Privacy Policy

Last updated: 27 September 2026

This policy explains what personal data the Nuvami application (the «app») processes, on what legal bases, where it is stored, and which rights you can exercise under Regulation (EU) 2016/679 (the «GDPR»). Nuvami helps people caring for a pet with a chronic illness track therapies, doses and measurements.

1. Data controller

The data controller is Aleksei Konoplia (a natural person), the developer of Nuvami.

For any request about your data or to exercise your rights, contact:
privacy@nuvami.it

No Data Protection Officer (DPO) has been appointed, as one is not required under Art. 37 GDPR; the address above is the single contact point for privacy matters.

2. What data we process, and when

2.1 — On your device (before you have an account)

The data you enter about your pet and its therapy is stored locally only on your iPhone until you create an account. It includes, for example: your pet's name and species, diagnoses, medications and doses, measurements (e.g. blood glucose, weight), the vet's name and phone number, and the names of family members/caregivers. As long as it stays local, we do not collect it. (Product-analytics usage events are a separate thing and may be collected even now — see §5.)

2.2 — With an account (cloud service live)

When you create an account and turn on sync, we process the following categories of data server-side:

Pet health data, on its own, does not fall under Art. 9 GDPR (which concerns people). However, once linked to an identifiable account holder, we treat it with the same safeguards as special-category data: encryption, minimisation and restricted access.

2.3 — Advertising (free plan)

See §4. This applies only to free-plan users. Subscribers see no advertising and no advertising component is activated for them.

2.4 — Third-party data: your vet's contact details

Among the contacts you can save in the app are your vet's name and phone number, so you can call them quickly in difficult moments. This contact relates to someone other than you — the vet, or their practice or facility — and therefore constitutes personal data of a third party that you enter. We process only the details you enter, and we ask you to save only contacts you are authorised to use.

• What data: the name of the clinic or vet and the related phone number. No other data about the vet.
• Where it comes from: we do not receive it from the vet; it is entered by one of our users (typically a client of the vet). It does not come from publicly accessible sources.
• Why and on what basis: to give you, as part of the service, a direct call button to the vet when needed. The legal basis is our legitimate interest (Art. 6(1)(f)) in making the app useful in urgent situations; the balancing test is favourable because we process a minimal contact detail, within the data subject's reasonable expectations and with no disproportionate impact. This is not special-category data under Art. 9 GDPR.
• How long: for as long as you keep that contact in the app. If you remove the contact, delete the pet, or close your account, the vet's contact is deleted along with the other linked data (see §7). We do not pass it to third parties for their own purposes and it is not included in other users' exports; it is held on our systems (EU hosting, Hetzner) like the rest of the data (see §9).

When the vet is a family member instead. The above is about the contact you save yourself. If you invite a vet into your Nuvami family, they have their own account, and their data (e-mail, sign-in identifier, devices, sessions) is processed like that of any other user, under this same policy (see §2.2 and §7); in that role they can also read and edit the pet's treatment protocol. The two situations are distinct: in the first the vet has no relationship with us, in the second they are one of our users.

Information to the vet (Art. 14 GDPR). Because we receive this contact from you rather than directly from the vet, we have no direct channel to inform them individually, and notifying each professional one by one would involve disproportionate effort. For this reason, under Art. 14(5)(b) GDPR, we provide this information publicly and transparently here.

The vet's rights. A vet whose contact details are processed has the same rights under Arts. 15–21 GDPR (access, rectification, erasure, restriction and objection) and can exercise them by writing to privacy@nuvami.it: on request we will delete the contact. They also have the right to lodge a complaint with the Italian Data Protection Authority (Garante) (see §13). In any case, the user who entered it can remove it at any time directly in the app.

2.5 — Tips and news notifications

If you have turned notifications on, every now and then we also send you care tips and app news. That is a promotional message from us, and it is a separate thing from the dose reminders and health alerts, which are part of the service and keep arriving either way.

• Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 13 of the ePrivacy Directive, which each country implements in its own direct-marketing rule: Art. 130 of the Privacy Code in Italy, §7(2) UWG in Germany, Art. 21 LSSI-CE in Spain, Art. L. 34-5 CPCE in France). The channel is announced in the app on the notifications screen and is governed by the "Tips and news" switch: leaving it on counts as consent, turning it off withdraws it.
• How you withdraw it: at any time, with the "Tips and news" switch in Family → Settings → NOTIFICATIONS. Withdrawing it does not touch your dose reminders. ⚠️ If your version of the app does not have that switch yet, the channel is on: update the app to get it, or write to privacy@nuvami.it and we will take you off the list — no reason asked. You can also turn off all Nuvami notifications in iOS settings, but that would cost you the dose reminders too.
• What we process: the notification token Apple issues to your device and your device language (so we write to you in your own language); the technical delivery outcome (delivered, not delivered, not sent — with the code Apple returned or our own reason); and, if you open the message, the fact that it was opened, recorded pseudonymously alongside the other usage events (§5): it carries the identifier of the message and the same per-install technical identifier that rides the other usage events (§5) — not your name, not your account identifier, and we do not link it to your account. We measure how many opens a campaign got, not who opened it. Measuring opens belongs to product analytics (§5) and rests on legitimate interest, with the opt-out described there: the "Tips and news" switch stops the messages, usage statistics are turned off in the privacy settings.
• No profiling: we write the text ourselves and it is the same for every recipient in the same language. We do not choose who receives it from your pet's health data, from your measurements or from how you use the app: it goes to everyone who has notifications on and has not switched this channel off. There is no automated decision-making within the meaning of Art. 22 GDPR.
• Recipients: to deliver the message to your iPhone we go through Apple's notification service (APNs) — see §9 and §10. We use no third-party marketing tools.
• For how long: see §7.

2.6 — Technical logs of our servers

Every request your browser or the app sends to our addresses leaves a line in a technical server log. This covers all four of them: nuvami.it (the website), api.nuvami.it (the address the app talks to on every sync), s.nuvami.it (the shared-report pages, which people without an account also open — your vet, for instance) and admin.nuvami.it (our internal panel). It happens even if you have no account and even if you have never opened the website: that is why this section is here and not only in the Cookie Policy, which is about the site.

• What the line contains: date and time, the address requested, your IP address and the technical headers your browser or the app send with every request (including the kind of program and the preferred language), plus technical data about the connection and the response (outcome, size, duration). Some headers that may carry credentials, or the address of an identified person, are removed or replaced with a placeholder before the line is written; the same goes for a shared-report link and for an invite code when they appear in the address, in the form your browser or the app sends them. The body of a request is never logged: your pet's data does not end up in the log. The requested address is logged, however, including anything after the «?» — which is why a report link and an invite code are replaced before the line is written. ⚠️ One exception: the passage through the bridge address to the App Store (nuvami.it/go/store, §5 and Cookie Policy §5) does not end up in this log but in a separate log, whose line does not contain your IP address nor your browser's headers: what remains is date and time, the address requested, the outcome, the technical data of the response and the browser type; and if the browser tells us it is loading the link in advance, no line is written at all. That log follows the same retention stated in §7.
• What it is for, and which purpose sets how long we keep it: the security of the service — spotting and blocking abuse, reconstructing an incident. It is that purpose, and only that one, that determines how long we keep the lines. From the same lines we also derive a purely statistical figure about the site: how many times the printable forms of the guides are downloaded (§5 and Cookie Policy §5). The clicks the website buttons send to the App Store, by contrast, are counted in the separate log described above, which does not contain your IP address. Neither count adds anything to the line and does not extend retention. ⚠️ For security, and only for security, an automated system may temporarily block an IP address: either because it generates unusual traffic towards us, or because other participants reported it to the anti-abuse network (§9) — in that second case the block applies even if nothing has happened from that address towards us. The block applies to the address, not to the person, and is temporary — but it is worth saying what it entails: while it lasts, our other services are unreachable from that address too, so the app cannot sync. If this happens to you for no apparent reason, write to privacy@nuvami.it.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You may object at any time, on grounds relating to your particular situation, by writing to privacy@nuvami.it (Art. 21 GDPR): as this is a security log we may have to keep the line on compelling legitimate grounds, and if so we will tell you.
• Who sees them: we do, and Hetzner, the provider hosting the server (§9); for the addresses that trigger a security rule and only those, the anti-abuse network of CrowdSec SAS (§9); and, for admin.nuvami.it only (our internal panel, which is not aimed at users), Cloudflare, which sits in front of that address and therefore sees its requests before we do — see §9 and §10.
• For how long: see §7.

We do not use these lines to build profiles, and we do not link them to your account or to the usage events described in §5: they stay a technical record.

3. Legal bases (Art. 6 GDPR)

• Performance of a contract — Art. 6(1)(b): providing the service (account, sync, subscription and paid features).
• Legitimate interest — Art. 6(1)(f): requesting NON-personalised ads on the free plan when you do not consent (the interest: keeping the core features free — see §4; you may object by writing to privacy@nuvami.it), pseudonymous product analytics to improve and secure the app (see §5), the security of our servers and the technical logs that come with it (see §2.6), preventing fraudulent use of subscriptions (the identifier attached to the purchase, §2.2) and the feedback you send us through the in-app "Your opinion" survey (see §8). You can object at any time to product analytics from the app settings (Family → Settings → Privacy and data → Usage statistics); for the survey feedback (§8) and for the anti-fraud identifier (§2.2), by writing to privacy@nuvami.it — in the latter case we may have to keep the measure on compelling legitimate security grounds (Art. 21(1)).
• Consent — Art. 6(1)(a): personalised advertising for the free plan and storing/accessing information on your device for advertising purposes (collected via Google's consent form and iOS tracking permission — see §4), tips and news notifications (see §2.5; and your country's direct-marketing rule) and participation in research/interviews (see §8). Consent can be withdrawn at any time.

4. Advertising and tracking

On the free plan we show full-screen (interstitial) ads via Google AdMob (Google Ireland Ltd / Google LLC), which acts as an independent controller/provider for the advertising service. Subscribers see no ads and the advertising kit is not initialised for them: no advertising tracking.

• In the European Economic Area we show you Google's consent form (UMP) before any advertising. If you do not consent, advertising does not go away: we keep requesting ads, but non-personalised ones — we do not use your advertising identifier to profile you. What Google then chooses to show you is Google's decision, as an independent controller. If you want no advertising at all, a Nuvami+ subscription removes it for you and the whole family.
• On iOS we ask for tracking permission (App Tracking Transparency). If you do not consent, ads are non-personalised and we do not use the advertising identifier (IDFA) for cross-app tracking.
• For advertising, device/advertising identifiers and interaction data may be processed. Domains involved include googleads.g.doubleclick.net, googlesyndication.com, google-analytics.com.
• The app is intended for a general audience (not children): we do not apply «child-directed» treatment.

For how Google processes this data, including outside the EU under appropriate safeguards (Standard Contractual Clauses), see Google's Privacy Policy and how Google uses data.

5. Product analytics (first-party)

To understand how the app is used, to improve it and to check that its mechanisms actually work, we collect pseudonymous usage events (e.g. app open, onboarding completion, dose confirmation) and technical outcomes of app operations (e.g. whether, when you sign out, the device was unlinked from notifications: we record only the outcome of the operation (e.g. succeeded, failed, not needed) and no device identifier), including before you create an account. This analytics is:

• First-party and EU-resident: events are written to our own PostgreSQL database hosted in Falkenstein, Germany. No third-party analytics SDKs (Amplitude, Mixpanel, Firebase Analytics, etc.).
• Pseudonymous and not linked to your account: no e-mail, no person's name, no pet name or diagnosis, no free text, no clinical values — only a per-install technical identifier that is not tied to your identity or account.
• No IP storage: the IP address is used only to derive the country (two-letter code) via a local lookup, then discarded — it is not stored in the event. ⚠️ This is about the usage event. The request that carries it still leaves a line in the technical server log, and that line does contain the IP address (§2.6): they are two separate processing operations, with different purposes and different retention, and the second is not cancelled by the first.
• Opt-out: you can object to product analytics in the app's settings. If you turn it off, we stop collecting these events.

Retention: raw events are kept for up to 13 months, after which they are turned into anonymous aggregates and the raw data is deleted.

Note: the above concerns the app. The nuvami.it website, by contrast, uses Google Analytics 4 only with your prior consent: see the Cookie Policy.

In addition, the website buttons that lead to the App Store go through an address on our own site, which redirects to the App Store storefront and adds a campaign label (pt/ct): the label lets Apple tell us, in aggregate form, how many installs come from the site, while the passage through our server lets us count, again in aggregate, how many clicks leave the pages. The labels are not cookies and do not identify you; the passage through our server leaves a line in a separate log which does not contain your IP address nor your browser's headers (§2.6). Both work regardless of your cookie choice; the purposes, legal basis, retention and right to object are described in the Cookie Policy (§5).

6. Where data is stored and how we protect it

• Data stays in the European Union: it is hosted on a server in Falkenstein (Germany, provider Hetzner). Any backups are kept in the EU. One exception is the anti-abuse network that receives the IP addresses which trigger a security rule, described in §9 and in the Cookie Policy (§8).
• Encryption in transit: all communication uses HTTPS (TLS 1.2/1.3) with HSTS.
• Encryption at rest: the data volume is encrypted (LUKS), and the most sensitive personal fields (e-mail, vet phone) are encrypted at the application level.
• Restricted, logged access: administrative access is limited and recorded in an audit log kept for 24 months.
• Breaches: in the event of a personal data breach, we will notify the Italian Data Protection Authority within 72 hours, as required by Art. 33 GDPR.

7. Data retention

• Account and health data: kept for the lifetime of the account (history is the product's value). When you delete your account, the data is erased immediately and permanently: there is no grace period and the action cannot be undone (see the note on backups below). If you are the owner, deletion covers the entire shared family: people who help you keep their own account, but lose access to this family's data.
• Product analytics: 13 months (see §5).
• "Your opinion" survey: for the lifetime of the account (see §8); erasable on request.
• Access and erasure register (audit): 24 months. The entry recording an erasure keeps internal identifiers — the account's and that of the person who asked for it — and nothing more about you: no name, no e-mail, none of your pet's data. It is the proof the erasure took place.
• Tips and news notifications (§2.5): 24 months. That is how long we keep the campaign and its delivery register (which device, in which language, with what outcome); once the period is up, the campaign and its deliveries are deleted. If you delete your account, or the device is removed, the delivery rows about it go immediately along with it. The fact that a message was opened is not kept here: it lives among the pseudonymous usage events and follows their period (§5).
• Identifier attached to the purchase (§2.2): stays in the receipt held by Apple, for as long as Apple keeps it, even after your account is deleted (see §11).
• Technical server logs (§2.6), including the separate click log: 32 days on the server; 7 days longer in the system backup copies, so at most 39 days in total. Full explanation in the Cookie Policy (§5). ⚠️ The backup copies mentioned here are the server's system backups and are a different thing from the application backups described in the next paragraph.

Encrypted backups follow a rotation and are retired over time, within a maximum of 3 months: a deleted account may still appear in dated backups until they expire. Erased data is not reintroduced into production: after any emergency restore from backup we re-apply the erasures on record.

8. Research and interviews (optional)

Occasionally we may invite you to a short in-app survey or an interview. The "Your opinion" survey collects a score (0–10), one or more categories and an optional free-text comment, and is linked to your account (legal basis: legitimate interest in improving Nuvami, Art. 6(1)(f); you can object at any time). Responses are read by our internal team to improve the product and stay separate from your pet's health data. The comment can contain whatever you write, so please do not include sensitive data (e.g. about health). You can ask us to delete your responses at any time by writing to privacy@nuvami.it; in any case they are deleted if you delete your account.

The interview is optional and requires your explicit consent; booking happens through an external scheduling tool (with its own privacy policy). The app does not collect your contact details: you may provide them to the external tool. You can give or withdraw this consent at any time under Family → Settings → Privacy and data → Research and interviews.

9. Providers and recipients

We do not sell your data. The following may process parts of it, solely for the purposes described:

• Hetzner Online GmbH — infrastructure hosting (EU, Germany), including the system backup copies and the technical server logs (§2.6).
• CrowdSec SAS (RCS Nanterre 880 140 496, 20 rue Maurice Arnoux, 92120 Montrouge, France) — the anti-abuse network protecting our hosts. It receives only the addresses that trigger a security rule, not the traffic of people browsing normally. According to its own privacy notice what it is sent is the IP address, the date and time and the type of incident, which it keeps for periods of its own (Cookie Policy §8) and may pass on to the members and partners of its network: that onward transmission is described in its notice as processing carried out jointly with them. Towards us the provider acts as an independent controller: it does not process this data on our instructions. On transfers see §10; for data already sent to the network you may also contact the provider (dpo@crowdsec.net).
• Cloudflare — protection and access control for the internal panel only (admin.nuvami.it): it sees requests to that address, not those of the app or the website. For data subjects in the EU the contract is with Cloudflare Ireland Ltd.; on transfers see §10.
• Google — advertising (AdMob) and consent form, free plan only.
• Apple — purchase and subscription handling (App Store), notification delivery to your device (Apple Push Notification service, APNs: it receives the device token and the text of the message) and, if you choose Sign in with Apple, authentication. For purchases and subscriptions Apple (Apple Distribution International Ltd., Ireland) acts as an independent controller under Apple's own Privacy Policy; at purchase it also receives and keeps the purchase code described in §2.2.
• Apple / Google / Facebook — authentication, if you choose to sign in with one of these.
• External scheduling tool — only if you book an interview (§8).

10. Transfers outside the EU

The data we manage stays in the EU, with the single exception described below (anti-abuse network). Some providers (in particular Google for advertising and sign-in services, and Apple for purchases, subscriptions and notification delivery) may also process data outside the EU: for that processing they act as independent controllers, on the safeguards set out in their own privacy policies (Standard Contractual Clauses or adequacy decisions). What leaves our systems this way is, in particular, the purchase code attached to the purchase (§2.2), received by Apple (for EU users the controller is Apple Distribution International Ltd., Ireland); what Apple then does with it, and where, is governed by Apple's own privacy policy. The other outbound flows are described in §4 (advertising) and §9 (the CrowdSec SAS anti-abuse network, sign-in with Apple/Google/Facebook, scheduling tool). For the anti-abuse network (§9): where the recipient of a flow is outside the European Union, the provider states that it operates on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR), both for its own sub-processors and for the members of its network; a copy of the safeguards is available on request at privacy@nuvami.it. The detail is in Cookie Policy §8 (anti-abuse network: it receives the IP addresses which trigger a security rule, with the safeguards described there).

11. Your rights

Under Arts. 15–22 GDPR you have the right to:

• Access and portability (Arts. 15, 20): obtain a copy of your data by writing to privacy@nuvami.it: we answer within one month (Art. 12(3) GDPR). We are working on an export directly in the app; until it ships, the address above is the way, and it already works today.
• Erasure (Art. 17): delete your account and data from Family → Settings → Privacy and data → Delete my account and all data. Erasure is immediate and permanent (see §7). One exception we would rather tell you about: if you took out a subscription from an account that already existed, the purchase code attached to the transaction (§2.2) stays in the receipt held by Apple, which handles it as an independent controller. Today we have no way to remove it from a receipt already issued; we will do so as soon as that becomes technically possible, and for data Apple handles as a controller you can contact Apple directly. On our side that code no longer exists: it lived in a single place, deleted together with the account, and it does not appear in the register entry recording the erasure (§7), which keeps a different identifier. One window remains and we would rather tell you about it: for as long as dated backups exist (up to 3 months, §7) the link would still be technically reconstructible from those copies.
• Rectification (Art. 16): correct inaccurate data, directly in the app.
• Restriction and objection (Arts. 18, 21): object to product analytics in the settings; for the other processing based on legitimate interest (§3), by writing to privacy@nuvami.it. For direct marketing — the tips and news notifications (§2.5) — objection under Art. 21(2) is unconditional: if you object we stop, with no grounds to weigh.
• Withdraw consent (Art. 7): withdraw at any time your consent to personalised advertising (from Google's consent form in the app settings and from iOS tracking settings; withdrawing turns personalisation off; to see no advertising at all there is the subscription, or you may object to the non-personalised ad request by writing to privacy@nuvami.it), to tips and news notifications ("Tips and news" switch, §2.5) and to research (§8), as easily as you gave it.

To exercise these rights, use the in-app features or write to privacy@nuvami.it.

12. Children

Nuvami is intended for adults caring for a pet and is not directed to children. We do not knowingly collect data from children.

13. Complaints

If you believe the processing of your data infringes the GDPR, you may contact us (privacy@nuvami.it) and you have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of your country of residence.

14. Changes to this policy

We may update this policy. The current version is always published at this address, with the «last updated» date at the top. For significant changes we will notify you in the app.

This version is a translation; the original is the Italian version. How we process your data is the same whichever version you read. If you spot a discrepancy, write to privacy@nuvami.it and we will fix it.