EvolYou

Last updated: June 16, 2026

This Privacy Policy describes how the EvolYou app (“App”, “we”) collects, uses, stores and protects your personal data, including health and fitness related data, in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018).

1. Who we are

EvolYou is an app for tracking weight, body measurements, healthy habits and for comparing progress with partners on a proportional basis. The App does not replace medical, nutritional or physical education guidance.

2. Data we collect

• Account: name, email and Google profile picture (when you use Google sign-in).
• Health and fitness: weight, body measurements (waist, hips, arms, etc.), habit logs (water, sleep, workouts and custom activities).
• Preferences: body goal, measurement units, notification settings, time zone.
• Technical: push notification token (FCM), device identifier, aggregated usage events (analytics).

2.1 Smartwatch data (Health Connect and Apple Health)

If you connect a watch or fitness band, EvolYou reads from Health Connect (Android) or Apple Health (iOS) only the following data: steps, active calories, total calories, distance, exercise sessions, sleep, resting heart rate and average heart rate.

• Read only. EvolYou never writes to or modifies data in Health Connect or Apple Health.
• Never used for advertising or any marketing purpose, and never sold or transferred to third parties.
• Never shared with your evolution partner.
• Used solely to show your activity inside the App and in your reports.
• Reading happens only while the App is open — there is no background syncing.
• You can revoke permission at any time in Health Connect itself (or in Settings > Health on iOS). That stops any further reading; to erase what was already stored, delete your account (item 7).

3. Purposes

• Providing the service: recording data, displaying charts and calculating proportional progress.
• Social functionality: sharing an authorized summary with a connected partner.
• Notifications: habit reminders and social interactions (nudges, encouragements).
• Security and improvement of the App.

4. Sharing

We do not sell your data. We share it only:

• With the progress partner you agreed to connect with, limited to what you have not marked as private.
• With Google/Firebase as infrastructure processors (hosting, authentication, database).
• When required by law or court order.

5. Legal bases (LGPD)

• Performance of a contract (terms of use).
• Consent for health data and for sharing with a partner.
• Legitimate interest for security and aggregated usage metrics.

6. Retention

We keep your data for as long as the account is active. After the account is deleted, we remove or anonymize the data within 30 days, unless there is a legal retention obligation.

7. Your rights

At any time, you may:

• Access and correct data in the App.
• Withdraw consent by ending connections or deleting your account.
• Request deletion — see Account deletion.
• Contact us: privacidade@evolucorpo.app

8. Security

We use encryption in transit (HTTPS/TLS), database access rules and server-side processing of sensitive writes (Cloud Functions).

9. Minors

The App is intended for users aged 16 or older.

10. Changes

We may update this policy. Relevant changes will be communicated in the App. The date of the current version appears at the top of this page.

11. Users in the European Economic Area (EEA) and the United Kingdom

This section supplements — and does not replace — the other sections of this Policy, and applies to users located in the European Economic Area (EEA) and the United Kingdom, under Regulation (EU) 2016/679 (GDPR) and the UK GDPR. The preceding sections, including the references to the LGPD, remain fully valid.

11.1 Controller and contact

The controller of the personal data processed in EvolYou is PAULO SERGIO DE CARVALHO — CNPJ 60.748.857/0001-16 — Rua Benedito Mendes Pereira, 81, Quilombo, Conceição dos Ouros/MG, CEP 37548-000, Brasil. Contact for privacy and data protection matters: privacidade@evolucorpo.app.

Representative in the European Union and the United Kingdom (Art. 27): Not applicable — the controller has no establishment in the European Union or the United Kingdom and has not appointed a representative under Art. 27. Data Protection Officer (DPO): No data protection officer has been formally appointed. The controller is a small-scale processing agent (micro-enterprise) and maintains a communication channel for data subjects at privacidade@evolucorpo.app.

11.2 Legal bases for processing (Art. 6)

• Performance of the contract (Art. 6(1)(b)): account data and App usage data necessary to provide the service you signed up for — registration, authentication, recording and displaying your information, synchronization across devices.
• Explicit consent (Art. 6(1)(a) together with Art. 9(2)(a)): data relating to health and physical fitness, and the sharing of your progress summary with a connected partner, caregiver or professional.
• Legitimate interest (Art. 6(1)(f)): service security, prevention and detection of fraud and abuse, and aggregated usage metrics for maintenance and improvement of the App.
• Compliance with a legal obligation (Art. 6(1)(c)): where the processing is required by law or by order of a competent authority.

Special categories of data (Art. 9). Weight, body measurements, body photos, medication records and other health and physical fitness data constitute a special category of personal data. The processing of such data relies exclusively on your explicit consent, given in the App, and you may withdraw it at any time.

11.3 Your rights (Arts. 15 to 22)

• Access (Art. 15): obtain confirmation of the processing and a copy of your data.
• Rectification (Art. 16): correct inaccurate or incomplete data — most of it is editable directly in the App.
• Erasure (Art. 17): delete your account and the associated data — see Account deletion.
• Restriction of processing (Art. 18): request the suspension of processing in the cases provided for by law.
• Portability (Art. 20): receive the data you provided to us in a structured, commonly used format.
• Objection (Art. 21): object to processing based on legitimate interest.
• Withdrawal of consent (Art. 7(3)): at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal — by ending connections, disabling health features or deleting the account.

To exercise any of these rights, use the App's options (Settings → Privacy) or write to privacidade@evolucorpo.app. We will respond within the period set out in Art. 12(3) of the GDPR (as a rule, one month, extendable in the cases permitted therein).

11.4 International data transfers (Chapter V)

EvolYou is operated in Brazil and uses the infrastructure of Google Firebase and Google Cloud (hosting, authentication, database, file storage and Cloud Functions). The artificial intelligence features — diet and workout suggestions, image analysis and audio transcription — use Google's Gemini API. Consequently, your personal data is transferred and processed outside the EEA and the United Kingdom, including in Brazil and in other countries where these providers operate.

These transfers rely on the Standard Contractual Clauses adopted by the European Commission, incorporated into the Google data processing terms that govern our use of these services. We do not claim any other transfer mechanism, certification or adequacy decision. [PREENCHER: reference to the current version of the Google data processing addendum accepted for this project and, if applicable, to the United Kingdom international transfer addendum]

11.5 Retention periods

• Account data (name, email, profile picture): for as long as the account is active.
• Health and physical fitness data (weight, measurements, body photos, habits, medications): for as long as the account is active or until you withdraw consent.
• After account deletion: removal or anonymization within 30 days, as described in section 6.
• Infrastructure backups: up to 30 days after deletion, in accordance with the provider's policy.
• Push notification token (FCM): removed upon account deletion or when notifications are disabled.
• Aggregated or anonymized usage records: may be kept indefinitely, as they do not allow you to be identified.
• Data subject to a legal retention obligation: for the period required by the applicable legislation.

11.6 Automated decisions and profiling (Art. 22)

The diet and workout suggestions and the analyses generated by artificial intelligence in the App are informational support. They do not produce legal effects concerning you nor similarly significantly affect you, they do not replace medical, nutritional or physical education guidance, and they may be ignored, edited or discarded at any time. We do not make decisions based solely on automated processing within the meaning of Art. 22 of the GDPR.

11.7 Complaint to the data protection authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the data protection authority of your country of residence, your place of work or the place of the alleged infringement — in the United Kingdom, the Information Commissioner's Office (ICO); in Brazil, the National Data Protection Authority (ANPD).

This is a courtesy translation; in case of any discrepancy, the Portuguese version prevails. View Portuguese version