LifeOS for the human body. Track your wellness, get personalized AI insights, and reach your health goals with recommendations built around your own data.
Copyright © 2026 Zuvo. All rights reserved.
Zuvo holds health data, which is about as personal as data gets. This page describes what we have actually built to protect it — and what we have not built yet.
Last updated: October 5, 2026
In transit. Everything between the app and our servers travels over TLS 1.2 or higher. The app pins the certificates it expects, so a network that tries to intercept the connection is refused rather than trusted.
At rest. The database is encrypted with AES-256 under a key we control through AWS Key Management Service. Automated backups inherit the same key. Our servers connect to it with full certificate verification, so a connection that cannot prove it is reaching our database fails instead of continuing.
On your phone. Sign-in tokens live in the iOS Keychain, not in ordinary app storage.
Your password. Stored as a scrypt hash, never as text we could read. If someone obtained the database they would not obtain your password.
Zuvo is not end-to-end encrypted. Generating your insights means our servers read your health data in a usable form — that is how the product works. Any health app that personalises anything and still claims end-to-end encryption is describing something it does not do.
Zuvo is not a HIPAA covered entity for the consumer app, and your data in it is not “PHI” in the HIPAA sense. Our cloud provider is HIPAA-eligible, which is a property of their infrastructure and not a compliance status we inherit. We would rather say this plainly than let a badge imply otherwise.
We hold no security certifications — no SOC 2, no ISO 27001, no HITRUST. See the status table below.
Not your employer. If you reached Zuvo through an employer or health plan, they see aggregate numbers across their population — never your individual records, meals, messages or readings. Aggregates are suppressed below a minimum group size, so a small team cannot be narrowed down to one person.
Not advertisers. We do not sell your health data, and we do not share it with advertisers.
AI providers, for the message you send. When you use chat or photo logging, the relevant content goes to an AI provider to produce a response. We are listed below. We are candid about a gap here: we do not yet have agreements in place with those providers restricting their retention of what we send. Until we do, this page will say so.
A small number of our own staff, where a support request or a production issue requires it. Access to health data is recorded in an audit log with who, what and when.
| Who | What for | What they get |
|---|---|---|
| Amazon Web Services | Hosting and storage (US region) | Everything, encrypted at rest |
| OpenAI, Anthropic | Chat replies, photo and document recognition | The content of that request only |
| Apple, Google | Sign-in, push notifications | Account identifiers — no health data |
Delete your account, and we mean delete. Deletion removes your records from twenty-five tables — signals, meals, messages, prescriptions, device tokens, rewards. Audit records are anonymised rather than removed, because a compliance log that can be erased is not a compliance log.
Export your data and withdraw consent for optional processing, both from inside the app.
Most security pages list only what exists. Here is the other half, because you would find it out eventually and we would rather you heard it from us.
| Item | Where we are |
|---|---|
| SOC 2 | Not started. No auditor engaged. When one is, this page will name the firm and the observation period — not a logo. |
| HIPAA BAA | Not available. Required for enterprise deployments handling PHI; we cannot sign one today and will say so here when that changes. |
| ISO 27001, HITRUST | Not being pursued at this stage. |
| Independent penetration test | Not yet commissioned. We will publish the date and scope when one is done. |
| AI provider data agreements | In progress. Not yet in place — see “Who can see your data” above. |
Email security@zuvofit.ai. Tell us what you found and how to reproduce it. We will acknowledge within three business days.
Please do not run denial-of-service tests, access another person’s account, or modify data that is not yours. Research that stays within those limits is welcome, and we will not pursue legal action over it.
For how we collect and use data, see the Privacy Policy.