Privacy Policy

1. Who we are & how to contact us

This Privacy Policy explains how SHPATIK STUDIO S.R.L. (“Owlova”, “we”, “us”), the data controller, collects and uses your personal data. You can reach us at privacy@owlova.com; our registered address is Alexandru Hâjdeu 86/1, Chișinău MD-2001, Republic of Moldova. For data-protection questions you may also contact dpo@owlova.com.

2. Scope

This policy applies to the Owlova mobile apps (iOS and Android), the Owlova web app, and owlova.com.

3. The data we collect

We collect the following categories of data. This includes health data — your medications, dosages, schedules, instructions/notes and adherence history — which we treat as special-category data (see legal basis below).

Owlova does not process payments. Premium is bought inside the app — on iOS through Apple’s In-App Purchase, on Android through Google Play Billing — and Apple or Google is the merchant of record: they take the payment and keep your payment method. We never see your card number, its last four digits, its expiry date, or your billing address. All we are told is which plan you hold, whether it is active or in a free trial, when the current period ends, and an identifier for the subscription itself.

4. How we use your data (purposes) & legal basis

We rely on the following legal bases under the GDPR. For health data, our lawful basis is your explicit consent (Art. 9(2)(a)), captured at onboarding; you can withdraw it at any time by deleting your account.

5. Notifications & lock-screen exposure

The machine-readable part of a push notification — what your phone hands to the app — never contains a medication name at all. It carries an identifier for the dose and where to open the app, and nothing else. What can be read off a locked screen is a separate question, and one setting governs it: “show medication names in notifications”, which is off by default. While it is off, nothing we send you names a medicine. Turn it on and the medication name and dose appear on your lock screen, where anyone who can see your screen may read them.

Owlova sends three kinds of notification, and the setting applies differently to each.

1. The dose reminder. At the time of a dose, and again 15 minutes later if you have not responded. With the setting off these read “Time for your 9:30 AM medication” and “Don't forget your 9:30 AM medication”. The time is the time you set for the dose, written the way your phone writes the time (12-hour or 24-hour), so the message says that a dose is due and when, and nothing about what the dose is. A dose you snoozed, or that was held until your quiet hours ended, keeps its original time: “Time for your 10:30 PM medication” can arrive at 7:00 AM. With the setting on, each names the medication and the dose instead (“Time for your [medication] [dose]” and “Don't forget: [medication] [dose]”). A reminder that would land inside your quiet hours is held until that window closes; the 15-minute nudge is then measured from when the reminder actually went out, so a dose reminded shortly before your quiet hours begin can be followed up just inside them.

2. The missed-dose correction. One hour after a dose you never confirmed, we mark it missed and tell you so, so that you can put it right if you did take it. With the setting off it reads “Marked as missed: your 9:30 AM medication. Tap if you took it”; with it on it names the medication and the dose in the same sentence (“Marked as missed: [medication] [dose]. Tap if you took it”). This is the same exposure as a reminder, not a lesser one. It is also sent inside your quiet hours if that is when the hour is up — we chose to tell you a dose was marked missed at the wrong hour rather than stay silent about it, or hold it until morning, by which time the app can no longer undo the mark for you.

3. The daily summary. Off unless you switch it on separately, at most one message a day, in the evening (or just before your quiet hours if they start earlier), and only on a day you actually missed something. It carries a count and nothing else — “2 doses were missed today” — and it never names a medication, on either setting of the option above, because a summary spans your whole day rather than one dose. We do say the count out loud here rather than calling the message contentless: a line like that on a lock screen still tells a person reading over your shoulder that you take medication and had a difficult day with it. That is the trade you are making when you turn it on. Unlike the correction above, this one is never sent during your quiet hours; if there is no moment left in your day outside them, that day’s summary is dropped rather than saved up and added to the next one.

Text messages are not part of this. We use them only to send a one-time sign-in code, which never contains anything about your medication (see §7).

6. Legal bases summarized (GDPR)

We process your data under: consent (health data; usage analytics, only if you say yes), performance of a contract (delivering the service you signed up for), legitimate interests (security, diagnostics), and legal obligation (tax records, breach notification), mapped per purpose above.

7. Sharing & disclosure / Subprocessors

We do not sell your personal data. We share data with the service providers (subprocessors) below, each acting under a data-processing agreement (DPA). DigitalOcean and PostHog are configured to the EU region, and that is where your account and health data are held. Sentry — which collects crash and error reports so we can fix faults — is the one we deliberately run in the United States instead, under Standard Contractual Clauses. It receives technical diagnostics labelled with an internal account id and never any health data: no medication name, dosage, schedule or dose record is ever sent to it. Apple and Google are the exception to the “subprocessor” framing: for a purchase made in the app they act as merchants of record under their own privacy policies — they are not processing that payment on our behalf — and they are listed here because they are still recipients of data about you.

8. Health Breach Notification (FTC HBNR)

Owlova is a covered “health app” under the FTC’s Health Breach Notification Rule. In the event of a breach of unsecured health data, we will notify affected individuals, the FTC, and — for large breaches — the media, within the timelines the Rule requires.

9. International transfers

Some data may be processed in the United States. For users in the EU/EEA and UK we rely on Standard Contractual Clauses (and the UK IDTA / adequacy where available); the transfer mechanism per provider is named in the subprocessor table above.

10. Data retention

We keep each category of data only as long as needed. In particular, your reminder/dose history is retained for 13 months, then purged; it is also deleted or anonymized earlier when you delete your account.

11. Security

We protect your data with encryption in transit (TLS) and at rest (DigitalOcean Managed Postgres, EU/FRA1), access controls, and app-layer authorization. Medication data is never included in push notification payloads by default.

12. Your rights (GDPR / UK)

You have the right to:

• access, rectify, erase, restrict, and port your data;
• object to processing and withdraw consent at any time;
• lodge a complaint with a supervisory authority.

You can exercise these in-app via Settings → Download my data (GET /v1/users/me/export) and Delete account (DELETE /v1/users/me), or by emailing privacy@owlova.com. Your statutory data export is always free.

You do not need to be signed in to have your account erased: see how to delete your account for exactly what deletion removes, what we are required to keep, and how to reach us if you have lost access.

13. Your rights (California — CCPA/CPRA)

California residents have the right to know, delete, and correct their personal information, to opt out of its sale or sharing, to limit the use of sensitive personal information, and to non-discrimination for exercising these rights. Your health/medical data is “sensitive personal information.” We do not sell or share your personal information. To make a request, contact privacy@owlova.com.

14. Children’s privacy

Owlova is not directed to children under 16. We do not knowingly collect data from anyone under 16 and will delete it on discovery.

15. Cookies & analytics

We use PostHog (usage analytics) and Sentry (error tracking). Usage analytics run only if you say yes: the website shows a banner on your first visit, and the app asks while you set up. They record the screens you view, the buttons you tap and your purchases, linked to your account ID — and never medication names, types, amounts, schedules, notes or doses, or any record of when you take, skip or miss a dose. You can change your answer at any time in Settings.

16. Changes to this policy

We will post changes here and update the effective date; material changes re-prompt acceptance in the app.

17. Contact & complaints

Email privacy@owlova.com. EU/EEA users may complain to their local supervisory authority; California users may contact the Attorney General. Governing law for any related terms is the Republic of Moldova.

18. Effective date / version

Version 2026-10-23 · effective 2026-10-23.