Last updated · 2026-09-13
This policy explains what Rovexa collects, why, who touches it, and what you can do about it. We collect as little as we need, sell none of it, and give you control over the rest.
Rovexa is operated by Rovexa Fitness Inc., a Canadian corporation.
Rovexa Fitness Inc.
1065 Canadian Pl, Ste 201 #500
Mississauga, ON L4W 0C2, Canada
Email: [email protected]
Rovexa Fitness Inc. is the data controller for everything described in this policy.
This policy applies to:
It does not cover Apple, Google, or any other company's services that you use alongside Rovexa. Their own policies apply to those.
The Rovexa app carries no advertising SDK, no product analytics SDK, no crash reporting SDK, and no ad attribution SDK. Nothing you do in the app is shared with an ad network. If that ever changes, we will update this policy and, where required, ask your permission in the app first.
Rovexa can read from Apple Health on iOS and from Health Connect on Android. The connection is off until you turn it on, and your phone asks you which categories to grant.
What we read: steps, active energy, distance, exercise minutes, workouts, heart rate, resting heart rate, heart rate variability, and your sleep times and stages.
We only read. Rovexa never writes anything back to Apple Health or Health Connect.
What we use it for:
What we never do with it:
Rovexa's use of information received from Health Connect adheres to the Health Connect Permissions policy, including its Limited Use requirements. Our use of Apple Health data follows Apple's HealthKit guidelines.
Health information you enter yourself (height, weight, body measurements, what you eat, sleep and mood in your journal, injuries you mention to the coach) is treated with the same care as data from Apple Health or Health Connect.
Disconnecting: you can disconnect at any time, in Rovexa or in your phone's health settings. Disconnecting stops the sync. Days already synced stay in your account until you delete them or close your account. You can delete synced days from within the app.
Legal basis: under EU and UK data protection law, health data is a special category of personal data. Our lawful basis for holding it is your explicit consent, which is what the connection prompt and the onboarding health questions ask for. You can withdraw that consent at any time by disconnecting, deleting the data, or closing your account.
When you scan a meal, the photo is sent to our AI provider to identify the food and estimate its nutrition (see section 6).
Photos are stored in our database provider's file storage, scoped to your account. We do not use your photos for anything other than the feature you used them for, and we do not use them to train AI models.
Rovexa uses third-party AI models to power two features. Both providers act as our service providers: they process your data only to return the result we asked for, they are bound by contract not to use it for their own purposes, and neither uses your data to train their models. Neither do we.
Meal scans go to Google. The meal photo is sent to Google's Vertex AI, which runs Gemini, to identify the food and estimate its nutrition. It is sent for that one request.
The AI coach goes to OpenAI. When you talk to the coach, your message is sent to OpenAI to generate the reply, together with the context the coach needs to answer usefully. Depending on your question, that context can include:
The coach's replies are stored in your account so the conversation continues across sessions. The coach also keeps a short memory of things you have told it (such as an injury or a schedule change) so you do not have to repeat yourself. You can clear a conversation or close your account at any time.
Not medical advice. The coach gives training and nutrition guidance based on general principles and the data you share. It is not a doctor, dietitian, physiotherapist, or mental health professional. Read our Health disclaimer before relying on it.
Automated decisions. The coach adjusts your plan and suggestions automatically. It never makes decisions that have legal or similarly significant effects on you, and you can always email us to talk to a person about anything the coach has said or done.
| What we do | Data involved | Legal basis (EEA/UK) |
|---|---|---|
| Run the app: your account, logs, plans, and coach | Account, profile, logs, coach conversations, purchases | Performing our contract with you |
| Process Apple Health / Health Connect and other health data | Health data | Your explicit consent |
| Personalize your coach and plans | Profile, logs, health data | Contract; explicit consent for health data |
| Enforce plan limits and manage subscriptions | AI usage records, purchases | Contract |
| Send account and service messages (receipts, security, changes to terms) | Email, notification token | Contract; legal obligation |
| Send product news and offers by email or notification | Email, notification token | Consent (you can opt out any time) |
| Keep the service secure and prevent abuse | Technical data, AI usage records | Legitimate interest in protecting the service |
| Fix bugs and understand feature use in aggregate | Technical data, AI usage records | Legitimate interest in improving the product |
| Respond to your support requests | Whatever you send us | Contract; legitimate interest |
| Comply with tax, accounting, and legal obligations | Purchase records | Legal obligation |
We do not use your data for third-party advertising, and we do not make it available to advertisers.
Rovexa is based in Canada and our servers are in the United States. If you use Rovexa from the EEA, UK, Switzerland, or elsewhere, your data is transferred to those countries. Where the law requires it, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with our providers, or on a provider's certification under the EU-U.S. Data Privacy Framework where applicable. You can ask us for a copy of the safeguards in place by emailing [email protected].
| Data | Kept for |
|---|---|
| Account, profile, and everything you log | While your account is active, then deleted within 30 days of you closing it |
| Individual workouts, meals, journal entries, coach conversations | Until you delete them, or until account deletion |
| Unconfirmed meal scan photos | 24 hours |
| Apple Health / Health Connect data | Until you delete it or close your account; disconnecting stops new data |
| AI usage records (no content) | 12 months |
| Server and security logs | Up to 90 days |
| Purchase and billing records | Up to 7 years, as required by Canadian tax law |
| Waitlist email address | Until you create an account or unsubscribe |
| Support emails | 24 months after the conversation ends |
| Encrypted backups | Up to 30 days, then rotated out |
Deleted data may persist in backups for up to the backup retention period above before it is gone for good.
No system is unbreakable, but we work to make ours hard to break.
Wherever you live, you can:
To exercise any of these, use the app where the option exists, or email [email protected]. We will respond within 30 days, or sooner where the law requires. We may ask you to confirm you own the account before acting. We will never charge you or treat you differently for exercising your rights.
In the app: Settings > Account > Delete account.
By email: send a request from the email address on your account to [email protected] with the subject "Delete my account".
On the web: rovexa.ai/delete-account
Deleting your account removes your profile, logs, photos, journal, coach conversations, and synced health data within 30 days. We keep purchase records for as long as tax law requires, and nothing else. Deleting your account does not cancel a subscription; cancel it in your Apple or Google subscription settings first.
Rovexa is for adults 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, email [email protected] and we will delete it.
Rovexa Fitness Inc. is the controller of your data. You have the rights in section 12, plus the right to data portability and the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office; in the EU, the authority in your country of residence). We would appreciate the chance to resolve your concern first.
We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. Your data may be stored and processed outside Canada (see section 9), where it is subject to the laws of those countries.
For Quebec residents: the person in charge of the protection of personal information at Rovexa Fitness Inc. is the President, reachable at [email protected]. You have the right to access, correct, and request deletion of your data, and to file a complaint with the Commission d'accès à l'information du Québec.
California (CCPA/CPRA). In the past 12 months we have collected the following categories of personal information: identifiers (name, email, account ID, IP address); personal information under Cal. Civ. Code 1798.80 (name); characteristics of protected classifications (age, sex); commercial information (purchase history); internet or network activity (technical data); sensory data (meal photos you upload); health information you enter or connect; and inferences drawn from the above (training and nutrition targets, coach recommendations). We collect these from you, your device, and the app stores, for the purposes in section 7, and share them only with the service providers in section 8. We do not sell personal information and do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes beyond those permitted by the CPRA. You have the right to know, delete, correct, and to non-discrimination. You can appoint an authorized agent to make requests on your behalf. Make requests by emailing [email protected].
Consumer health data (Washington, Nevada, Connecticut). This section is our Consumer Health Data Privacy Policy under the Washington My Health My Data Act and similar laws.
If you apply to our affiliate or creator program, we collect what you submit in the application (name, email, social handles, audience details) and, if accepted, the details we need to pay you. Referral tracking uses promo codes, not device tracking. We keep this data for the life of the relationship and as long as tax law requires afterward.
Rovexa links to and works with services we do not control: Apple, Google, and any wearable or health app you connect. Their privacy policies govern what they do with your data. Sign in with Apple, Sign in with Google, Apple Health, Health Connect, and in-app purchases are all subject to Apple's and Google's terms. Rovexa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We may update this policy as the product evolves. The date at the top always shows the current version. For material changes, we will email your account address at least 30 days before they take effect and, where the law requires it, ask for your consent again.
Questions, requests, or complaints about this policy or your data:
Rovexa Fitness Inc.
1065 Canadian Pl, Ste 201 #500
Mississauga, ON L4W 0C2, Canada
[email protected]