Ovia Health Apps Privacy Policy

Introduction and scope

This Ovia Health Apps Privacy Policy (“Policy”) describes how Ovuline, Inc., doing business as Ovia Health (“Ovia”) collects, uses and shares personal data collected through the Ovia apps, health coaching, surveys, and related social media and marketing activities (the “Services”). Ovia Health is a subsidiary of Labcorp, a global life-sciences leader.

Some parts of this Policy only apply to Ovia’s free consumer version of the Services, while others only apply to the enhanced paid versions provided as a benefit by employers, health plans and health care providers. In this Policy, we refer to these different versions as the “Consumer” and “Ovia+” versions of the Services. To view the full version of this Policy, click “Full Privacy Policy” above; the “Notice of Collection” is a shorter version required for California law.

This Policy does not apply to personal data collected outside the scope of the Services. For Ovia’s non-app Privacy Policy, which covers personal data collected by Ovia from business contacts or through our corporate website, please see our Non-App Privacy Policy.

“Personal data” means information about you that identifies you, like a name, telephone number or other bit of information that is used to tell us who you are. Personal data includes “direct identifiers” such as your email address and also “indirect identifiers” that could be used to identify you such as the IP address and the Advertising ID of your mobile device.

Personal Data We Collect

We collect the following categories of personal data in connection with our Services:

Category	Examples of Data We Collect In this Category
Identifiers	Name, email address, street address, postal address, mobile phone number Device identifiers such as IP address, AdID, IDFA For Ovia+ members, employer ID, employee ID
General personal information including health information	Date of birth, date of last period, due date, and other fertility, pregnancy, health, sex life and life circumstances information you input into the apps or discuss as part of health coaching services In the Parenting app, health and milestone information for your child For Ovia+ members, health insurance information
Legally protected classifications such as race, gender, disability or pregnancy status	Race, gender, gender identity, age, ethnic group, nationality, sexual orientation, pregnancy status, disability, medical condition
Biometric information	Sleep, health and exercise data that you sync from a wearable device, Apple Health or Google Health Connect to your Ovia account. Ovia does not collect biometric identifiers such as fingerprints or voiceprints.
Internet and app activity information	App usage, browsing history, email opens and views Device type, operating system, other device parameters
Geolocation	Approximate location by country, state, city, zipcode and regional area
Audio and visual information	Photos and videos that you upload to your Ovia account
Professional and employment related	Employment status, name of employer (for Ovia+ membership)
Inferences	Pregnancy trimester, fertile window, health issues that may be relevant to you
Sensitive information	racial or ethnic origin, health information, sex life and sexual orientation information

Where Do We Get the Information We Collect?

Categories of Sources	Examples of Our Use of These Sources
From direct input into our apps and Services	We collect the data you input into Ovia apps and Services and store it in our cloud computing environment
From wearable devices, Apple Health and Google Health Connect	If you sync a device, Apple Health or Google Health Connect with Ovia, we collect the data you choose to share Ovia’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
From our coaching services and communications	We collect your communications with our care advocates, health coaches and in our Community feature
From our Ovia+ customers – employers, employer health plans, health insurers, providers	To verify your eligibility for Ovia+ services, we receive identity information (such as name, date of birth, employee ID numbers) from your organization
From your mobile device or computer and through tracking technologies	We automatically collect from your device information such as IP address and technical identifiers We also use cookies, tags, pixels and other tracking technologies to collect information about your interaction with content and the Services generally
From surveys	We collect data you submit to us through surveys
From friends referrals and lists purchases	We may receive email addresses and contact information from referrals, co-promotions and list purchases

Purpose of Collection and Use of Personal Data

We use your personal data to:

Provide the Services to you
Understand how you use the Services, including what content and ads you view
Personalize the Services by showing you content relevant to your health, interests and fertility, pregnancy and parenting journey – for example, if you provide us with personal data indicating you have a certain health condition, we may provide you with editorial content relevant to that condition
Send you personalized emails showing relevant data points derived from the personal data you input to our Services, unless you opt-out of such communications in the Settings page of the app. Despite precautions, email communications may be intercepted; you should opt-out if you do not wish to accept this risk.
Send you marketing communications for Ovia and its affiliates, subject to your opt-in consent when required by law
Provide support and troubleshooting
Provide you with health coaching if you are an Ovia+ member
Send you email communications about the Services
Solicit your participation in surveys and run surveys
Provide security for the Services and obtain analytics about app performance
Market, develop and improve Ovia’s and its affiliates’ products and services
Conduct clinical and scientific research, subject to your informed consent where required by law
Create deidentified data and aggregated data and statistics, as described further here
Comply with law, for security management and investigation, in connection with litigation, or to protect the rights or property of Ovia or third parties

Lawful Processing. Our processing of your personal data is based on one or more of the following:

The consent you provide to us at the point of collection of your personal information;
The performance of the contract we have with you;
The compliance of a legal obligation to which we are subject;
The performance of scientific research, preparation of statistics or public health activities;
The legitimate interests of Ovia, you or a third party, where not overridden by your interests, fundamental rights or freedoms. Ovia’s legitimate interests include the lawful conduct of its business.

The table below describes the purposes for our use and collection by category.

Category	Purpose of Collection and Use
Identifiers	All purposes listed under “Purpose of Collection and Use of Personal Data” above (“Comprehensive Use”), other than creation of deidentified data
General personal information including health information	Comprehensive Use, other than uses not permitted by law.
Legally protected classifications such as race, gender, disability or pregnancy status	Comprehensive Use, other than uses not permitted by law
Biometric information	Comprehensive Use
Internet and app activity information	Comprehensive Use
Geolocation	Comprehensive Use
Audio and visual information	Store and display the photos and videos you upload to your Ovia account
Professional and employment related	To provide you with Ovia+ services
Inferences	Comprehensive Use, other than uses not permitted by law. Our primary use of inferences is to provide you with content relevant to your health.
Sensitive information	Comprehensive Use, other than uses not permitted by law.

When We Share Personal Information, What Categories of Recipients Do We Share With?

Categories of Recipients	Examples of Recipients We Share With
Service Providers and Contractors	Ovia’s data is processed and stored by service providers and contractors working on Ovia’s behalf, including our cloud services provider Amazon Web Services, Helpshift (support services platform), Salesforce.com (coaching platform), Alchemer (survey platform) and Zoom Video Communications (coaching communications).
Ovia+ Customers and their Business Associates and Health Benefit Providers	If you are an Ovia+ user, we may share data with your health insurer, health plan, employer, or their business associates and benefits management providers, as described below under the heading “Ovia+ Data Sharing”, provided that we share information with your employer only for specific uses and only if you expressly consent.
From your other devices	If you opt-in to share your Ovia data with Apple Health, Google Health Connect or your other devices, we share the information you select to share.
From surveys	We collect data you submit to us through surveys
People You Invite	The Ovia apps may allow you to invite others, such as your partner, to share your Ovia journey. If you invite someone, they will be able to see all of your personal data in the Ovia apps. The people you invite are also able to add others to your account. If you add personal data or other content to an Ovia account, everyone who is following that Ovia account will see it.
You and Your Requested Followers	If you enroll in Ovia, Ovia may send you regular email updates relevant to your Ovia journey. These emails are subject to opt-in consent where required by law. If you include a profile image or name for yourself or a child in your care, this profile image and name will be shared in emails to you and everyone who has been invited to follow your account. The name and image will be visible even before the invitation is accepted. If you do not want the image or name to be shared, you should not enter a profile picture or a profile name.
Affiliates and Successors	We may share data with our parent company Labcorp and with companies under common control, and with any successors in the event of merger, acquisition, asset sale, or similar transaction.
Government Authorities and Recipients of Compelled Disclosures	Ovia may provide personal data to courts, law enforcement, and governmental authorities and other third parties if required by law, subpoena, directive from a regulatory authority or as otherwise necessary to comply with legal requirements or to protect the rights or property of Ovia or third parties. Please also see How Does Ovia Respond to Data Requests

Ovia+ Data Sharing

If you receive the premium “Ovia+” version of Ovia through your health insurer, employer or employer health plan, your Ovia+ services include data sharing with your insurer, employer health plan, employer, or vendors working on their behalf in accordance with HIPAA and other privacy laws.

Data sharing does not occur for all Ovia+ clients. If you would like definitive information on the data sharing for your account, please contact support@oviahealth.com. Our Ovia+ data sharing policy is as follows:

If you receive Ovia as a benefit from your health insurer or health care provider, Ovia is part of your care package and we share your personal data with your health insurer or provider, or their business associates, under HIPAA, for care and benefits management.
If you receive Ovia as a benefit from your employer or your employer health plan:
- we do not share your health data with your employer unless you expressly consent for a specific purpose; this may occur, for example, if your employer offers you access to an in-house care management team. If this occurs, we limit the sharing as necessary for the specific purpose to which you have given consent. To understand more about the consent we request, see Why do we ask for this?
- However, we may share personal data with your employer health plan and their business associates (including your health insurer), and with employee benefits management vendors, consistent with HIPAA or other privacy laws.
When we share your data with your health insurer, nurse care managers from your health plan may also have access to your personal data and may contact you as a result for care management purposes.
If you seek to register for Ovia+ premium services provided by a health plan or employer, we may share limited identity information (such as name and date of birth) with the health plan or employer to confirm your eligibility for Ovia+ benefits.
When we share health data for care and benefits management as described in this section, we share a summary snapshot of your health data. We do not share any information you have recorded in the Ovia apps about sexual activity, any answers you have given to MyQ questions, or any submissions you make to our Community feature.

What Categories of Personal Information Do We Sell or Share for Advertising?

As of June 2025, Ovia no longer shows advertising to our Consumer users and does not sell or share any personal data for advertising. Please see the table at the end of this document for the categories of personal data sold or shared for advertising before we terminated our advertising business.

No Selling or Sharing for Advertising of Personal Data of Consumers Under 16

To its knowledge, Ovia does not sell or share any personal data of Ovia users under 16. Ovia no longer shows advertising.

Categories of Personal Information Disclosed for Business Purposes

Category	Categories of Recipients	Business Purpose for Sharing
Identifiers	Cloud computing providers, data analytics providers, vendors who provide email, support, admin, marketing, survey and scheduling systems.	For internal operations (hosting, support, admin, marketing, analytics).
General personal information including health information	Cloud computing providers, data analytics providers, vendors who provide email, support, admin, marketing, survey and scheduling systems. Ovia+ customers and their vendors as described under the “Ovia+ Data Sharing” heading above.	For internal operations (hosting, support, admin, marketing, analytics). To provide our digital health solutions to Ovia+ customers.
Legally protected classifications including race, gender, pregnancy status	Cloud computing providers, data analytics providers, and vendors who provide email, support, admin, marketing, survey and scheduling systems. Ovia+ customers and their vendors as described under the “Ovia+ Data Sharing” heading above.	For internal operations (hosting, support, admin, marketing, analytics). To provide our digital health solutions to Ovia+ customers.
Biometric information	Cloud computing providers, and vendors who provide email, support, admin, marketing, survey and scheduling systems. If you elect to share your Ovia data with a device provider (such as Apple or Google), we share the data you elect to share. Ovia+ customers and their vendors as described under the “Ovia+ Data Sharing” heading above.	For internal operations (hosting, support, admin, marketing, analytics) and to provide our digital health solutions to Ovia+ customers. If you elect to share your Ovia data with a device provider (such as Apple or Google), to provide that sharing service to you.
Internet and app activity information	Cloud computing providers, data analytics providers, and vendors who provide email, support, admin, marketing, survey and scheduling systems. Ovia+ customers and their vendors as described under the “Ovia+ Data Sharing” heading above.	For internal operations (hosting, support, admin, marketing, analytics), and to provide our digital health solutions to Ovia+ customers.
Geolocation	Cloud computing providers, data analytics providers, and vendors who provide email, support, admin, marketing, survey and scheduling systems.	For internal operations (hosting, support, admin, marketing, analytics).
Audio and visual information	Cloud computing providers.	For internal operations (hosting and support).
Professional and employment related	Cloud computing providers, data analytics providers, and vendors who provide email, support, admin, marketing, survey and scheduling systems.	For internal operations (hosting, support, admin, marketing, analytics).
Inferences	Cloud computing providers, data analytics providers, and vendors who provide email, support, admin, marketing, survey and scheduling systems. Ovia+ customers and their vendors as described under the “Ovia+ Data Sharing” heading above.	For internal operations (hosting, support, admin, marketing, analytics), and to provide our digital health solutions to Ovia+ customers.
Sensitive information	Cloud computing providers, data analytics providers, and vendors who provide email, support, admin, marketing, survey and scheduling systems. Ovia+ customers and their vendors as described under the “Ovia+ Data Sharing” heading above.	For internal operations (hosting, support, admin, marketing, analytics). To provide our digital health solutions to Ovia+ customers.

Prior to the termination of our advertising business in June 2025, we shared identifiers, internet and app activity information and inferred purchase interests with our ad sales platform, advertising networks, advertising platforms or advertising technology providers to sell, administer, serve and purchase ads.

Ovia may also share personal data for business purposes in all of the above categories, as described in the table “When We Share Personal Information, What Categories of Recipients Do We Share With?”, with the following categories listed in that table: People You Invite, You and Your Requested Followers, Affiliates and Successors, and Government Authorities and Recipients of Compelled Disclosures.

Third Parties Receiving Personal Information for Their Own Business Purposes

Ovia discloses personal data to processors who act on Ovia’s behalf (our principal processors are listed on our Subprocessors Page). Our analytics vendor Appsflyer provides its services to Ovia as a processor, but may act as a controller when using personal data for its internal security, error correction and compliance purposes.

Data Security

Ovia protects personal data with security measures that are consistent with industry standards, including background checks on all employees and data encryption in transit and at rest. Ovia’s Ovia+ product has achieved certification to the HITRUST Common Security Framework. Our principal database is hosted by Amazon Web Services, which maintains multiple security certifications. We will notify you of security incidents as required by law, and you agree that, when permitted by law, such notices may be sent by email to the email address associated with your Ovia account.

Data Retention

If you are a Consumer user, we store your data (all categories) for the period that your account is active and then for 7 years after that. After this period, we automatically delete your data.

If you are an Ovia+ user, we store your data (all categories) during the period that you are receiving Ovia+ benefits. Ovia is generally required to delete your data after your Ovia+ benefits end. We will notify you before your data is deleted and, where possible, offer you the opportunity to convert your account to a Consumer account and retain your data.

While these are our standard retention periods, you can delete your data at any time as described in the next section.

What Are Your Choices?

Within the Ovia Apps

You can use self-service controls within the Ovia apps to exercise your data subject rights to:

Correct your data:
- Go to the “More” page of your Ovia app to the “Account” section to modify your profile and health information
Opt-out of marketing emails and push-notifications
- Go to the “More” page of your Ovia app, then choose “Settings”, to edit email subscriptions and opt out of email and push notifications
- You can also opt out of marketing emails by using the unsubscribe link in the emails
Delete your data and account, subject to certain exceptions
- Go to “More” then “Settings” and choose “reset or delete my account”, and then “delete my account”
Obtain a copy of your data
- Go to “More” then “Settings” and then “export my data”
Obtain a summary statement of Ovia’s data processing
- Go to “More” then “Settings” and choose “how is my data used?”
Withdraw your consent to Ovia’s data processing by deleting your data
- Go to “More” then “Settings” and choose “reset or delete my account”, and then “delete my account”
For non-US users, manage your cookies
- Go to “More”, “Settings”, then “Manage My Privacy Settings”

Opting Out Through Browser-Based Global Privacy Controls

Ovia does not receive a “do not sell” Global Privacy Control (GPC) signal when you are using Ovia’s mobile applications or viewing content through in-app webviews. Ovia respects “do not sell” GPC signals that we receive on the Ovia Health corporate website at www.oviahealth.com, which is governed by Ovia’s Non-App Privacy Policy.

Contacting Our Helpdesk, and Use of Authorized Agents

You may email Ovia at support@oviahealth.com to exercise any of the rights listed above and any other data subject rights provided by law. Any authorized agents seeking to exercise data subject rights on behalf of any Ovia users should contact support@oviahealth.com with their request. Ovia may require you to verify your identity by entering your username and password in order to exercise data subject rights.

You have the right not to be discriminated against for exercising your privacy rights. Contact our helpdesk if you are concerned that this has happened to you.

Appeal Rights

If your request to exercise any of your rights is refused, you may send your notice of appeal by email to legal@oviahealth.com, for review by Ovia’s Legal Department. We will resolve your appeal within 30 days of the date of receipt of your email.

Exceptions to Deletion

Even if you exercise your rights described above, Ovia may retain personal data to maintain proper business records, to comply with and as permitted by law, for security management and investigation, in connection with litigation, or to protect the rights or property of Ovia or third parties. Please see also How Does Ovia Respond to Data Requests.

Other Relevant Information

If you opt-out of marketing emails and push notifications, you will still receive account management notices. To stop all emails and push notifications, you must delete your account and data. If we delete your data, we will not delete the posts or comments you have shared publicly on Ovia’s social media, community or chat features. If you have consented to participate in a research study and subsequently request deletion of your data, we may delay deletion until completion of the study. Even if you exercise your rights described above, Ovia may retain personal data to maintain proper business records, to comply with and as permitted by law, for security management and investigation, in connection with litigation, or to protect the rights or property of Ovia or third parties. Please see also How Does Ovia Respond to Data Requests.

How to Contact Ovia with Comments or Complaints?

To contact Ovia to exercise your privacy choices, please see “What Are Your Choices?” above.

Ovia has designated a Data Protection Officer. To contact our Data Protection Officer or for questions or complaints about Ovia’s processing of personal data, contact us at:

Data Protection Officer
Ovuline, Inc., dba Ovia Health
3400 Computer Drive
Westborough, MA 01581
legal@oviahealth.com

Data subjects located in the EEA or UK may contact the Data Protection Officer at the address above or Ovia’s EU and UK representative at dpo@labcorp.com.

You may also have the legal right to lodge a complaint about Ovia’s data processing with your local consumer protection or data protection authority. If you are a resident of Washington state in the US, the Washington Attorney-General’s complaint website is here.

Additional Information

Third Party Websites or Apps: Some links within the Services may interface with or take you to websites or apps that are operated by other companies. Ovia is not responsible for the privacy practices of others. You should review the privacy policies of those sites and apps.

US Location: The data we collect is transferred to servers located in the US of our cloud computing provider, Amazon Web Services (AWS); some personal data may be transferred to other US-based vendors who provide services to Ovia, including the principal vendors listed here. If you are resident outside the US, your data may as a result become subject to US jurisdiction which may provide you with weaker data protection safeguards and rights than you would enjoy in your home jurisdiction. By accepting this Privacy Policy, using the Services or providing us with your personal data you acknowledge and consent to your personal data being transferred and/or processed as described in this Policy.

Children: The Services are not available to children under 13 or who otherwise require parental consent under applicable law to use the Services or provide personal information to Ovia. Ovia does not collect personal data from children under 13. Parents and guardians may include personal data about their baby or child in their Ovia account; the parent or guardian is responsible for ensuring they have the legal right to do so.

Deidentified Data and Aggregated Data: Ovia may use personal data to create deidentified data for research and development purposes. Deidentified data is not personal data as it is no longer linked or linkable to you. If we create a deidentified dataset we maintain it as such and will not re-identify it. We may provide deidentified data to our research partners, such as universities and medical research institutions for research, and to other businesses who have engaged us to provide research services on deidentified or aggregated data. Ovia may disclose or sell deidentified data derived from patient information (as defined by the California Consumer Privacy Act); if so, such patient information is deidentified in accordance with HIPAA safe harbor or expert determination deidentification requirements. We may use personal data to create aggregated analytic data and statistics, which we may use for Ovia’s internal purposes or share with third parties. Ovia may receive compensation for sharing deidentified or aggregate data.

Social Media: Some Ovia content may appear on Ovia’s social media channels. Ovia does not collect personal data through those channels, and the respective privacy policies of the social media provider will apply to your usage of those channels.

Sale or Sharing of Personal Information Before the Termination of Ovia’s Advertising Business

Before the termination of Ovia’s advertising business in June 2025, within the last 12 months Ovia sold or shared personal data for advertising as described in the table below.

Category of Personal Information	Categories of Recipients	Purpose of Sale or Ad Sharing
Identifiers	If you separately opted-in to share data as part of a giveaway or promotion, we shared the data you agreed to share, which may have included name, email address, and physical address, with the advertisers and sponsors of that promotion. With advertising networks, advertising platforms, advertising technology providers and advertisers, we shared online identifiers and IP addresses.	For marketing and promotion. To sell, administer, serve and purchase ads.
General personal information including health information	If you separately opted-in to share data as part of a giveaway or promotion, we shared the data you agreed to share, which may have included name, email address, physical address and month/year due, with the advertisers and sponsors of that promotion.	For marketing and promotion. To sell, administer, serve and purchase ads.
Legally protected classifications such as race, gender, disability or pregnancy status	If you separately opted-in to share as part of a giveaway or promotion, we shared the data you agreed to share, which may have included include month/year due, with the advertisers and sponsors of that promotion.	For marketing and promotion. To sell, administer, serve and purchase ads.
Purchase histories or interests	If you separately opted-in to share a purchase interest as part of a giveaway or promotion, we shared that information with the relevant advertisers or sponsors.	For marketing and promotion. To sell, administer, serve and purchase ads.
Internet and app activity information	With advertising networks, advertising platforms, analytics providers, advertising technology providers and advertisers, we shared online identifiers, IP addresses and app and ad engagement and activity information.	For marketing and promotion. To sell, administer, serve and purchase ads.
Geolocation	Not sold or shared for advertising.	Not applicable
Professional and employment related	Not sold or shared for advertising.	Not applicable
Inferences	If you separately opted-in to share data as part of a giveaway or promotion, we shared your pregnancy month/year due with advertisers and sponsors. Unless you separately opted in to share specific data as part of a promotion, we did not share any inferences with advertisers or sponsors.	For marketing and promotion. To sell, administer, serve and purchase ads.
Sensitive information	If you separately opted-in to share data as part of a giveaway or promotion, we shared your pregnancy month/year due with advertisers and sponsors. For Florida residents, because of this sharing, we were required to state: “NOTICE: This website may sell your sensitive personal data.” Unless you separately opted in to share specific data as part of a promotion, we did not share any health data you tracked in Ovia apps with advertisers or sponsors.	For marketing and promotion. To sell, administer, serve and purchase ads.

Changes to this Policy

Ovia may modify this Policy from time to time by posting an updated version of the Policy. When we make material changes this Policy, we will notify users by email or in-app notification.

Last updated: June 23, 2025

The principal changes in this update were:

Modifying the policy to reflect Ovia’s termination of its advertising business
Removing references to the Ovia Wallet program