Arveli privacy policy.

1. Who this policy covers

Kandola LLC, the independent studio behind Arveli, provides this policy for the Arveli app on iPhone and iPad, its Apple Watch companion, and its widgets and other system integrations.

Core use does not require an Arveli account. Kandola LLC does not operate an Arveli health-data server or collect your journal through the app. For the other parts of this site, see SiftFrame privacy and website privacy. Apple, your email provider, and destinations you choose have their own privacy practices.

2. Your local record

Information you enter may include cycles, bleeding and spotting, symptoms and pain locations, mood, sleep, sexual activity, LH tests and temperature observations, medications and dose events, contraception, pregnancy and outcomes, recovery bleeding, menopause and bleeding after menopause, health focuses, appointments, measurements, private notes, and pregnancy journal photos. Saved comparison plans, Daily Kits, support guides, message presets, and preferences also stay locally.

Sensitive journal information is encrypted on your device, with device-only encryption keys protected in the Keychain. Core tracking, the Health Library, Ask, reports, and privacy controls work offline. There is no developer-operated cloud journal, automatic journal sync through iCloud or CloudKit, advertising SDK, or third-party analytics SDK.

For pregnancy journal photos, you choose images through Apple’s photo picker. Arveli resizes and re-encodes the selected image on device, without preserving its original location or camera metadata. The resulting image and note become part of your local journal and are included in readable exports and encrypted backups. This does not alter the original photo in your photo library.

Daily Kits store the checklists you create; checkmarks reset when you revisit a kit and do not become health records. Together stores your support guides and message presets. It does not create a shared account or give another person live access to your journal.

Kandola LLC does not receive your journal for advertising, remote profiling, analytics, or sale to data brokers. Your device security, presentation choices, and handling of copies also affect your privacy.

3. Analysis, questions, and preferences

Arveli calculates estimates, Pattern Map views, Recorded Together counts, Body Signals comparisons, Pain Locations, recaps, and answers about your recorded history locally. Derived results are calculated in memory, rather than added to your health history, readable export, or encrypted backup. A report you deliberately create may include selected charts and comparisons.

On supported devices with iOS 26 or iPadOS 26 or later, optional Apple on-device language models can classify a question you submit into limited topics and, for questions about your history, a time range. The model receives the submitted question, not your stored health history, and does not generate the health answer. Local rules provide a fallback. Arveli does not use cloud or third-party AI to process these questions.

Questions, query results, Care searches, and temporary sharing drafts are not retained as a chat or search history. Quick Exit clears the active sensitive query session. Saved support guides and message presets are separate records you choose to keep.

Arveli also keeps local settings and limited counters for presentation, the Free Ask allowance, review prompts, and Plus offers. The focus you choose is encrypted on device. Plus invitations can use that focus and aggregate counts, such as the number of recorded cycles, calculated locally. Recorded health values, symptoms, pregnancy context, and question text are not used to target offers. These settings and counters are not sent to Kandola LLC and are excluded from health exports and backups.

4. Apple Health is optional

You choose which Apple Health categories to connect through an explicit action and Apple’s permission controls. Depending on the device and operating system, these include reproductive records, separately chosen sexual-activity and contraception data, sleep, State of Mind, medications, fertility observations, and Body Signals such as sleeping wrist temperature, resting heart rate, heart-rate variability, and respiratory rate. You can change or revoke access in Apple Health or system settings.

After you enable the relevant import option and review its disclosure, exact period, spotting, and separately opted-in sexual-activity records can be added automatically when Arveli is open and checks for updates. Ambiguous records, source changes, deletions, and life-stage conflicts require review; contraception imports also require review. Imported records retain source context and are not automatically written back to Apple Health.

Sleep duration is copied to a Daily Log only when you choose it and save. State of Mind and Body Signals are viewed as transient, source-aware information; they are not automatically copied into Arveli history, exports, or backups. Apple Health medication information remains read-only until you explicitly link it to a local medication record. Connecting a category does not authorize every other category.

Writing supported Arveli-origin records to Apple Health is a separate choice. Apple Health may sync or back up its own copy according to your Apple settings. Its handling is described in Apple’s Health App & Privacy notice. Arveli’s local storage model does not change Apple Health’s separate behavior.

5. Permissions and sharing

• Clinician reports. Choose a range and sections, preview the locally generated PDF, and select a destination through the system share sheet. Private notes require a separate choice. Reports exclude Care searches and estimates; optional Plus charts and comparisons describe recorded information.
• Readable export. Export creates a complete readable copy of recorded health information, including private notes and pregnancy journal photos, plus saved Daily Kits, support guides, and message presets. It is not narrowed by clinician-report selections. Care searches, app settings, and derived analysis are excluded.
• Together and questions. Sharing a guide, message, or question uses a preview and the system share sheet. Review the exact content before choosing a recipient. It does not attach your journal automatically or create an ongoing connection.
• Calendar. An appointment can be passed to Apple’s event editor for review and saving. Arveli does not read your calendar or maintain a live link to the event. The calendar account you choose may sync the saved copy.
• App Lock. Optional authentication uses Apple’s device authentication mechanisms. Arveli does not receive your Face ID or Touch ID biometric template. A privacy shield covers sensitive app content when the app becomes inactive.
• Outside resources. Care and source links use a deliberate handoff. Care does not request location permission or retain search criteria, and Arveli does not append your journal or question to those links. A destination or network provider can receive ordinary connection information when you open it.

Sharing or saving creates a copy outside Arveli. The recipient, app, storage provider, or calendar service controls that copy and may store, sync, or forward it.

6. Notifications, widgets, and Apple Watch

Reminders are local notifications and require your permission and an enabled reminder. New setups use Detailed notification content; Private content is available in Settings. Detailed reminders can identify a type of activity, but do not include recorded values, symptoms, or pregnancy context. Health-specific actions open an authenticated app flow rather than directly changing history from the notification.

New Home Screen widget setups use a Custom Summary with cycle status, the expected period range, and today’s symptom count. You can select individual fields or choose Private mode. Widgets use a limited local snapshot of the fields you enable, not direct access to your health vault or Apple Health. A widget can reveal information to someone who can see that screen.

The optional Apple Watch link requires explicit setup and device authentication. Setup initially enables a detailed configuration, including health summaries, medication names, appointment titles, logging, and Current Focus complications. You can narrow each disclosure in Watch settings. Selected information travels over an encrypted link to the paired Watch, which can retain an encrypted local copy; the iPhone remains the authority for health records and checks Watch logging actions.

Existing saved privacy choices remain in place. Erase, restore, reset, or an invalid Watch connection use protective resets rather than restoring detailed disclosures automatically. Check notifications, widgets, Watch settings, and App Lock for the visibility you want.

7. Encrypted backup and restore

Encrypted Backup creates an encrypted archive before handing it to Files. You choose where to save it; a cloud drive or other provider follows its own rules. Arveli does not automatically upload your journal or provide a developer cloud recovery service.

The separate recovery key is not included in the backup. A device-only copy can be kept in the Keychain and viewed through the app’s authentication flow. Keep your own safe copy, separately from the backup. Kandola LLC cannot retrieve your key or restore a backup without it. Anyone with both a backup and its key can read that backup.

Restore validates the archive and shows a preview before replacing the health history on the destination device. It is not a merge. Apple Health permissions and live links, reminders, widget disclosures, and App Lock settings are not transferred from the backup. After restore, reminders remain off, widgets return to Private, and the Watch link must be reviewed. Restore does not change records already held in Apple Health or other apps.

8. Optional DailyMed label requests

Arveli’s official medication-label reader contacts the U.S. National Library of Medicine’s DailyMed service after a one-time disclosure and an action you choose. A lookup sends the medication’s public RxNorm identifier, or RxCUI, and fetching a chosen label sends its public SPL Set ID.

The request does not include your notes, dose history, pregnancy status, symptoms, other journal data, precise location, or an Arveli account identifier. The identifier reveals which medication information you requested. DailyMed and your network provider can receive ordinary connection information, including your IP address. There is no automatic background lookup or developer-operated relay.

The in-app connection uses a temporary session without persistent cookies or credentials. Downloaded label material is stored in an encrypted local cache with a seven-day freshness limit, excluded from health exports, backups, and widgets. Expired entries are removed when the cache is checked. You can clear it in Settings → Data & Privacy → Clear Downloaded Medication Information without deleting medication records.

Opening the full DailyMed website is a separate outside handoff and follows the browser’s and destination’s practices. See NLM’s Privacy and Security Policy.

9. Purchases and support

Apple processes App Store downloads, Arveli Plus subscriptions, billing, and refunds under its own terms. Arveli uses verified Apple purchase information to determine paid access. Your health records and questions are not attached to purchase metadata, and Kandola LLC does not receive payment card details through the app.

If you email support, we receive your address and anything you include so we can respond. Email is handled by the providers involved. Please do not send health records, reports, backups, recovery keys, or sensitive screenshots. Support cannot access or restore your on-device journal and cannot provide medical advice.

10. Retention, access, and deletion

Your saved records remain locally until you edit or delete them. You can correct entries, export them, and use Settings → Data & Privacy → Erase all health data. Full erase removes locally controlled health records and journal photos, clears sensitive temporary files and downloaded medication information, deletes the locally stored backup recovery key, resets widget disclosures, retires the Watch link, and replaces the vault encryption key. App Lock and your Today layout remain in place.

Full erase also attempts to remove Arveli-created Apple Health copies. Records from other sources and copies that could not be removed may remain; Arveli reports incomplete cleanup. Review Apple Health separately. Exports, shared reports, encrypted backups, saved calendar events, original photos, and recipient copies must be managed at their destinations. Deleting local data does not recall those copies, and deleting the app does not cancel a subscription.

Kandola LLC cannot remotely retrieve or erase a journal it does not hold. Support correspondence may remain in our mailbox while needed to handle your request and related follow-up. Contact us about access, correction, or deletion of information you sent us, subject to applicable obligations. No health record is required to make a privacy request.

11. Contact and policy changes

Questions about this policy or your privacy choices can be sent to developksgroup@gmail.com. Describe the feature or concern without private health information.

We will update the effective date when this policy changes and provide appropriate additional notice for material changes. Review the terms of service and Arveli product limitations for how the app should be used. Features described here may depend on the installed app version, device, and operating system.