Privacy

Privacy Policy

Last updated October 15, 2026

Effective date: 15th October 2026 · Version 1.0

At Univa, we believe in being clear, honest and transparent about how we use your personal information. This notice explains how and why Univa Health Consumer LLC (“Univa”, “we”, “us”) collects, uses, shares and protects your personal information when you use the Univa apps, website and programs in the United States (together, the “Service”), and the choices and rights you have in your data. It applies to everyone who uses the Service from the United States.

If you live outside the United States, a different privacy notice applies to you; our UK notice is available at www.univa.health.

The short version
This summary is here to help you — the full notice below is what applies.
We collect the information you give us (such as your name, email, and what you share in your program), information provided by others (your parents if you are a minor or from a caregiver, if you have one), and information about how you use the Service.
We use it to run your program, keep you safe, support you, and improve Univa.
If you pay for Univa yourself or use it through a pilot, HIPAA generally does not apply, but the FTC Health Breach Notification Rule and state privacy laws may apply.
Your information is stored in the United States, encrypted, and accessed only by people who need it to do their job.
You can ask to see, correct, download or delete your information, and you can withdraw consent, at any time by emailing dataprivacy@univa.health. You may have other rights in your data.

1. Who we are and what this notice covers

1.1 Univa Health Consumer LLC is a Delaware limited liability company with its principal business address at 303 Goring Road, Goring-by-Sea, Worthing, West Sussex BN12 4NX, United Kingdom. We are part of the Univa Health group.

1.2 This notice covers personal information we collect through the Univa apps, the Univa website (us.univa.health) when you visit from the United States, and when you communicate with us by email, phone, text, WhatsApp or social media. It should be read together with our Terms and Conditions (United States).

1.3 “Personal information” means any information that identifies you or could reasonably be linked to you — for example your name, date of birth, email address, or information about your health. It does not include information that has been de-identified so that it can no longer reasonably be linked to you (see section 7).

2. The information we collect

The information we collect depends on how you use the Service. Most of it comes directly from you.

Category	Examples	Where it comes from
Account and contact information	Name, email address, phone number, password (stored in hashed form), account settings, communication preferences.	You
Identity and demographic information	Age ranges “13 years old – 17 years old” or “Adult” (used to check age and whether parental consent is needed), and optional information such as gender or pronouns.	You; your parent or guardian
Health and program information	The reason you are using Univa; eating and mood diaries; symptoms, goals and progress; questionnaire and assessment answers; weight or other measurements if you choose to enter them; notes, messages, photos, audio or video you record in the app; information about your care and treating team.	You; your parent or caregiver;
Information about the person you care for	If you are a parent or caregiver: your child’s or loved one’s first name or nickname, age, eating difficulties and how they are doing, as you record it in your program.	You (the parent or caregiver)
Emergency contact	Name, phone number, email address and relationship of the person you nominate.	You
Payment information	If you pay yourself: billing name, billing address, subscription history and the last four digits and expiry of your card. Full card details are collected and held by our payment provider, Stripe — we never see or store them.	You, via Stripe
Communications	Emails, messages, calls, complaints and feedback you send us, and our records of responding to them.	You
Audiovisual information	Photos, audio, or video you capture or record in the app	You; your parent or caregiver;
Research and pilot participation	If you take part in a pilot, survey, interview or research study: your responses, study ID and any consent you give.	You

We do not collect precise geolocation, biometric identifiers, or information about your race, religion, sexual orientation or immigration status, and we ask you to not provide us with those pieces of sensitive information in free-text fields.

3. Where your information comes from

We collect personal information:

directly from you when you create an account, use the app, complete questionnaires, contact us, or fill in a form on our website;
from your parent, guardian or caregiver (if you are under 18 or they are supporting your care), and from the person you care for if you are a caregiver;
automatically from your device and browser when you use the app or website, as described in section 2; and
from our service providers, such as Stripe (payment status) and our messaging providers (delivery status).

4. How and why we use your information

Purpose	Information we use	Who this applies to
Providing your program. Creating and running your account, delivering program content, tracking your progress, and personalizing what you see based on what you tell us.	Account, identity, health and program information, information about the person you care for.	All members
Keeping you safe. Reviewing information to identify risk, contacting you, your emergency contact, your parent or guardian, your care team or emergency services if we are seriously concerned about your safety or someone else’s, and making reports the law requires.	Health and program information, contact details, emergency contact.	All members
Supporting you. Answering your questions, handling complaints and concerns, and providing technical support.	Contact details, communications, account information and any relevant program information.	Everyone who contacts us
Checking eligibility and consent. Confirming your age, verifying parental consent for members aged 13 to 17, and checking the safety criteria in our Terms.	Identity and demographic information, contact details, referral information.	All members
Taking payment. Processing subscriptions, refunds and failed payments through Stripe, and keeping the records tax and accounting law require.	Payment information, account information.	Self-pay members
Quality, safety and improvement. Reviewing how Univa is used and how members progress, fixing errors, testing new features, training our team, and auditing our own safety and quality protocols.	Usage and device information, health and program information (in de-identified form only), communications.	All members
Product analytics. Understanding which features are used and where people get stuck, using aggregated and pseudonymous usage data.	Usage and device information. Not the content of your diaries, messages or health answers.	All members
Research. Evaluating whether Univa works, publishing findings and improving care for people with eating disorders, using de-identified data (section 7). Identifiable research only with your separate consent.	De-identified health and program information; identifiable information only with consent.	All members (de-identified); research participants (identifiable)
Communicating with you. Sending service messages (section 8) and, only if you opt in, news and stories about Univa.	Contact details, communication preferences.	All members; mailing list subscribers
Security and fraud prevention. Protecting the Service, detecting misuse, and keeping accounts secure.	Account information, usage and device information.	Everyone
Legal compliance and protecting rights. Complying with laws, responding to lawful requests, and establishing or defending legal claims.	Any relevant information.	Everyone
Running our business. Accounting, audit, insurance, legal, or other professional advice.	Any relevant information.	Members

4.1 No automated decisions. We do not make decisions about you that have legal or similarly significant effects using automated means alone. Program content is tailored by rules and the information you enter, and a member of our team is involved in any decision to suspend or end your access.

5. Who we share your information with

We share personal information only when we need to, with the following categories of recipients:

Within Univa. Your information may be shared within Univa for our legitimate business purposes and only those with a need-to-know.
Your care team. If you are a self-pay member, we share information with your doctor or care team only with your permission or where section 4 (“Keeping you safe”) applies.
Your parent, guardian or caregiver. If you are under 18, your parent or guardian can see basic engagement information about your account — for example whether you have logged in recently, how many days you have used Univa, and how much of your program you have completed. They cannot see your diary entries, questionnaire answers, notes, recordings or messages in the Univa application. They may be contacted by a member of our team team if we are seriously concerned about your safety (section 4) and, under applicable law, your parent or guardian has the right to make a privacy rights request on your behalf, including the right to know what information we have about you as described in sections 6 and 13.
Your emergency contact and emergency services, if we are seriously worried about your safety.
Service providers that work for us and may only use your information to provide services to us under contract: cloud hosting (Amazon Web Services, US regions); payment processing (Stripe); email, SMS and WhatsApp messaging providers (Twilio); our product analytics provider (Amplitude); customer support and helpdesk tools; and professional advisers.
Our affiliate, Univa Health Ltd (UK), which develops the programs and helps us run and support the Service. Its staff may access your information only when needed for support, safety, program quality or engineering purposes. Affiliate staff are required to maintain confidentiality of user information and may only access information if they have a need-to-know. Your data stays stored in the United States (section 9).
Researchers and partners, using de-identified data only, as described in section 7.
Regulators, courts and law enforcement, where the law requires it, to respond to a valid legal request, or to protect the rights, property or safety of Univa, our members or others.
A buyer or successor, if we sell, merge, or reorganize our business, including through bankruptcy or liquidation, we will share your personal information with the third party (and their agents and advisors), as part of the transaction. We will continue to protect your information according to this notice (or one at least as protective).
Anyone you ask us to share with, with your direction or consent.

6. Children and parental consent

6.1 Univa is designed for people aged 13 and over and their parents and caregivers. Children under 13 cannot have their own account; only a parent or legal guardian can use the service with them. We do not knowingly collect personal information from a child under 13 without verifiable parental consent. If we learn that we have, we will delete it and close the account, as the Children’s Online Privacy Protection Act (COPPA) requires. If you believe a child under 13 has an account, please email dataprivacy@univa.health and we will delete the child’s account and any information associated with it.

6.2 Members aged 13 to 17. Before a 13- to 17-year-old can use the Service, their parent or legal guardian must consent to our Terms and to our collection and use of the young person’s information as described in this notice. Until consent is confirmed, the account stays locked and we hold only the minimum information needed to request parental consent (the young person’s age range, email, and the parent’s contact details); if parental consent is not confirmed within 30 days we delete all the information associated with the account. We confirm consent with the child’s parent or guardian.

6.3 Parents’ rights. A parent or guardian who has consented can ask us to correct or delete their child’s information, and can withdraw consent to further collection (which will end the child’s access). Email dataprivacy@univa.health if you want to exercise any rights to your child’s data or to withdraw previously-given consent. We will first verify that you are the child’s parent or guardian before acting. Because young people need to be able to share honestly for their program to work, a parent’s access to the content of a 13- to 17-year-old’s account is generally limited to the engagement information described in section 6.5 below. We will also share more detailed information with you if the child consents, the safety exception in section 4 applies, or the law requires otherwise. Parents and guardians can exercise a child’s privacy rights as described in Section 12 on behalf of the child, including the right to know what information we have on the child.

6.4 Information about children in a caregiver’s program. When a parent or caregiver records information about a child in their own program, that information is the parent’s or caregiver’s content and is protected in the same way as the rest of their account. We do not use it to build a profile of the child or for any purpose other than supporting the caregiver.

6.5 What a parent or guardian can see. A parent or guardian who has consented to a 13- to 17-year-old’s account can only see basic engagement information in the application — whether the young person has logged in recently, how many days they have used Univa, and how much of their program they have completed. In the app, parents cannot see the young person’s diary entries, questionnaire answers, notes, recordings or messages to us. Parents can see their child’s information as explained in section 4 (“Keeping you safe”) and section 6.3 (a parent’s request on the child’s behalf). We explain this to young people in the plain language description of this notice.

7. Health research and de-identified data

7.1 Learning whether Univa works — and publishing what we learn — is part of how we improve care for people with eating disorders. We do this using de-identified data: information from which we have removed your name, contact details, date of birth, device identifiers and anything else that could reasonably identify or be linked to you. De-identified data is no longer personal information, and we commit not to try to re-identify it. If we share any de-identified data with other parties, we obligate recipients to keep the data in de-identified form and to never try to re-identify it.

7.2 We may share de-identified or aggregated data with research partners such as universities, publish it in peer-reviewed journals, and use it in statistics about eating disorders, symptoms and outcomes.

7.3 If you choose to be part of a research interview or study, we will only share the information that you allow under a separate, explicit consent and, where required, approval from an institutional review board (IRB). You can withdraw at any time without it affecting your access to the Service.

8. How we communicate with you

8.1 Service messages. We send messages that are part of the Service — for example, a reminder that something is waiting for you in the app, a safety check-in, or a billing receipt — by app notification, email, text message or WhatsApp. We never include sensitive details in notifications. You cannot opt out of essential service messages while you have an account.

8.2 Text messages. With your consent, we send service-related text messages to a mobile number you give us. Consent to receive text messages is not required to obtain any good or service from Univa. Message and data rates may apply and message frequency varies. Reply STOP at any time to opt out at any time, or HELP for help. We do not share text messaging originator opt-in data or consent information with anyone other than the service providers that help us deliver our text messages.

8.3 News and stories. We send optional “you might be interested in” emails only if you have opted in, and you can unsubscribe at any time using the link in the email or by emailing dataprivacy@univa.health. If you unsubscribe from optional messages, we keep your email address on a suppression list so that we do not contact you again.

9. Where we store your information

9.1 Your personal information is stored and processed in the United States, on Amazon Web Services infrastructure in US regions. Our payment, messaging and analytics providers may also process limited information in the United States.

9.2 Members of our affiliate’s team in the United Kingdom with a need-to-know may access your information remotely, where needed to support, maintain and keep the Service safe, as described in section 5. That access is controlled, logged and governed by contract; your data is not moved to or stored in the UK as part of normal operations.

10. How long we keep your information

We keep personal information only for as long as we need it for the purposes above, to comply with the law, and to establish or defend legal claims. The main periods are:

Information	How long we keep it
Account and contact information; communication preferences	For as long as your account is active, and for 90 days after it closes in case you want to come back. After that we delete or de-identify it, unless we need to keep it longer for a legal reason.
Content you submit in the app (diaries, messages, uploads)	For as long as your account is active and for 90 days after you cancel, after which it is deleted or de-identified.
Health and program records	Up to 2 years after your account closes, so that we can respond to questions about your care, meet our legal obligations and defend claims. We may hold on to it longer if it’s legally necessary to do so. We delete or de-identify your information once the legal necessity is gone.
Payment and billing records	7 years, as tax and accounting law requires.
Complaints, safety incidents and related communications	7 years from closure of the matter, or longer if needed to defend a legal claim.
Usage, device and analytics information	Up to 24 months in identifiable form; longer only in aggregated or de-identified form.
Research data	De-identified data may be kept indefinitely. Identifiable research data is kept for the period in the study consent you sign.
Marketing suppression list	Indefinitely, so that we do not contact you again.

11. How we protect your information

11.1 We use appropriate technical and organizational security measures, such as access controls and encryption, to protect the personal information we collect and maintain from unauthorized access, destruction, use, modification, or disclosure. However, no security measure or method of transmitting data is completely secure, so we cannot guarantee the absolute security of the personal information we have collected from you. You can help by choosing a strong password, keeping it secret, and telling us immediately at support@univa.health if you think your account has been compromised.

11.2 Our Service may link to third-party websites; their privacy practices are their own and we are not responsible for their data handling.

12. Your privacy choices and rights

12.1 We offer the following rights to everyone who uses the Service in the United States, whichever state you live in.

Access/Know/Data Portability — ask us to confirm what personal information we hold about you (subject to certain exceptions) and to give you a copy, including in a portable, machine-readable format.
Correction — ask us to correct information that is inaccurate or incomplete. You can also update most account details yourself in the app.
Deletion — ask us to delete your personal information. We will do so unless we need to keep it for a legal reason (such as a safety record or tax law).
Withdraw consent — where we rely on your consent (for example for research or marketing), withdraw it at any time; this does not affect what we did before you withdrew your consent.
Opt out — of marketing emails (unsubscribe link), text messages (reply STOP), and non-essential cookies (cookie settings or GPC). We do not sell personal information or use it for targeted advertising, so there is nothing to opt out of on that front.
Limit use of sensitive information — ask us to use your health and other sensitive information only for the purposes needed to provide the Service. We already limit it in this way.
No discrimination — we will never treat you differently, charge you more, or lower the quality of the Service because you exercised a privacy right.

12.2 How to exercise your rights. Email dataprivacy@univa.health, use the privacy options in the app, or write to us at the address in section 14. We will need to verify your identity — usually by confirming details on your account or sending a code to your account email — before we act. You can authorize someone else to make a request for you; we will ask for proof of their authority and may still confirm with you directly. We will not charge you for a request in accordance with applicable law.

12.3 Appeals. If we decline all or part of your rights request, we will tell you why. You can appeal by replying to our decision or emailing dataprivacy@univa.health with “Privacy appeal” in the subject line. A different member of our team will review the appeal and respond within 45 days. If you are still not satisfied, you can contact your state Attorney General or other applicable state regulator.

12.4 Parents and guardians can exercise the above privacy rights on behalf of a child under 18 whose use the parent or guardian has consented to and can help the young person make their own requests. Access to the content of a 13- to 17-year-old’s account is handled as described in sections 6.3 and 6.5.

12.5 Nevada. We do not sell covered information as defined by Nevada law (NRS 603A). Nevada residents may still submit a request to opt out of any future sale by emailing dataprivacy@univa.health.

13. Changes to this notice

13.1 We keep this notice under regular review and place the current version at us.univa.health/privacy-policy. If we make a change that materially affects how we use your personal information, we will tell you by email or through the app before it takes effect and, where the law requires, ask for your consent or give you a chance to withdraw your consent. The “effective date” at the top tells you when this version came into effect.

14. Contact us and how to complain

14.1 If you have any questions or concerns about how we use your personal information, or want to exercise your rights, contact our privacy team: dataprivacy@univa.health, or by mail at Univa Health Consumer LLC, Attn: Privacy, 303 Goring Road, Goring-by-Sea, Worthing, West Sussex BN12 4NX, United Kingdom.

14.2 If you are not satisfied with our response, you can complain to the Federal Trade Commission (www.ftc.gov/complaint), to your state Attorney General or other state regulator. We would always welcome the chance to put things right first.

Thank you for trusting Univa with your information. We will always try to live up to that trust.