Privacy Policy

1. Who We Are (Data Controller)

This Privacy Policy explains how GameOnTherapy LLC (“we,” “us,” or “our”) collects, uses, and protects information when you use our mobile applications. For the purposes of the EU General Data Protection Regulation (“GDPR”) and the UK GDPR, GameOnTherapy LLC is the data controller responsible for your personal data.

This Policy applies to the following applications: Evara, Nuvio, and Avola.

2. No Medical Advice Disclaimer

The App is intended for informational and self-tracking purposes only. It does not provide medical advice, diagnosis, or treatment. Always seek the advice of a qualified healthcare provider with any questions regarding a medical condition.

3. Information We Collect

We collect only the information necessary to provide and improve the App’s functionality. This may include:

• User-provided information (e.g. logged events, symptoms, habits, notes)
• Account information, where you create an account (e.g. email address, authentication identifiers)
• App usage data (e.g. interactions with features)
• Device information (e.g. device type, operating system, app version, and mobile advertising / device identifiers where applicable)

We do not collect precise location data or access GPS services.

4. Health-Related Data

The App allows users to voluntarily enter health-related information for personal tracking purposes. Under the GDPR / UK GDPR, health data is a “special category” of personal data and, under U.S. law, may constitute sensitive personal information. We process this data only on the basis of your explicit consent and for the purpose of providing the tracking features you request.

This data is stored securely and is not shared with third parties for advertising purposes. The App does not sell health data and does not use health data for targeted advertising.

5. How We Use Information

We use collected information to:

• Provide and operate the App
• Improve user experience and app performance
• Generate summaries or reports requested by the user
• Respond to support requests
• Comply with legal obligations and protect the security of the App

We do not use personal data for targeted advertising.

6. Legal Bases for Processing (EU / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases to process your personal data:

• Consent (Art. 6(1)(a) and, for health data, Art. 9(2)(a)) – for processing health-related information you voluntarily enter and, where required, for analytics.
• Performance of a contract (Art. 6(1)(b)) – to provide the App’s features and any account or subscription you request.
• Legitimate interests (Art. 6(1)(f)) – to maintain, secure, and improve the App, provided your rights do not override those interests.
• Legal obligation (Art. 6(1)(c)) – where processing is required to comply with applicable law.

Where processing is based on consent, you may withdraw your consent at any time; this does not affect the lawfulness of processing carried out before withdrawal.

7. Service Providers and Analytics (Third-Party Categories)

We may share limited data with trusted third-party service providers who process it on our behalf under contractual confidentiality and data-protection obligations. These providers fall into the following categories:

• Cloud hosting, authentication, and data storage providers (Supabase)
• Sign-in providers (Google Sign-In, Sign in with Apple), where you choose to use them
• Payment and subscription processing, handled by the applicable app store (Apple App Store or Google Play Store)
• Customer support and communication tools, where used

We do not currently integrate third-party advertising or cross-app tracking SDKs. If this changes, we will update this Policy and, where required, present the iOS App Tracking Transparency (ATT) prompt.

8. Data Sharing

We do not sell, rent, or trade personal information. Data may be shared only with the service providers described above as necessary to operate the App, or where required by law, legal process, or to protect the rights, safety, and security of users and the public.

9. International Data Transfers

We are based in the United States, and the data we collect is processed in the United States and potentially in other countries where our service providers operate. If you access the App from the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal data may be transferred outside your country of residence, including to the United States.

Where we transfer personal data out of the EEA or the UK, we implement appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), to ensure your data receives an adequate level of protection. You may request a copy of the relevant safeguards by contacting us at hello@gameontherapy.net.

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy. Retention periods by category are, in general:

• User-provided tracking and health data – retained until you delete it in the App or delete your account.
• Account information – retained for the life of the account and deleted within a reasonable period after account closure.
• Usage, device, and diagnostic data – retained for a limited period for analytics and security, then deleted or aggregated/anonymized.
• Records required for legal, tax, or dispute-resolution purposes – retained for the period required by applicable law.

Users may delete their data at any time through the App.

11. Your Privacy Rights

California residents (CCPA / CPRA). California residents have the right to request access to the personal information we collect, request deletion of personal information, request correction of inaccurate information, and opt out of the sale or sharing of personal information. We do not sell personal information. We will not discriminate against you for exercising these rights.

EEA / UK residents (GDPR / UK GDPR). If you are located in the EEA or the UK, you have the right to:

• Access the personal data we hold about you
• Request rectification of inaccurate or incomplete data
• Request erasure of your data (“right to be forgotten”)
• Request restriction of processing
• Object to processing based on legitimate interests
• Data portability – receive your data in a structured, commonly used, machine-readable format
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at hello@gameontherapy.net. We will respond within the timeframes required by applicable law. We may need to verify your identity before fulfilling a request.

12. Children’s Privacy

The App is not intended for use by children. The App is not directed to individuals under the age of 13 (or under the minimum age of digital consent in their country, which may be up to 16 in parts of the EEA). We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without appropriate consent, we will delete it.

13. Security

We implement reasonable administrative, technical, and physical safeguards to protect personal information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

14. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected users where and as required by applicable law.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted within the App and on this page, and the “Last updated” date above will be revised. Material changes will be communicated as required by law.

16. Contact Information

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at: