Privacy policy

Last updated: October 2026

Who is responsible

The data controller is Noviera, Metiuslaan 83, 5612 NR Eindhoven, Netherlands (KvK 42170054). Contact for any privacy question or request: Wellora_@outlook.com.

What we collect

Your email and name; the profile details you enter (goals, age, activity level, dietary preferences, targets); and what you log: sleep, meals, activities, habits, AI plans and coach conversations. For Wellora Pro, our payment partner processes your card details — we never see or store them. We only keep your subscription status and renewal date.

How we use it

Only to run Wellora: to show your progress and to personalize AI coaching and plans. Relevant parts of your data are sent to our AI provider to generate responses and are not used to advertise to you. We don't sell your data, and we don't use it for automated decisions with legal or similarly significant effects.

Who can see it

Only you. Every record is locked to your account, and other users cannot read or change it. We work with a small number of processors who handle data on our behalf under data-processing agreements: our cloud hosting and database provider, our AI provider (to generate coaching responses), and our payment partner (to process subscriptions). Where data is processed outside the EU/EEA, this happens under appropriate safeguards such as EU Standard Contractual Clauses.

Legal basis

We process your data to provide the service you signed up for (performance of a contract) and, for health-related wellness data you choose to log, on the basis of your explicit consent, which you can withdraw at any time by deleting the data or your account. Billing records are processed to meet legal tax obligations.

Your rights

Under the GDPR you can access, correct, export or delete your data, restrict or object to processing, and withdraw consent. You can export everything or delete your account yourself at any time from your profile page — no need to contact us. For anything else, email Wellora_@outlook.com; we respond within 30 days. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

Your data is encrypted in transit and at rest, stored in access-controlled systems, and every record is isolated per account. Access is limited to what is needed to operate the service.

Retention

We keep your data while your account exists. When you delete your account, your wellness data is deleted immediately and irreversibly. Billing records are kept as long as Dutch tax law requires (7 years).