Privacy policy

Valeva is a coaching platform operated from Australia: a web dashboard for coaches and a mobile app for coaches and their clients, covering training, nutrition, check-ins, messaging and payments. Questions about this policy or your data: reach us via the support page.

Account and profile. Email address, name, and the optional profile you choose to add (photo, location, timezone; for coaches a bio, specialties and qualifications; for clients an optional goal weight).

Coaching data. The content that makes the product work: training programs and logged workouts, nutrition diary entries and meal plans, habits and habit logs, check-in forms and responses (including any photos or files you attach to an answer), messages between coach and client (text, photos, voice notes and video clips), a coach's private notes about their clients, body metrics, progress photos, and shared resources.

Payments. Payment is handled by Stripe through hosted checkout — card details never touch our servers. We store subscription status and what Stripe reports back to us (plan, amounts, billing state).

Technical. Device push-notification tokens (so messages and reminders can reach your phone) and the feedback you submit in-app. We do not collect advertising identifiers.

Some features handle health-adjacent information. We treat it as the most sensitive class of data in the product:

• Apple Health and Health Connect. With your explicit permission, the mobile app reads daily aggregates — steps, sleep duration, resting heart rate and weight — and stores them as entries in your metrics timeline. We only ever read; we never write to or change your health store, and you can revoke the permission at any time in your device settings.
• Connected wearable accounts (Fitbit, Garmin, Oura). If you connect one, we receive the same daily aggregates from the vendor's API. The access tokens are stored encrypted (AES-256-GCM) and are used only to fetch your readings. Disconnecting stops all syncing immediately; already-synced entries stay in your timeline until you delete them.
• Body-scan documents (DEXA and similar). A scan PDF you upload is processed to extract the printed values for your review and is then discarded — the document itself is never stored.
• How health data is used. Solely to show your readings to you and to the coach or coaches you are connected with. It is never used for advertising, never sold, and never shared beyond the processors listed below.

Some features send specific content to an AI provider, only when you use that feature:

• Meal photos, spoken or typed meal descriptions, and body-scan documents are sent to Anthropic to identify foods or extract printed values. The results are estimates you review and confirm — nothing is saved without your confirmation.
• Voice messages are transcribed by OpenAI (Whisper) so a caption can accompany the audio.
• A coach's program or meal-plan briefs are sent to Anthropic to draft a proposal the coach then reviews.
• This content is sent solely to deliver the feature. We do not permit these providers to use it to train their models.

Food barcode scans and food-name searches query Open Food Facts, a public food database; the query is the barcode or search text itself.

We use a small set of infrastructure providers, each processing data only to run the service:

• Supabase — authentication and our database.
• Cloudflare R2 — file storage (photos, attachments, resources).
• Railway — application hosting.
• Upstash — job queues and real-time message delivery.
• Stripe — payments (hosted checkout; card data goes directly to Stripe).
• Resend — transactional email (invites, notifications you enable).
• Google Firebase Cloud Messaging — push notifications.
• Anthropic / OpenAI / Open Food Facts — only as described under AI features.

Your coach sees the coaching data the product is for: your training, nutrition, habits, check-ins, metrics and messages with them. Progress photos carry a per-photo visibility control — photos you mark private are never shown to your coach. In a coaching team, administrators can see coaching artifacts but never get automatic access to a client's food diary, photos or body metrics — that always requires a direct coach-client relationship. We never sell personal information to anyone.

The coaching product — the dashboard and the mobile app — contains no third-party analytics, tracking or advertising SDKs. Your coaching data is never fed to an analytics platform.

Our public marketing website (valeva.com) uses Google Analytics to measure aggregate site visits — standard traffic measurement (pages viewed, rough region, how visitors found us). It runs only on the marketing pages, never inside the product, and is never linked to your account or coaching data.

You can delete your account in-app (Settings → Delete account) or by emailing us. Deletion is a hard delete of your world — profile, logs, photos, files and connections. A few honest exceptions: messages you sent to other people remain in their conversations attributed to “Deleted user”, and product feedback you submitted is retained with your identity removed. Backups age out on a rolling basis.

Data is encrypted in transit; wearable tokens are encrypted at rest; file downloads run through signed, expiring, access-checked URLs; and coach-client access boundaries are enforced server-side on every request.

We handle personal information in accordance with the Australian Privacy Principles. You can access, correct or delete your data — most of it directly in the product, and anything else via the support page. If you're not satisfied with our response you can complain to the Office of the Australian Information Commissioner.

Valeva is not directed at children. You must be at least 16 to create an account.

If this policy changes materially we will update this page and the date above, and notify account holders where the change matters to them.