NURVANNotice on the processing of personal data
This is a translation provided for convenience. In case of any difference, the Italian version prevails.
Last updated: · version
This notice explains which personal data the Nurvan app (Android app, iOS app and web version) processes, why it processes them, who it shares them with and what rights you have. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR").
1. Data controller
2. What data we process
Account data
- Name, email address and password (stored only in hashed form; we cannot read it).
- If you sign in with Google or with Apple: the identifier the provider gives us for your account, your email (including Apple's "relay" address, if you choose to hide it) and, for Apple, a token used to revoke the link when you delete your account.
- Registration date, last sign-in, subscribed plan, the consents you have given and when you gave them.
Training data
- Programs, sessions, sets, loads, repetitions, RIR/RPE, notes, calendar, statistics.
Health data (special categories, Art. 9 GDPR)
- Weight, body measurements and body composition, physique check photos.
- Nutrition, food diary, meal photos, supplements.
- Therapies, medications and blood tests that you choose to record.
- Sleep, resting heart rate, recovery status and check-in answers, if you enter them.
Nurvan does not read data from other apps (for example Health Connect or Apple Health): recovery values are estimates calculated from what you record yourself.
Coach-athlete relationship data
- If you use Nurvan with a coach: messages, check-ins, photos and documents you exchange with them, programs they assign to you, notes they write about you.
Content sent to the artificial intelligence features
- Only if you turn on the AI features: the text of your questions to Coach AI, the program files to import, photos of meals and labels, barcodes to be recognised, together with the context needed for the answer (for example your active program or your nutrition targets).
Technical data
- IP address and request data, processed by the servers for security and to limit abuse (for example sign-in attempts).
- Error logs, without the content of your data.
Nurvan does not use advertising, does not use third-party profiling or tracking tools and does not sell your data.
3. Why we process them and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, syncing data across your devices, providing you with the app's features. | Performance of the contract (Art. 6(1)(b) GDPR). |
| Processing the health data you record, in order to show them to you, calculate statistics and, if you have a coach, share them with them. | Explicit consent (Art. 9(2)(a) GDPR), which you give at registration and can withdraw by deleting your account. |
| Artificial intelligence features. | Consent (Arts. 6(1)(a) and 9(2)(a) GDPR), separate and withdrawable at any time from Settings › Privacy and data. |
| Security of the service, prevention of abuse and fraud, technical logs. | Legitimate interest of the controller (Art. 6(1)(f) GDPR). |
| Compliance with legal requirements (for example tax requirements, if you purchase a paid plan). | Legal obligation (Art. 6(1)(c) GDPR). |
4. If you use Nurvan with a coach
The coach who invites you sees the data the app shares with them in order to follow you: workouts, check-ins, nutrition and supplementation, the physique checks you send them and, unless you turn it off, therapy and lab tests.
Therapy and lab tests have their own controls: the first time you open either section the app explains how they are processed, and from the "Privacy" panel of each one you choose whether your coach sees them, whether Coach AI can use them, and you can delete them all, including the attached report files. If you hide them, the coach does not receive them and cannot edit them.
For their relationship with you, the coach processes these data as an independent controller: for their choices about how to use them you can contact them directly. Nurvan provides the tool and stores the data on behalf of the coach's account.
Athlete accounts created by a coach are deleted when the coach removes them or deletes their own account. You can at any time ask for your data to be erased, either from the coach or from the privacy contact indicated above.
5. Who we share data with
The data are processed by providers acting as data processors (Art. 28 GDPR), only to the extent needed for the service:
| Provider | What it does | Data |
|---|---|---|
| Render Services, Inc. | The app's servers and database (region: ). | All data synced with the account. |
| Cloudflare, Inc. | Network and protection of traffic to the servers. | Technical request data. |
| Google LLC / Google Ireland Ltd. | Sign in with Google; Gemini API for the AI features, only if you turn them on; fonts for the web version. | Google identity; content sent to the AI features; IP address. |
| Apple Inc. | Sign in with Apple. | Apple identity. |
| jsDelivr (Prospect One / Cloudflare, Fastly) | Downloads, only when you use them, the libraries that read photos and PDFs on your device (text recognition, iPhone HEIC photos, PDF pages without text). With on-device reading, photos and PDFs do not leave your phone; with advanced reading, which you choose for each document, the pages go to Google Gemini as in the other AI features. | IP address and technical request data. |
| Resend (Plus Five Five, Inc.) | Sending account emails: address confirmation, password recovery and password change. | Email address, single-use codes and links. |
The food search queries public databases (Open Food Facts, FatSecret, USDA FoodData Central), sending only the search text or the barcode, never data from your account.
The nutritional values of generic foods come from the CREA tables (Centro di ricerca Alimenti e Nutrizione, 2019 update) and from the Ciqual table (Anses. 2025. Table de composition nutritionnelle des aliments Ciqual, Licence Ouverte Etalab 2.0; names translated into Italian by Nurvan). When a meal plan is read, the names of foods that cannot be matched automatically may be sent, if you have turned on the AI features, to Google Gemini to choose the corresponding food among those in the databases: the values remain those of the databases.
We do not disclose the data to anyone else, except at the request of an authority in the cases provided for by law.
6. Transfers outside the European Union
Some providers (Google, Apple, Render, Cloudflare, Resend) are based in the United States and may process data outside the European Economic Area. The transfer takes place on the basis of the EU-US adequacy decision (EU-US Data Privacy Framework) for certified providers, or of the standard contractual clauses approved by the European Commission.
7. How long we keep the data
- Account, training and health data: for as long as the account exists. When you delete it, they are erased from the database immediately.
- Photos and documents shared with the coach: no more than 12 months from upload, or earlier if they are removed or the account is deleted.
- The hosting provider's database backups are overwritten according to their rotation cycle.
- Data sent to the AI features are not kept by Nurvan's servers beyond the time needed for the response; only what the app saves in your account remains (for example the Coach AI chat history or a meal recognised from a photo).
8. Data on your device
The app keeps a copy of your data on your phone or in your browser, so that it also works offline. On the Android app this copy is excluded from Google's automatic backups and from transfer to a new phone: on a new device your data come back when you sign in to your account. When you sign out, the data remain on the device until you delete them from the phone or browser settings.
The camera and microphone are used only when you turn them on yourself (to take a photo or for voice input); notifications are used for the reminders you set.
9. Your rights
At any time you can:
- access your data and receive a copy of them (in the app: Settings › Privacy and data › Export my data);
- correct them directly in the app;
- erase them by deleting your account (in the app: Settings › Privacy and data › Delete account; or by following the deletion procedure);
- withdraw your consent to the AI features (Settings › Privacy and data), without affecting the lawfulness of processing carried out before the withdrawal;
- request restriction of processing, object to processing based on legitimate interest, obtain data portability;
- lodge a complaint with the Garante per la protezione dei dati personali, the Italian supervisory authority (www.garanteprivacy.it), or with the authority of the country where you live.
To exercise your rights, write to . We reply within one month.
10. Minimum age
Nurvan is intended for people who are at least years old. At registration we ask you to confirm this. If we learn that an account belongs to a younger person, we delete it.
11. Nurvan is not a medical device
The app's estimates, statistics and suggestions (including those of the AI features) are meant to help organise training and nutrition and do not replace the advice of a doctor or healthcare professional. Do not use Nurvan for diagnosis or to decide on therapies.
12. Security
Communications with the servers are encrypted (HTTPS). Therapy and lab tests are not included in leaderboards, XP or shareable images, and reach Coach AI only if you turn it on or if you confirm sending the individual value. Passwords are stored hashed. Sessions can be closed remotely (for example by changing your password). Photos and documents shared with the coach are accessible only through signed, expiring links.
13. Changes
If we change this notice we update the date and the version at the top. When the changes concern consent, the app asks you for it again the first time you sign in.