Privacy Policy

Last updated: 14 August 2026

This policy explains what personal data the Nuvami application (the «app») processes, on what legal bases, where it is stored, and which rights you can exercise under Regulation (EU) 2016/679 (the «GDPR»). Nuvami helps people caring for a pet with a chronic illness track therapies, doses and measurements.

Current state of the app. Nuvami runs in a hybrid way. The data you enter about your pet (diagnoses, doses, measurements, contacts) stays on your device until you create an account: as long as it stays local, we do not collect it. The cloud service is live: the moment you create an account and turn on sync, that data is processed on our servers in the EU (see §2.2). In addition, to improve the app, we collect pseudonymous usage events (product analytics, which you can turn off in settings; see §5) from the start, including before you create an account; and on the free plan, with your consent, we show advertising (see §4). The sections below describe each of these in detail.

1. Data controller

The data controller is Aleksei Konoplia (a natural person), the developer of Nuvami.

For any request about your data or to exercise your rights, contact:
privacy@nuvami.it

No Data Protection Officer (DPO) has been appointed, as one is not required under Art. 37 GDPR; the address above is the single contact point for privacy matters.

2. What data we process, and when

2.1 — On your device (before you have an account)

The data you enter about your pet and its therapy is stored locally only on your iPhone until you create an account. It includes, for example: your pet's name and species, diagnoses, medications and doses, measurements (e.g. blood glucose, weight), the vet's name and phone number, and the names of family members/caregivers. As long as it stays local, we do not collect it. (Product-analytics usage events are a separate thing and may be collected even now — see §5.)

2.2 — With an account (cloud service live)

When you create an account and turn on sync, we process the following categories of data server-side:

Category	Examples
Account identifiers	e-mail address and the sign-in identifier provided by Apple, Google or Facebook (if you use those sign-in options)
Pet health data	diagnoses, dose log (taken/skipped), measurements and their trends
Contacts	the vet's phone number, names of invited family members/caregivers
Subscription	subscription status and plan (weekly/monthly/annual); payment is handled by Apple. If you buy while you already have an account, we attach a purchase code for your Nuvami family to the transaction: a technical code generated at random for this purpose alone, with no name, no e-mail and no record of when you created the account. It serves only this: to keep a purchase receipt that ends up in the wrong hands from switching the subscription on for another account. It is not the identifier your account is filed under with us, and deleting the account deletes it too
Closing a pet's record	whether and when you closed a pet's record and, only if you choose to tell us, the reason: "no longer with us" or "another reason". Answering is optional and you can undo your answer; we use it solely so we don't keep writing to you as if nothing happened (legal basis: your consent, art. 6(1)(a); withdrawable at any time by reopening the record or clearing the answer). We never ask for the date of death.
Product analytics	pseudonymous usage events (see §5)

Pet health data, on its own, does not fall under Art. 9 GDPR (which concerns people). However, once linked to an identifiable account holder, we treat it with the same safeguards as special-category data: encryption, minimisation and restricted access.

2.3 — Advertising (free plan)

See §4. This applies only to free-plan users who consent. Subscribers see no advertising and no advertising component is activated for them.

2.4 — Third-party data: your vet's contact details

Among the contacts you can save in the app are your vet's name and phone number, so you can call them quickly in difficult moments. This contact relates to someone other than you — the vet, or their clinic — and therefore constitutes personal data of a third party that you enter. We process only the details you enter, and we ask you to save only contacts you are authorised to use.

What data: the name of the clinic or vet and the related phone number. No other data about the vet.
Where it comes from: we do not receive it from the vet; it is entered by one of our users (typically a client of the vet). It does not come from publicly accessible sources.
Why and on what basis: to give you, as part of the service, a direct call button to the vet when needed. The legal basis is our legitimate interest (Art. 6(1)(f)) in making the app useful in urgent situations; the balancing test is favourable because we process a minimal contact detail, within the data subject's reasonable expectations and with no disproportionate impact. This is not special-category data under Art. 9 GDPR.
How long: for as long as you keep that contact in the app. If you remove the contact, delete the pet, or close your account, the vet's contact is deleted along with the other linked data (see §7). We do not pass it to third parties for their own purposes and it is not included in other users' exports; it is held on our systems (EU hosting, Hetzner) like the rest of the data (see §9).

Information to the vet (Art. 14 GDPR). Because we receive this contact from you rather than directly from the vet, we have no direct channel to inform them individually, and notifying each professional one by one would involve disproportionate effort. For this reason, under Art. 14(5)(b) GDPR, we provide this information publicly and transparently here.

The vet's rights. A vet whose contact details are processed has the same rights under Arts. 15–21 GDPR (access, rectification, erasure, restriction and objection) and can exercise them by writing to privacy@nuvami.it: on request we will delete the contact. They also have the right to lodge a complaint with the Italian Data Protection Authority (Garante) (see §13). In any case, the user who entered it can remove it at any time directly in the app.

3. Legal bases (Art. 6 GDPR)

Performance of a contract — Art. 6(1)(b): providing the service (account, sync, subscription and paid features).
Legitimate interest — Art. 6(1)(f): pseudonymous product analytics to improve and secure the app (see §5), preventing fraudulent use of subscriptions (the identifier attached to the purchase, §2.2) and the feedback you send us through the in-app "La tua opinione" survey (see §8). You can object at any time to product analytics from the app settings (Impostazioni → Privacy e dati → Statistiche d'uso); for the survey feedback (§8) and for the anti-fraud identifier (§2.2), by writing to privacy@nuvami.it — in the latter case we may have to keep the measure on compelling legitimate security grounds (Art. 21(1)).
Consent — Art. 6(1)(a): advertising for the free plan (collected via Google's consent form and iOS tracking permission — see §4) and participation in research/interviews (see §8). Consent can be withdrawn at any time.

4. Advertising and tracking

On the free plan we show full-screen (interstitial) ads via Google AdMob (Google Ireland Ltd / Google LLC), which acts as an independent controller/provider for the advertising service. Subscribers see no ads and the advertising kit is not initialised for them: no advertising tracking.

In the European Economic Area we show you Google's consent form (UMP) before any advertising.
On iOS we ask for tracking permission (App Tracking Transparency). If you do not consent, ads are non-personalised and we do not use the advertising identifier (IDFA) for cross-app tracking.
For advertising, device/advertising identifiers and interaction data may be processed. Domains involved include googleads.g.doubleclick.net, googlesyndication.com, google-analytics.com.
The app is intended for a general audience (not children): we do not apply «child-directed» treatment.

For how Google processes this data, including outside the EU under appropriate safeguards (Standard Contractual Clauses), see Google's Privacy Policy and how Google uses data.

5. Product analytics (first-party)

To understand how the app is used and to improve it, we collect pseudonymous usage events (e.g. app open, onboarding completion, dose confirmation), including before you create an account. This analytics is:

First-party and EU-resident: events are written to our own PostgreSQL database hosted in Falkenstein, Germany. No third-party analytics SDKs (Amplitude, Mixpanel, Firebase Analytics, etc.).
Pseudonymous and not linked to your account: no e-mail, no person's name, no pet name or diagnosis, no free text, no clinical values — only a per-install technical identifier that is not tied to your identity or account.
No IP storage: the IP address is used only to derive the country (two-letter code) via a local lookup, then discarded — it is not stored in the event.
Opt-out: you can object to product analytics in the app's settings. If you turn it off, we stop collecting these events.

Retention: raw events are kept for up to 13 months, after which they are turned into anonymous aggregates and the raw data is deleted.

Note: the above concerns the app. The nuvami.it website, by contrast, uses Google Analytics 4 only with your prior consent: see the Cookie Policy.

In addition, the website buttons that lead to the App Store carry a campaign label (pt/ct) that lets Apple tell us, in aggregate form, how many installs come from the site: it is not a cookie, it does not identify you, and it works regardless of your cookie choice. Details in the Cookie Policy (§5).

6. Where data is stored and how we protect it

Data stays in the European Union: it is hosted on a server in Falkenstein (Germany, provider Hetzner). Any backups are kept in the EU.
Encryption in transit: all communication uses HTTPS (TLS 1.2/1.3) with HSTS.
Encryption at rest: the data volume is encrypted (LUKS), and the most sensitive personal fields (e-mail, vet phone) are encrypted at the application level.
Restricted, logged access: administrative access is limited and recorded in an audit log kept for 24 months.
Breaches: in the event of a personal data breach, we will notify the Italian Data Protection Authority within 72 hours, as required by Art. 33 GDPR.

7. Data retention

Account and health data: kept for the lifetime of the account (history is the product's value). When you delete your account, the data is erased immediately and permanently: there is no grace period and the action cannot be undone (see the note on backups below). If you are the owner, deletion covers the entire shared family: people who help you keep their own account, but lose access to this family's data.
Product analytics: 13 months (see §5).
"La tua opinione" survey: for the lifetime of the account (see §8); erasable on request.
Access and erasure register (audit): 24 months. The entry recording an erasure keeps internal identifiers — the account's and that of the person who asked for it — and nothing more about you: no name, no e-mail, none of your pet's data. It is the proof the erasure took place.
Identifier attached to the purchase (§2.2): stays in the receipt held by Apple, for as long as Apple keeps it, even after your account is deleted (see §11).

Encrypted backups follow a rotation and are retired over time, within a maximum of 3 months: a deleted account may still appear in dated backups until they expire. Erased data is not reintroduced into production: after any emergency restore from backup we re-apply the erasures on record.

8. Research and interviews (optional)

Occasionally we may invite you to a short in-app survey or an interview. The "La tua opinione" survey collects a score (0–10), one or more categories and an optional free-text comment, and is linked to your account (legal basis: legitimate interest in improving Nuvami, Art. 6(1)(f); you can object at any time). Responses are read by our internal team to improve the product and stay separate from your pet's health data. The comment can contain whatever you write, so please do not include sensitive data (e.g. about health). You can ask us to delete your responses at any time by writing to privacy@nuvami.it; in any case they are deleted if you delete your account.

The interview is optional and requires your explicit consent; booking happens through an external scheduling tool (with its own privacy policy). The app does not collect your contact details: you may provide them to the external tool. You can give or withdraw this consent at any time under Famiglia → Impostazioni → Privacy e dati → Ricerca e interviste (Family → Settings → Privacy & data → Research and interviews; the app's interface is currently in Italian).

9. Providers and recipients

We do not sell your data. The following may process parts of it, solely for the purposes described:

Hetzner Online GmbH — infrastructure hosting (EU, Germany).
Google — advertising (AdMob) and consent form, free plan only and only with consent.
Apple — purchase and subscription handling (App Store) and, if you choose Sign in with Apple, authentication. For purchases and subscriptions Apple (Apple Distribution International Ltd., Ireland) acts as an independent controller under Apple's own Privacy Policy; at purchase it also receives and keeps the purchase code described in §2.2.
Apple / Google / Facebook — authentication, if you choose to sign in with one of these.
External scheduling tool — only if you book an interview (§8).

10. Transfers outside the EU

The data we manage stays in the EU. Some providers (in particular Google for advertising and sign-in services, and Apple for purchases and subscriptions) may also process data outside the EU: for that processing they act as independent controllers, on the safeguards set out in their own privacy policies (Standard Contractual Clauses or adequacy decisions). What leaves our systems this way is, in particular, the purchase code attached to the purchase (§2.2), received by Apple (for EU users the controller is Apple Distribution International Ltd., Ireland); what Apple then does with it, and where, is governed by Apple's own privacy policy. The other outbound flows are described in §4 (advertising) and §9 (sign-in with Apple/Google/Facebook, scheduling tool).

11. Your rights

Under Arts. 15–22 GDPR you have the right to:

Access and portability (Arts. 15, 20): obtain a copy of your data. With an active account you will be able to export it from Impostazioni → Privacy e dati → Esporta i miei dati (Settings → Privacy & data → Export my data).
Erasure (Art. 17): delete your account and data from Impostazioni → Privacy e dati → Elimina il mio account (Settings → Privacy & data → Delete my account). Erasure is immediate and permanent (see §7). One exception we would rather tell you about: if you took out a subscription from an account that already existed, the purchase code attached to the transaction (§2.2) stays in the receipt held by Apple, which handles it as an independent controller. Today we have no way to remove it from a receipt already issued; we will do so as soon as that becomes technically possible, and for data Apple handles as a controller you can contact Apple directly. On our side that code no longer exists: it lived in a single place, deleted together with the account, and it does not appear in the register entry recording the erasure (§7), which keeps a different identifier. One window remains and we would rather tell you about it: for as long as dated backups exist (up to 3 months, §7) the link would still be technically reconstructible from those copies.
Rectification (Art. 16): correct inaccurate data, directly in the app.
Restriction and objection (Arts. 18, 21): object to product analytics in the settings; for the other processing based on legitimate interest (§3), by writing to privacy@nuvami.it.
Withdraw consent (Art. 7): withdraw at any time your consent to advertising (from iOS tracking settings) and to research (§8), as easily as you gave it.

To exercise these rights, use the in-app features or write to privacy@nuvami.it.

12. Children

Nuvami is intended for adults caring for a pet and is not directed to children. We do not knowingly collect data from children.

13. Complaints

If you believe the processing of your data infringes the GDPR, you may contact us (privacy@nuvami.it) and you have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of your country of residence.

14. Changes to this policy

We may update this policy. The current version is always published at this address, with the «last updated» date at the top. For significant changes we will notify you in the app.