backup of your health data and your photos. Your photos are encrypted on your iPhone before upload."
- Creating an account or signing in with Apple, Google or email: turns on records backup, and the screen says so beforehand. Photos require separate permission.
- "Enable backup on this account", in Account and backup, when you already have an account and backup is off.
5.2. What goes to the cloud
With backup on, the app keeps a copy of your records at Supabase, on servers in the United States: profile, injections, weigh-ins, daily log, foods, exercise, check-ins and achievements, including data that came from Apple Health. The copy is sent a few seconds after each change and when you open the app, if you are online. There is one copy per account, and each upload replaces the previous one.
Health records are not end-to-end encrypted. They are encrypted in transit, encrypted at rest by the provider, and protected by access rules that let only your account read your copy. Your Copilot history does not go to the cloud.
5.3. Photos in backup
On iPhone, progress photos and saved meal photos are encrypted on your device before upload, with 256-bit AES-GCM (end-to-end encryption). Supabase receives only the encrypted content and a few unencrypted details about each photo: type (body or meal), date and time, size and file check codes. The key is stored on your iPhone and, with iCloud Keychain on, syncs through your iCloud. We do not have that key and cannot see the content of your photos. The app shows a recovery code after you confirm your identity with Face ID or your iPhone passcode. Keep that code.
To recover the photos on another iPhone, you need to sign in to the same leve account and have the key in the same iCloud, or enter the recovery code. With the no-email account, getting back to the same account on a new iPhone depends on the session saved in your iPhone Keychain coming along (iCloud Backup, an encrypted computer backup or Quick Start) or on having used "Protect with Apple". Email alone does not recover the key. Without the key and without the code, we cannot open those photos for you.
Outside the iPhone (for example, in the web version), there is no end-to-end protection. There, photos go to the backup only if you tap "Include photos without end-to-end encryption", and the screen tells you they will have only the provider's encryption.
Automatic cleanup. After each confirmed upload, the app deletes from the cloud the photos that the copy no longer uses and that are more than 24 hours old, such as photos you deleted in the app and older copies without end-to-end encryption. Backup does not send body photos to AI and does not use them to train any model.
5.4. Pausing, uninstalling and your own iPhone backup
"Pause automatic backup" stops uploads and removes your backup authorizations, but the last copy stays in the cloud until you delete your account or use "Start over from scratch". Deleting the app does not delete the cloud copy. On iPhone, your account session stays in the Keychain even after you delete the app: if you install it again, the app finds the copy and offers to bring it back.
Records and photos stored on your device may be included in the backup you make of your own iPhone (in iCloud or on a computer), under your Apple account and Apple's rules. Apart from the photo key in iCloud Keychain, leve does not use iCloud to store your data.
6. Meal analysis, Copilot and sharing
6.1. Meal analysis with AI
Before the first analysis, the app asks "Use AI to analyze your meals?" and explains that the meal photo or description goes to Groq, the artificial intelligence provider, under zero data retention. Your permission applies to later analyses on that account and device. You can revoke it in Protein › AI Privacy, and the app will ask again before the next analysis.
For each analysis, the app sends over an encrypted connection to our analysis service, which runs on Cloudflare, the reduced photo (a JPEG of up to 1280 pixels on the longest side; if reducing fails, the original photo) or the text you wrote (3 to 600 characters). Along with it go: proof that you subscribe (the session of an account with Apple, Google or email, or your RevenueCat identifier), a random device code and, when the app is in English or Spanish, the language. The service checks your account at Supabase or your subscription at RevenueCat, uses your IP address only to limit attempts, and sends Groq only the photo or text, with the analysis instructions and no identifier of yours.
The analysis service does not store the photo or text, and its technical logs do not include the meal content. leve's Groq account is set to zero data retention: Groq processes the content to return the estimate and does not keep it. The answer comes back in the app language, is an estimate and can be wrong: you review it before saving. The photo you save in the entry stays on your device and goes to the backup only with the authorization in section 5. Progress photos and backups never go to AI.
Today the analysis uses Groq. If we change providers, we will update this policy and ask for your permission again in the app before sending any meal to the new provider.
6.2. Guided Copilot
The Copilot offers ready-made questions and builds its answers on your device, from your records and reviewed content. It does not use the internet or any AI provider, it is not a free chat, it is not a medical consultation, and it does not change doses or prescriptions. Its history stays only on your device, outside the backup, and is removed with Delete conversation.
6.3. Report, trend sharing and reminders
The PDF report is generated on your device and leaves through the iPhone share sheet, to whomever you choose. We do not receive the report. "Share my trend" also creates the image on your device: weight numbers appear only if you turn on "Show weight numbers", and the image goes only to whomever you choose. Reminders are local notifications scheduled on your iPhone, with no notification server.
7. Automated readings
leve uses automated calculations to produce weight trends, goal projections, pace, patterns between side effects and the dose cycle, an estimated medication level and food estimates. These readings are informational: they are not a diagnosis or a prescription, they are not a promise of any result, and they do not replace a healthcare professional. Estimates and projections can be wrong.
None of these readings produces legal effects. You can still ask us to review any reading and to explain the criteria used, under article 20 of the LGPD, by writing to the contact in section 18.
8. Usage statistics
To know whether the app works and where people give up, leve records usage events. Each event carries the event name, a random code created on your device, a short detail when there is one, the app version, the operating system (iOS or web) and the time. Events are stored in a leve table at Supabase, in the United States, to which the app can only add rows, never read them.
The events are: app opened, sent from the first time the app opens; setup started and completed; subscription screen shown, with the selected plan; subscribe tapped; subscription started, with or without a free trial; offer code redeemed; entry saved; AI analysis (photo or text); report generated; week closed; trend image shared (whether weight numbers were shown, yes or no, never the numbers); and subscription gift sent, when that feature is available. Setup and subscription screen events also carry your answer to "How did you hear about leve?" and the referral code you typed, if any.
What is never sent: no health values (weight, dose, side effect, meal or photo), and no name, email or account identifier. The device code is not linked to your account. Test versions of the app and testing on a computer send no events. Without a connection, up to 20 events wait on your device and go with the next upload.
8.1. How to turn it off
Starting with app version 1.0.4, you can turn it off in Profile › Settings › Privacy and integrations › Usage statistics. The switch is on by default. When it is off, no event leaves your device, and any events waiting in the queue are discarded. Versions up to 1.0.3 do not have this switch: you can object by email, and we will explain the limit in section 8.2. Updating the app and turning the switch off solves it.
8.2. Events already sent
Because the device code is random and not linked to you, we cannot find one person's events to show, correct or delete them, even on request. That is why we do not promise to delete events that were already sent. They carry no name, email or health data, and they are deleted automatically when they turn 24 months old. "Start over from scratch" changes the device code, so later events are not linked to earlier ones.
9. Where data is kept and for how long
| Data | Where | How long |
|---|---|---|
| Health records and profile | on your device | until you delete them; the daily log keeps the last 120 days with entries, and the food list the 300 most recent items |
| Setup draft | on your device | until you finish setup, start over, or 7 days pass |
| Copilot history | on your device | until "Delete conversation" or "Start over from scratch" |
| Cloud copy of your records | Supabase (U.S.), only with backup on | until you delete your account or use "Start over from scratch"; pausing backup keeps the last copy |
| Progress and meal photos | on your device and, if authorized, at Supabase (U.S.) | on the device, until you delete them; in the cloud, until the photo leaves the copy (the cleanup in section 5.3 removes it after 24 hours), until you delete your account, or until you use "Start over from scratch" |
| Account | Supabase (U.S.) | until you use "Delete account and data in the cloud" or ask us by email; "Start over from scratch" deletes the copy, not the account |
| Usage statistics | Supabase (U.S.) | deleted automatically at 24 months |
| Photo or text sent for analysis | in transit only | not stored by the analysis service or by Groq |
| Meal analysis permission | on your device | until you revoke it |
| Subscription | Apple and RevenueCat (U.S.) | while you have a subscription and, after that, until you ask us to delete your RevenueCat record; Apple keeps your purchase history under its own rules |
| Support messages | leve's email inbox (iCloud) | as long as needed to resolve your request and keep a record of it |
| Android waitlist | Supabase (U.S.) | while the list is used for the Android launch notice, or until you ask to leave |
When the period or purpose ends, the data is deleted or anonymized, except where the law requires us to keep it (article 16 of the LGPD).
10. Who receives data
We share the minimum necessary, and only with service providers that process data to provide the service to leve (processors). Through their terms of service, they commit to protecting the data with confidentiality and security and to using it only to provide that service. We only use providers whose commitments give your data the same or equal protection as described in this policy.
| Processor (country) | What for | What it receives |
|---|---|---|
| Supabase (U.S.; servers in the us-east-1 region, Northern Virginia) | account, database, authorized backup, usage statistics and waitlist | account data, the copy of your records, authorized photos (on iPhone, only the encrypted content and the details in section 5.3), usage events and waitlist emails |
| Cloudflare (U.S.) | runs the meal analysis service and protects the website against bots | the meal photo or text in transit, proof of subscription, language, IP address and connection data; it does not keep the meal content |
| Groq (U.S.) | estimates the foods and protein in a meal | only the photo or text sent for analysis, under zero data retention; no identifier of yours, no progress photos and no Copilot history |
| RevenueCat (U.S.) | validates and tracks your subscription | your app identifier at RevenueCat (an anonymous RevenueCat code or, if you have an account, your account identifier), purchases and subscription status, your answer to "How did you hear about leve?", the referral code and, on iPhone, Apple's ad attribution token, without IDFA; no photos and no health data |
| Expo (U.S.) | delivers app updates | IP address, technical device and app data (such as the operating system and app version) and a random installation code created by the update system |
| Apple (U.S.) | App Store and purchases (StoreKit), Sign in with Apple, App Store ad attribution (AdServices), Apple Health on your device, iCloud Keychain (photo key) and iCloud Mail, which sends the sign-in code and receives support email | purchase and sign-in data, the attribution token without IDFA, the photo key (stored in your iCloud) and your email address when we send the code or answer support; what you allow in Apple Health stays on your device |
| Google (U.S.) | Sign in with Google | sign-in data for your Google account |
Apple and Google also process purchase and sign-in data under their own policies, as independent controllers. Apple Health stays on your iPhone, under your control: what leve writes there follows Apple's rules.
We may also disclose data when required by a court order or a competent authority. If leve is sold or reorganized, we will tell you beforehand, and whoever takes over leve will be bound by this policy.
11. International transfers
leve is operated from Brazil, and all the processors in section 10 are in the United States. leve's database, which holds accounts, backup copies, authorized photos, usage statistics and the waitlist, is at Supabase, in the us-east-1 region (Northern Virginia, United States). So when your data leaves your device, it goes to the United States:
- Backup and account (Supabase): only when you turn on backup or create an account; kept until you delete it (section 9).
- Meal analysis (Cloudflare and Groq): only when you ask for an analysis; in transit only, with no copy kept.
- Subscription (Apple and RevenueCat): while you have a subscription (section 9).
- Usage statistics (Supabase): up to 24 months.
- Sign-in, email and app updates (Apple, Google and Expo): when you use those features.
- Waitlist (Supabase): while it is used for the Android launch notice.
Legal basis for the transfer. These transfers are necessary to provide the service you asked for, so under Brazilian law they rely on article 33, IX, together with article 7, V, of the LGPD. Health data goes to the United States only through an action of yours: turning on backup or asking for a meal analysis. Sections 10 and 13 describe who processes the data and how it is protected, and section 12 describes your rights, including the right to complain to Brazil's data protection authority. You can ask us about these transfers through the contact in section 18, and we will answer within 15 days.
12. Your rights and how to use them
Under article 18 of the LGPD, you can at any time and at no cost:
- confirm whether we process your data and access a copy of it;
- correct incomplete, inaccurate or outdated data;
- have unnecessary or excessive data, or data processed unlawfully, anonymized, blocked or deleted;
- receive your data in a portable format, on express request;
- delete data processed based on your consent;
- know who we share data with;
- know that you can refuse consent and what happens if you do (section 4.2);
- withdraw consent at any time;
- object to processing based on legitimate interest;
- ask for review of automated decisions, under article 20.
If you live in the United States, section 19.5 and section 20 describe your rights under U.S. state laws.
12.1. What you can do in the app
- View and correct: every entry can be edited on the screen where it was created.
- Export your records: Profile › Settings › Account and backup › Export or restore file creates a JSON file, not encrypted, with your profile, injections, weigh-ins, daily log, foods and exercise. Progress photos can be exported one at a time from the leve photo gallery: tap a photo, then "Take". Meal photos, the Copilot history and your email are not included in the file.
- Delete everything, on the device and in the cloud: Profile › Settings › Start over from scratch deletes the records, photos, Copilot history, Apple Health preferences and the usage statistics code on this device. If an account is signed in on the app, it also deletes the copy of your records and your photos in the cloud, even with backup paused, and signs you out. Do this while online: without a connection, the cloud copy is not deleted. "Start over from scratch" does not delete: the account itself, the meal analysis permission, the photo key in iCloud Keychain, the data at RevenueCat, your purchase history at Apple, or usage statistics already sent.
- Delete your account: Profile › Settings › Account and backup › Delete account and data in the cloud deletes your photos in the cloud, the copy of your records and the account, signs you out of RevenueCat (your record there remains; ask us by email to delete it) and then deletes the data on this device. It works while the account is signed in on the app.
- Withdraw permissions: backup with "Pause automatic backup"; meal analysis in Protein › AI Privacy; Apple Health in Profile › Settings › Privacy and integrations › Apple Health and in the iPhone Health app; reminders in leve or iPhone settings; usage statistics with the switch in section 8.1, starting with version 1.0.4.
12.2. What you can ask by email
Write to alvorlabs@icloud.com to: get a copy of what we keep in the cloud about your account; delete an account you can no longer open in the app (for example, the no-email account on a device you no longer have); delete your RevenueCat record, including subscription source data; object to usage statistics or to subscription source measurement; and make any other request in this section. We confirm receipt and answer within 15 days (U.S. residents: see section 19.5). We may ask for information to confirm the request is really yours. When we correct or delete data at your request, we tell the processors that keep a copy of it.
12.3. Limits you should know about
- Usage statistics: as explained in section 8.2, we cannot find one person's events, because the device code is random and not linked to them. They are deleted automatically at 24 months.
- Photo key: it stays in your Apple account's iCloud Keychain, and the app does not delete it. Without the photos in the cloud, it opens nothing.
- Meal analysis permission: it stays on your device until you revoke it.
If you are not satisfied with our answer, you can complain to Brazil's National Data Protection Agency (ANPD), to consumer protection authorities, or, in the United States, as described in sections 19 and 20.
13. Security
- All traffic between the app, the website and the services is encrypted in transit (HTTPS/TLS).
- Data stored in the cloud is encrypted at rest by the provider, with access rules that let each account read only its own copy.
- On iPhone, backed-up photos are encrypted on the device before upload (section 5.3).
- The public key inside the app does not open backup copies: reading or changing a copy requires that account's own session. Administrative access uses a different credential that is not in the app.
- Secret keys for third-party services, such as Groq's, are kept on the server, never in the app.
- On iPhone, your account session is kept in the device Keychain, and the photo recovery code appears only after Face ID or your iPhone passcode.
No system is infallible. If you find a security flaw, please write to the contact in section 18 before disclosing it publicly, and we will treat your report as a priority.
14. Children
leve is only for adults 18 and older. At setup, a date of birth is accepted only for people 18 or older; this is your own statement. leve is not directed to children, and we do not knowingly collect personal information from anyone under 18, including children under 13. If we learn that we have, we will delete it. Parents or guardians can write to the contact in section 18.
15. The leve website
- The website uses no advertising cookies, no social media pixels and no cross-site tracking.
- The website runs through Cloudflare, which receives visitors' IP addresses, uses a technical security cookie against bots (__cf_bm) and may run a small check in the browser to tell people from bots. This cookie is necessary to protect the website.
- Clicks on the App Store button are counted with the page and the link campaign, using a random code that lives and dies with the page, without following you between visits.
- If you arrived through a partner link, that link's code is stored in your browser and used for up to 90 days, to know where a waitlist request or a click came from. It goes away when you clear the site's data in your browser.
- The "Notify me on Android" form keeps your email, platform, source (including the partner link code, if any) and page, only to tell you about the launch.
- The card page for clinics creates its QR code with an outside service (api.qrserver.com), which receives the destination address and, like any website, the IP address of whoever opens the page.
- The web demo version keeps your records in your browser storage. If you sign in to an account there, the account and backup rules in this policy apply, without end-to-end photo protection.
16. Security incidents
If a security incident may cause you relevant risk or harm, we will notify Brazil's ANPD and you within 3 business days of learning that personal data was affected, under article 48 of the LGPD and the ANPD regulation. The notice will say what data was affected, how it was protected, the risks, what we did to reduce the problem, when we learned of it and how to contact us. It will reach you by the account email, when there is one, and by a notice on this website. Because the "Save to cloud" account has no email, the website notice will stay up for at least three months. For people in the United States, section 19.4 also applies.
17. Changes to this policy
We may update this policy to reflect changes in the app or in the law. The current version is always on this page, with the date at the top. If a change is material, we will tell you before it takes effect, highlighting what changed on this page and, when we have your email address, also by email. Where the law requires, we will ask for your consent again. You can ask us for earlier versions by email.
17.1. What changed in version 5.0
- The controller and the data protection officer are now identified by name, with an address.
- Accounts are optional, and "Save to cloud" and signing in with Apple, Google or email are described with what each one turns on.
- End-to-end photo protection is described as it works on iPhone today, in production.
- The legal basis for health data that stays on your device was corrected, and consent appears only where there is an action of yours.
- Meal analysis describes the permission request, Groq and zero data retention.
- Usage statistics have their own section, with the version 1.0.4 switch, the limit of the random code and the 24-month period.
- "Start over from scratch" and "Delete account" are described with what each one actually deletes.
- The transfer to the United States is described with the country, the region and the LGPD basis.
- New: writing to Apple Health, trend sharing, local reminders, your own iPhone backup, Expo, the website waitlist, the Cloudflare cookie, the QR code on the clinic card page, the 3-business-day incident deadline, section 19 for the United States and the Consumer Health Data Privacy Policy in section 20.
18. Contact
Privacy, your rights and the data protection officer: alvorlabs@icloud.com. Carlos Henrique Borges (Alvor Labs), an individual residing in Brazil. Address: Rua Doutor Guomide, 002.
19. For users in the United States
This section adds what U.S. laws require. It does not reduce any right that the law of your state gives you.
19.1. Who is responsible
leve is provided by Carlos Henrique Borges, an individual residing in Brazil who does business as Alvor Labs. Address: Rua Doutor Guomide, 002. Email: alvorlabs@icloud.com.
19.2. What we never do
We do not sell personal data, including health data. We do not use or disclose it for targeted advertising or marketing. The app contains no advertising or tracking SDKs, and the website has no social media or advertising pixels. We do not share health information with data brokers, insurers or employers. We do not use personal data to train large language models or other AI models, and we do not use it for profiling that produces legal or similarly significant effects.
19.3. HIPAA
leve is not a HIPAA covered entity or business associate, so HIPAA does not apply to the information you enter in the app. We protect it as described in this policy and as required by the FTC Act and applicable state laws.
19.4. Health breach notification
If we discover a breach of security involving your identifiable health information, including a disclosure you did not authorize, we will notify you without unreasonable delay and no later than 60 calendar days after we discover it: by email when we have your address, and by a notice on this website that stays up for at least 90 days. We will also notify the U.S. Federal Trade Commission and, where the law requires, state authorities and the media. The notice will explain what happened, the date of the breach and the date we discovered it, the types of information involved, the identity of any third party that obtained it, the steps you can take to protect yourself, what we are doing about it, and how to contact us.
19.5. Your state privacy rights
Wherever you live in the United States, you can ask us to confirm whether we process your personal data, to access it, correct it, delete it and get a portable copy of it, and to withdraw your consent. Health information is sensitive data: we process it only with your consent or as necessary to provide the features you request.
Because we do not sell personal data, use it for targeted advertising or use it for profiling with legal or similarly significant effects, there is nothing to opt out of, and our practices are the same whether or not your browser sends an opt-out preference signal such as Global Privacy Control.
Make your request in the app (section 12.1) or by email to alvorlabs@icloud.com. We respond within 45 days; if we need more time, we will tell you within those 45 days, with the reason, and respond within 45 additional days at most. Requests are free. If your state allows it, an authorized agent can make a request for you; we may ask the agent for proof of authorization and ask you to confirm your identity. If we decline your request, you can appeal as described in section 20.6. The limit in section 8.2 applies to usage statistics.
19.6. California
Do Not Track. leve does not track you over time and across third-party websites or apps, so our practices are the same whether or not your browser sends a Do Not Track signal. No other party collects personally identifiable information about your online activities over time and across different websites when you use leve or our website. You can review and correct your information in the app (section 12.1) or by email. We tell you about material changes as described in section 17, and the date at the top of this policy shows when it was last updated.
Medical information. If you live in California, we treat the health information you record in leve as medical information under the California Confidentiality of Medical Information Act. We do not disclose it without your authorization, except to service providers that process it on our behalf to provide the service or when the law requires, and we never use it for marketing.
Shine the Light. We do not share personal information with third parties for their direct marketing purposes.
19.7. Reproductive and sexual health information
Setup asks about some conditions that are reproductive or sexual health information: pregnancy or breastfeeding, and polycystic ovary syndrome. We use these answers only to adapt safety guidance, the protein goal and your report. They stay on your device, and we receive them only if you turn on backup, with the authorization shown next to the button. We never sell them or disclose them for advertising. You can delete them with "Start over from scratch", which also deletes the cloud copy when an account is signed in, or by writing to us.
20. Consumer Health Data Privacy Policy
Effective October 3, 2026. This section is our consumer health data privacy policy under the Washington My Health My Data Act, Nevada Senate Bill 370 (2023) and Connecticut's consumer health data law. We apply it to consumer health data of people anywhere in the United States. It is provided by Carlos Henrique Borges, an individual residing in Brazil who does business as Alvor Labs. Address: Rua Doutor Guomide, 002. Email: alvorlabs@icloud.com.
Most of the data below stays on your device, and we do not receive it. We receive consumer health data only when you turn on cloud backup or ask for a meal analysis.
20.1. Consumer health data we collect, and why
- Treatment and injections: medication, dose, frequency, injection day and time, start date, dose changes, tracking pauses, and the date, time, dose and site of each injection. We use them to log your treatment, schedule the reminders you turn on, and build your history, readings and report.
- Body measurements: weigh-ins, height, age, sex, estimated body-fat percentage, starting weight and goal weight. We use them to show trends, projections and progress.
- Side effects and routine: side effects with intensity and date, foods and protein, water, sleep, exercise and strength training, steps, active energy and weekly check-ins. We use them to show patterns and your daily summary.
- Health conditions you report at setup, including reproductive and sexual health information (pregnancy or breastfeeding, polycystic ovary syndrome). We use them to adapt safety guidance, the protein goal and your report.
- Progress photos: pictures of your body, so you can compare them over time.
- Meal photos and descriptions: the meal photos you save in food entries, and the photo or text you choose to analyze, to estimate foods and protein.
- Apple Health data you allow: weight, height, body-fat percentage, sleep, workouts, exercise minutes, active energy, steps, water and protein, to fill in your history.
- Inferences we calculate from this data: trends, projections, estimated medication level and patterns between dose and side effects, to show your readings. They are estimates, not diagnoses.
- Data that may suggest health information: because leve is for people taking GLP-1 medications, your account, subscription and usage events may themselves suggest that you take one. We use them only as described in sections 2.2 to 2.4 and 8.
20.2. Sources
You; your device (including the camera, only when you use it); Apple Health, only if you connect it; Apple and RevenueCat, for your subscription and App Store ad attribution; Apple or Google, if you sign in with them.
20.3. How we share it
We do not sell consumer health data. We do not share it with third parties for their own purposes, or with advertisers, social networks or data brokers, and we have no affiliates. We disclose it only to processors that handle it on our behalf and on our instructions, to provide the features you request:
- Supabase (cloud database and storage, United States): the copy of your records and your photos, only if you turn on backup. On iPhone, photos arrive end-to-end encrypted.
- Cloudflare (runs our meal analysis service): the meal photo or description you choose to analyze, in transit only.
- Groq (AI provider): the meal photo or description you choose to analyze, under zero data retention and with no identifier of yours.
Categories of consumer health data disclosed to these processors: the records in your backup (the categories in section 20.1, except the inferences, which the app calculates on your device), your progress and meal photos if photo backup is on, and the meal photos or descriptions sent for analysis.
Other processors receive data that may suggest you use leve, but never your health records: RevenueCat (subscription), Expo (app updates), and Apple and Google (purchases, sign-in and the services in section 10). The PDF report and the trend image go only to the people you choose, through the iPhone share sheet. What leve writes to Apple Health stays in your Health app. We may also disclose data if the law requires it, for example under a court order.
20.4. Consent
We collect and use consumer health data only as necessary to provide the features you request, or with your consent. Cloud backup, photos in backup, meal analysis and Apple Health each require a separate action and permission, in the app or on the iPhone permission screen. Accepting our Terms of Use is never treated as consent. You can withdraw consent at any time in the app (section 12.1) or by email; withdrawing does not affect what happened before.
20.5. Your rights and how to use them
- Confirm and access: confirm whether we collect, share or sell your consumer health data, and access it, including a list of every third party and processor that received it, with an email address or online way to contact each one.
- Delete: delete your consumer health data. We also tell our processors to delete it, and copies left in a provider's automatic backups are erased when those backups expire, on that provider's schedule.
- Withdraw consent at any time.
- Correct inaccurate data and get a portable copy.
- Stop our collection or sharing of your consumer health data.
- Not be treated differently for using any of these rights.
Use the app (section 12.1: export, delete account, start over and withdraw permissions) or write to alvorlabs@icloud.com with the subject "Consumer health data". We verify requests with reasonable steps, such as confirming that you control the account email; for the no-email account, the in-app options are the safest way. We respond within 45 days of receiving your request; if we need more time, we will tell you within those 45 days, with the reason, and respond within 45 additional days at most. Requests are free. Usage statistics are not linked to you, so we cannot find them (section 8.2); they carry no health values and are deleted automatically at 24 months.
20.6. Appeals
If we decline your request, in whole or in part, you can appeal by replying with the subject "Appeal". We will answer in writing within 45 days, explaining what we decided and why. If we deny your appeal, you can contact your state Attorney General: Washington, Nevada or Connecticut.
20.7. Other commitments
- We do not sell consumer health data, and we do not use it for targeted advertising.
- We do not use geofencing, and we do not collect your location.
- We do not use consumer health data to train large language models or other AI models.
- No third party collects consumer health data about your activity over time and across different websites or online services when you use leve.
- Access to consumer health data is limited to the person responsible for leve and to the processors that need it to provide the service.
20.8. Changes to this section
Before any material change to this section takes effect, we will publish it on this page with a new effective date at the top of this section and, when we have your email address, tell you by email.