Jovia Routine

Privacy Policy

Effective date: October 28, 2026 · Version: 1.3

This Privacy Policy explains how Jovia Labs, Inc. ("Jovia", "we", "us") collects, uses, shares and protects information when you use the Jovia mobile app (the "App"), or join our waitlist on our website, joviahealth.com. It also explains your choices and rights.

The App is offered only in the United States, to people 18 or older.

Some of the information the App collects is health data. Our Consumer Health Data Privacy Policy explains how we handle it in more detail, including the rights that Washington, Nevada, Connecticut and other states give you. It is part of this policy.

1. Summary

The App helps you track your skincare routine, take daily check-in photos, answer a few questions about your skin, keep a streak and see the day's weather and UV conditions.
Your check-in photos and answers are health data. When you sign up, you consent to our collection of them, and we treat them as sensitive.
We use your information to run the App for you. We do not sell your information. We do not use it for advertising, and we do not share it with advertisers or data brokers.
We do not use face recognition, and we do not create face templates or faceprints from your photos.
You can delete your account, and everything in it, in the App at any time. We lock it at once and delete it for good 30 days later.
The App does not give medical advice and is not a healthcare service (see section 12).

2. Who we are and how to contact us

Jovia Labs, Inc., 169 Madison Ave STE 99917, New York, NY 10016.

Privacy questions and requests: admin@joviahealth.com.

3. What we collect, and why

We collect only what the App needs to work. The table lists each feature.

Sign-in with your phone: What we collect: Your US mobile phone number. Google Firebase sends a one-time code to it by text message.; Why we use it: To create your account, sign you in and protect your account; Required? Required
Profile: What we collect: Your first name; your last name and email address if you give them; Why we use it: To personalize the App. We use your email to contact you about your account, including to help you get back into it. We send product news by email only if you opt in.; Required? First name required; last name and email optional
Routine: What we collect: The skincare products in your routine (from our product list, or products you add yourself, with any notes you write), and whether you use them in the morning or evening; Why we use it: To show and track your routine. If you add your own product, we may use its name to match it to product information in our catalog.; Required? Required to use the routine features
Logs and streak: What we collect: Which routines you log, the products you check off, when you log them, whether you checked in before or after your routine, days you skip or miss, your points and your streak; Why we use it: To count your points and streak and show your progress; Required? Created as you use the App
Check-in photos: What we collect: Photos of your face that you take in the App: up to 9 per check-in (front, left and right, up to 3 of each). With each photo, we also keep its angle, when you took it, a photo quality score with notes (for example blurry, too dark or too bright, head position, movement, glasses likely, or timed out), and the version of the scoring method.; Why we use it: To keep a private visual record of your skin for you. We also keep them so that, if we later offer skin analysis, you could see changes over time. We will ask for your separate permission before we analyze any photo. We use the photo quality information only to tell how clear each photo is.; Required? Optional (you can skip a check-in)
Check-in answers: What we collect: How your skin feels (oily, dry, mixed or neutral), whether you washed your face, and any tags you choose, such as poor sleep, stress, alcohol, exercise, travel, sun, makeup, sweat, swimming, a mask or helmet, picking at your skin, a salty or late meal, a new product, feeling unwell or being on your period; Why we use it: To keep your check-in history for you and, later, to help explain changes in your skin; Required? Optional (you can skip the questions)
Today's conditions: What we collect: The city on your account, or, if you allow location access, your device's approximate location; Why we use it: To show the day's UV, humidity, temperature, wind, air quality and pollen where you are; Required? Optional (you can choose a city instead)
Notifications: What we collect: Your reminder settings, your time zone and a push token for your device; Why we use it: To send the reminders you turn on, at your local time; Required? Optional
Device and technical data: What we collect: A random identifier for this installation of the App; the app version and build, and how you installed it (for example TestFlight or the App Store); your device's type, maker, model, memory and operating system version; screen size, text size, light or dark mode and the reduce-motion setting; language, region, time zone, time format and measurement settings; which permissions you gave the App (notifications and their settings, camera, photos and location); when you open the App, the network type, battery level (in steps of 10%), low-power mode and free storage (in steps of 100 MB); your IP address; and error information from our servers. We do not collect advertising identifiers, your device's name, your mobile carrier or your screen reader settings.; Why we use it: To run, secure and fix the App, and to prevent abuse such as text-message fraud; Required? Collected automatically
Crash reports: What we collect: If the App crashes, a crash report: where the App's code failed, the app version, your device model and operating system version, and a random identifier for crash reporting. Crash reports do not include your photos, check-in answers, messages or phone number.; Why we use it: To find and fix crashes; Required? Collected automatically
Messages and feedback: What we collect: What you send us by email or through the App, and your contact details; Why we use it: To answer you, fix problems and keep a record of privacy requests; Required? Only when you contact us

Sources. We collect this information from you, from your device, and from Google Firebase when you sign in. Weather, air-quality and pollen data come from Google (the Weather and Pollen APIs) and the U.S. Environmental Protection Agency (AirNow); that data is about places, not about you.

Location. When you allow location access, the App asks iOS for your approximate location only while you use the App. We round it to a coarse area before we request the forecast. We store only the resulting city name and whether location access is on. We do not store your coordinates or a history of your locations.

Photos and your face. We do not create face templates, faceprints or other biometric identifiers from your photos, and we do not use face recognition. While you take your check-in photos, the App checks on your device (on iPhone, with Apple's Vision framework) whether your face is in view, turned the right way, well lit, sharp and still. For each angle, it scores a short series of camera frames and picks the clearest photos on your device. It deletes the other frames on your device right away, and they never leave your device. The App uses the position and points of your face only in your device's memory while the camera is open, and does not store them or send them to us. With each photo we keep, we store only the photo quality information described above. We do not store or receive face positions, facial landmarks, face geometry, face templates or face embeddings.

Waitlist. If you join the waitlist on our website, we collect your email address. With it, we keep when you joined and basic technical details: a short description of your browser, and a one-way code made from your IP address that can no longer be linked to it after 2 days. We do not keep your IP address. We use your email address only to tell you when the App launches. To remove it, email admin@joviahealth.com and we will delete it.

4. How we use your information

We use your information only to:

provide the App and its features to you (routine, logs, streak, check-ins, photos, conditions and reminders);
create and secure your account, verify your phone number, and prevent fraud, abuse and text-message fraud;
answer your messages and requests, and send you service messages (for example a sign-in code, or a notice about a change to this policy);
tell you when the App launches, if you joined our waitlist;
fix bugs and improve the App, using de-identified or aggregated information where we can;
comply with the law, and enforce our Terms of Service.

We do not:

sell your personal information or health data, or share it for targeted (cross-context behavioral) advertising;
use your photos, check-in answers or other health data for advertising or marketing;
use your photos or health data to train artificial intelligence models, including large language models;
use face recognition or create face templates;
make decisions about you based solely on automated processing that produce legal or similarly significant effects;
use your information for a new purpose without telling you first and, where the law or Apple requires, asking for your consent again.

5. Photos and health data

Consent. When you sign up, you agree to the Terms, this policy and our Consumer Health Data Privacy Policy, and you consent to our collection of your check-in photos and answers. We record that consent separately from your acceptance of the policies. You can still use your routine, logs and streak if you skip photos and questions.
Private to you. Other users cannot see your photos or answers. They are sent over an encrypted connection and stored encrypted with Amazon Web Services in the United States.
Limited staff access. Only Jovia personnel who need access to operate, secure or support the App, to answer your request, or to meet a legal duty can access them.
No other use. We do not post them, share them with other companies for their own use, or use them for advertising.
Future analysis. Before we offer any photo analysis (for example a skin score), we will explain what it does and who processes your photos, and we will ask for your separate permission. If you say no, we will not analyze your photos.
Your control. You can skip or stop any check-in, and you can skip the check-in questions. A check-in takes photos from all three angles; you cannot skip a single angle. To delete photos or answers while you keep your account, email us at admin@joviahealth.com. To delete everything, use Account → Delete account.

6. How we share information

We share personal information only in the ways below.

Service providers. These companies run parts of the App for us. Our contracts allow them to use the information only to provide their service to us, and require them to protect it.

Amazon Web Services: What they do: Hosting, database, encrypted file storage and server logs; Information they receive: All App information, stored in the United States
Google (Firebase Authentication): What they do: Sign-in, and sending the text-message code; Information they receive: Your phone number and the device and network information needed to sign you in and prevent abuse
Apple: What they do: Notification delivery (Apple Push Notification service); Information they receive: Push tokens and notification text. Our notifications do not include your photos, check-in answers or product names.
Google (Firebase Cloud Messaging): What they do: Sending the reminders you turn on; Information they receive: Push tokens and notification text
Google (Weather and Pollen APIs): What they do: Weather, UV and pollen forecasts; Information they receive: A city name or rounded location only. Never your name, contact details, account identifier, photos or check-in answers.
U.S. Environmental Protection Agency (AirNow): What they do: Air-quality data; Information they receive: A city name or rounded location only. Never your name, contact details, account identifier, photos or check-in answers.
Google (Workspace): What they do: Email; Information they receive: Messages you exchange with us by email
Google (Firebase Crashlytics): What they do: Crash reporting; Information they receive: Crash reports, as section 3 describes. Never your photos, check-in answers, messages or phone number.
Linear: What they do: Tracking bug reports and feedback you choose to send from the App; Information they receive: Your message, and the app version and build, screen, device details, language, time zone and the first 8 characters of the App's installation identifier sent with it. Never your photos, check-in answers or phone number.

Legal and safety reasons. We may disclose information if the law requires it (for example a valid subpoena or court order), or when needed to protect the rights, property or safety of our users, the public or Jovia, or to investigate fraud or security problems. Where the law allows, we will tell you before we disclose your information. We will challenge requests for health data that are not legally valid.

Business transfers. If Jovia is part of a merger, acquisition, financing or sale of assets, your information may transfer to the new owner, who must continue to protect it as this policy describes. We will tell you before your information becomes subject to a different privacy policy.

With your permission. We share information in other ways only when you ask us to or agree.

7. How we protect your information

We encrypt information in transit (TLS) and at rest in our database and file storage.
Our database and file storage are private and not accessible from the internet. Access is limited to the people and systems that need it.
Our test systems are separate from the live App and use only made-up data.
Sign-in uses verified tokens from Firebase. The App has no password for anyone to steal.

No system is perfectly secure. If a security breach affects your information, we will notify you and the authorities as the law requires, including under the FTC Health Breach Notification Rule where it applies.

8. How long we keep information

Account, profile, routine, logs, streak and settings: How long we keep it: While your account is open
Check-in photos, their quality information, and answers: How long we keep it: While your account is open, unless you ask us to delete them sooner
Device location: How long we keep it: Not stored. We keep only the city name.
Server and application logs (no photos or check-in answers): How long we keep it: 30 days
Device records (the installation identifier, device, settings and permission details): How long we keep it: While your account is open, and 90 days after you sign out on that device. If you delete your account, we delete them with it (see below).
Device history used to fix problems (network, battery, storage and settings over time): How long we keep it: 30 days
Crash reports: How long we keep it: 90 days
Security and audit records (account identifiers and actions only): How long we keep it: Up to 24 months
Records of your consents, the policy versions you accepted, and your privacy requests: How long we keep it: While your account is open, and 24 months after it closes or after the request
Waitlist email addresses: How long we keep it: Until you ask us to delete them

When you delete your account in the App, you confirm it with a new text-message code. We then lock your account and sign you out at once. 30 days later, we permanently delete your account and all its information from our active systems, including your device records and every stored version of your photo files, and we delete your Firebase sign-in record. To keep your account, sign in again within those 30 days. When you ask us to delete information, we delete it from our active systems within 30 days of your request. Copies in our encrypted database backups expire on a rolling 35-day schedule, so all remaining copies are gone within 65 days of your request. We may keep limited information longer when the law requires it or to resolve a dispute, and only for that purpose.

9. Your choices and rights

In the App, you can:

edit your routine, email address and city;
skip or stop any check-in, and skip the check-in questions;
turn notifications on or off (Account → Notifications, or iOS Settings);
choose your city or use your current location (Account → City), and turn location access off in iOS Settings;
delete your account and all its information (Account → Delete account). We lock your account at once and delete it for good 30 days later (section 8).

Everyone who uses the App, wherever you live in the United States, can ask us to:

confirm and access the information we hold about you, and get a copy in a portable format;
correct information that is wrong (for example your name);
delete some or all of your information, including specific photos or answers;
withdraw consent to our collection of check-in photos and answers. We then stop collecting them; you can also ask us to delete what we hold. Withdrawing does not affect what we did before;
give you a list of the third parties that have received your information.

We do not sell personal information, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, so there is nothing to opt out of. If that ever changes, we will ask for your consent first.

How to make a request. Email admin@joviahealth.com. We verify your request through your account, for example by sending a code to your phone number or a message to the email on your account. An authorized agent can make a request for you where your state's law allows; we may ask for proof of their authority and verify your identity. We answer within 45 days. If we need more time, we will tell you why and may extend once by 45 days. We do not charge for requests and will not treat you differently for using your rights.

Appeals. If we decline your request, you can appeal by replying to our decision with the word "Appeal". We will answer within 45 days. If we deny your appeal, you can contact your state Attorney General.

10. State privacy law disclosures

Several US states, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, give their residents privacy rights. We give the rights in section 9 to everyone who uses the App. In addition:

Categories of personal information we collect (from the sources in section 3, for the purposes in section 4): identifiers (phone number, email address, account identifiers, app installation identifier, IP address, push token); personal records (name); internet or device activity (app usage records, technical data and crash reports); approximate location; visual information (check-in photos and their quality information); and sensitive personal information (health data, including your check-in photos and answers). We disclose these categories only to the service providers in section 6, and otherwise only as section 6 describes.
Sensitive data. We process health data and photos only with your consent, and only to provide the App. We do not use sensitive personal information to infer characteristics about you.
Retention. Section 8 explains how long we keep each category.
Sale and sharing. We have not sold personal information or shared it for cross-context behavioral advertising, and we do not knowingly sell or share the information of anyone under 18.
Reproductive and sexual health information. The "On my period" tag is reproductive health information. We collect it only with your consent, use it only to keep your check-in history, and never sell or disclose it except to our hosting provider to store it for you.

11. Consumer health data

Our Consumer Health Data Privacy Policy lists the consumer health data we collect, why, who receives it, and how to use your rights under the Washington My Health My Data Act, Nevada law and the Connecticut Data Privacy Act.

12. HIPAA and medical care

The App is a personal skincare tracking tool. Jovia does not act as your healthcare provider through the App, and the information you put in the App is not covered by HIPAA. Your health data is protected by this policy and by state and federal consumer protection and privacy laws.

If Jovia later offers care from licensed clinicians, that care will come with separate terms and a separate Notice of Privacy Practices. We will not move your App photos or check-in answers into a medical record, or share them with a clinician, unless you ask us to.

13. Children

The App is only for people 18 or older. We do not knowingly collect information from anyone under 18. If we learn that someone under 18 has an account, we will delete the account and its information. If you think we hold information about someone under 18, email admin@joviahealth.com.

14. Tracking and Global Privacy Control

The App does not track you across other companies' apps or websites, and contains no advertising or third-party analytics software. It uses Firebase Crashlytics only to report crashes (section 3). Because we do not sell or share personal information for advertising, a Global Privacy Control signal does not change how we handle your information; we treat it as a request to opt out of sale and targeted advertising, which we already do not do.

15. Changes to this policy

When we change this policy, we post the new version with a new effective date, and keep earlier versions at joviahealth.com/legal/archive. For a material change, we tell you in the App before it takes effect. We will ask for your consent again before we use your photos or health data in a new way.

16. Contact

Jovia Labs, Inc., 169 Madison Ave STE 99917, New York, NY 10016 · admin@joviahealth.com