Consumer Health Data Privacy Policy

1. Data Controller

Eivolv AB (org. nr 559459-6560), c/o Benjamin Raki, Fredriksdalsgatan 7 C, 412 62 Gothenburg, Sweden. Contact: support@inworkcenter.com.

2. Consumer Health Data We Collect

Under applicable health data privacy laws, the following categories of data collected by Inwork may qualify as "consumer health data":

• Mental wellness data: Journal entries, mood ratings, self-assessments, and reflections related to emotional and psychological wellbeing
• Habit and behavioral data: Habits tracked (including health-related habits such as exercise, sleep, meditation), completion records, and streaks
• Meditation and mindfulness data: Meditation session frequency, duration, and type preferences
• AI coaching interactions: Conversations with the AI Coach about wellness topics, goals, and personal development

3. Purposes of Collection

We collect consumer health data for the following specific purposes:

• Providing the core Inwork service (habit tracking, journaling, meditation, AI coaching)
• Personalizing your wellness experience based on your stated goals
• Generating AI-powered insights, suggestions, and coaching responses
• Displaying your progress, streaks, and personal statistics to you
• Ensuring service quality and debugging technical issues

4. How We Do NOT Use Your Health Data

We make the following binding commitments:

• We do NOT sell consumer health data to any third party, for any reason, at any price — and we never have
• We do NOT share consumer health data with advertising networks, data brokers, or ad-tech companies
• We do NOT use consumer health data for targeted advertising
• We do NOT share consumer health data with employers, insurance companies, or any entity that could use it to make decisions about you
• We do NOT use your data to train third-party AI models
• We do NOT geofence or track your location in relation to healthcare facilities

5. Third Parties Who Receive Health Data

Consumer health data is shared only with the following categories of service providers, solely to operate the Service:

• Database provider (Supabase): Stores your data with encryption and row-level security. Supabase does not access or use your data independently
• AI provider (OpenAI): Receives relevant context to generate AI responses and semantic memory embeddings. Data is processed under API terms that prohibit use for model training. The provider may keep it for up to 30 days to monitor for abuse
• Audio provider (ElevenLabs): Receives text for meditation audio generation and voice input for transcription. Audio is processed transiently

All service providers operate under data processing agreements that restrict their use of your data to providing services to Inwork.

6. Your Rights

Regardless of your location, you have the following rights regarding your consumer health data:

• Right to know: Request confirmation of whether we collect or share your consumer health data, and obtain a list of all third parties with whom it has been shared
• Right to access: Request a copy of your consumer health data in a portable format
• Right to delete: Request deletion of your consumer health data. We will delete your data and direct our service providers to do the same within 30 days
• Right to withdraw consent: Withdraw consent for collection or sharing of your consumer health data at any time. You may do so by deleting your account or contacting us. Withdrawal does not affect the lawfulness of prior processing

To exercise any of these rights, contact support@inworkcenter.com. We will respond within 30 days. We will not discriminate against you for exercising these rights.

7. Consent

By creating an account and accepting the Terms of Service and Privacy Policy, you provide your consent for Inwork to collect and process your consumer health data for the purposes described in Section 3 above and to share it with the third parties described in Section 5 above.

This consent is separate from and in addition to any other consents you provide. You may withdraw this consent at any time as described in Section 6.

8. Data Security

Consumer health data is protected by encryption in transit (TLS/HTTPS) and at rest, row-level security policies that restrict access to authorized users only, strict access controls that prevent unauthorized staff access, and regular security monitoring. For full details, see Section 17 of our Privacy Policy.

9. Changes to This Policy

We will notify you at least 30 days before making material changes to this Consumer Health Data Privacy Policy. Changes will be communicated via email or in-app notification.

10. Contact

• Company: Eivolv AB (org. nr 559459-6560)
• Address: c/o Benjamin Raki, Fredriksdalsgatan 7 C, 412 62 Gothenburg, Sweden
• Email: support@inworkcenter.com