Privacy Policy
Last updated: October 6, 2026 · Version 2.1
This is an English translation of our Política de Privacidade. If there is any conflict between the two versions, the Portuguese version prevails.
1. Who we are
The Novu GLP Care app (“Novu”, “app”, “we”, “us”) is operated by Davi Silva Buhrer, registered under Brazilian company number (CNPJ) 45.873.032/0001-30, located at Rua Professora Olivia Nogueira, 500 — São Pedro, São José dos Pinhais — PR, Brazil.
We are the controller of the personal data processed in the app, under Brazilian Law No. 13,709/2018 (General Data Protection Law — LGPD).
Data subject requests: Davi Silva Buhrer, at [email protected].
2. Plain-language summary
- Novu is a tracking diary for your treatment with GLP-1 medications. We are not a medical service: we do not diagnose, do not prescribe and do not replace your healthcare professional.
- To use the app you need to create an account and have an internet connection. Your records are stored on our servers, linked to your account.
- We record health data (medication, doses, weight, symptoms, meals, photos). We only process this data with your specific consent, given on a dedicated screen in the app, separate from the Terms.
- We do not sell your data and do not use it to train artificial intelligence. Your health data is never used for advertising.
- After you accept the terms, the app sends Meta (Facebook/Instagram) only usage events and technical device data, so we can measure Novu’s own ads. This stops when you sign out (section 3.4).
- You can view, correct, export and delete your data. Deleting your account erases your health records and your photos.
3. What data we collect
3.1 Registration and account
- Name or nickname, email and password (stored only as a hash).
- Sign in with Google or with Apple: we receive from the provider your name (when provided), email and an account identifier. With Apple, the email may be a relay address created by Apple. We do not have access to your Google or Apple password.
- Date of birth, sex, height, starting weight and goal weight.
- Phone number (optional), only if you turn on WhatsApp reminders.
- Subscription status (free or Premium) and purchase identifiers provided by the store. Today, subscriptions are made through the App Store. The same rule applies to Google Play once the Android app is available.
- A record of your acceptances (type, text version, date, IP address and device/browser data), as proof of consent.
3.2 Health data (LGPD, art. 11)
Collected because you provide it to use the app’s features:
- Medication, dose, administration method (pen, KwikPen, vial), dosing plan and phases, and your confirmation that the plan was set by your doctor;
- Logged injections (date, dose and body site) and custom injection sites;
- Weight, bioimpedance measurements, mood and energy;
- Symptoms and side effects, with intensity;
- Meals (description, macronutrients and photo, if you upload one);
- Hydration;
- Body progress photos and profile photo;
- Health conditions, allergies, other medications and your doctor’s name, if you fill in your medical history;
- Achievements and statistics calculated from the items above.
3.3 Treatment supply and costs
Pens and vials in stock, expiry date, lot number and amounts paid, entered by you for supply and cost tracking.
We do not collect card data. Subscription payments are processed by the store.
3.4 Technical data
- IP address, access date and time, and authentication logs (Brazilian Internet Civil Framework — Marco Civil da Internet, art. 15);
- Device/browser identification (user agent) associated with the session;
- Server operation logs (errors and performance), without the content of your health records.
The app does not use third-party analytics or error-monitoring tools.
3.4.1 Ad measurement (Meta SDK)
The app includes the Meta Platforms SDK (Facebook), used only to find out whether Novu’s ads lead to installs and subscriptions. The SDK stays off until you accept the terms and is turned off again when you sign out. When on, it sends Meta:
- app usage events: install, app open and, where applicable, the subscription purchase;
- an anonymous identifier generated by the SDK itself (it is not the device advertising ID);
- technical device data that accompanies the events: model, OS version, language, time zone, app version, screen resolution and carrier.
We do not send Meta your health data, photos, name, email, phone number or the device advertising ID (IDFA/AAID). We do not show ads inside the app. Meta processes this data under its own policy and is responsible for how it uses it. To stop the sending, sign out or delete your account (section 9).
3.5 What we do not collect
Location, contacts, messages, data from Apple Health or Google Health Connect, or the device advertising ID (IDFA/AAID).
4. How we use data (purposes and legal bases)
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Create and maintain your account, authenticate access | Registration, technical data | Performance of contract (art. 7, V) |
| Record and display your history, charts, calendar, supply and achievements | Health data | Specific and highlighted consent (art. 11, I) |
| Send reminders on your device and, if you turn it on, via WhatsApp | Dosing plan, preferences, phone number | Consent (art. 7, I and art. 11, I) |
| Generate the PDF summary and spreadsheet that you choose to share | Health data | Consent (art. 11, I) |
| Charge and manage the subscription | Status and purchase identifiers | Performance of contract (art. 7, V) |
| Keep proof of your acceptances | Consent record | Regular exercise of rights (art. 7, VI) |
| Keep access logs | IP, date and time | Legal obligation (art. 7, II — Marco Civil, art. 15) |
| Security, fraud and abuse prevention, bug fixing | Technical data | Legitimate interest (art. 7, IX) |
| Provide you with support | Registration data and anything you tell us | Performance of contract (art. 7, V) |
| Measure whether Novu’s ads generate installs and subscriptions (Meta SDK) | App usage events, the SDK’s anonymous identifier and technical device data — no health data | Consent (art. 7, I), given when you accept the terms; the SDK only turns on after that |
Withdrawing consent: go to Profile → Revoke health data consent. Since Novu does not work without this data, withdrawing consent means deleting your account (section 8).
5. Who we share data with
We do not sell, rent or transfer your data. We use service providers (processors) only to operate Novu:
| Provider | What it does | Data involved |
|---|---|---|
| Vultr | API server and database (datacenter in São Paulo) | All account data |
| Cloudflare | Protection and delivery of API and website traffic (the connection goes through it) and photo storage (R2) | API traffic, photos, technical data |
| Hostinger | Institutional website, sending emails (codes, login and security alerts) and the server for the WhatsApp service | Email, IP and device in the login alert; phone number and WhatsApp reminders |
| WhatsApp (Meta) | Delivery of WhatsApp reminders, if you turn them on | Phone number and reminder text |
| Sign in with Google; Google Play subscriptions, once the Android app is available | Account and purchase identifiers | |
| Apple | Sign in with Apple; App Store subscriptions | Account and purchase identifiers |
| Meta Platforms (Facebook SDK) | Measurement of Novu’s ads (section 3.4.1) | App usage events, the SDK’s anonymous identifier and technical device data |
WhatsApp: reminders are sent by software running on a server we contract, connected to a Novu WhatsApp account (it is not Meta’s official business platform). Messages do not include the medication name or the dose. They travel through WhatsApp’s infrastructure and remain in the chat history.
Support: if you lose access and ask for help, we can reset your password and send a code to your email. This action is logged and you receive an email notifying you. Once the password is reset, support can sign in to the account. This only happens to fulfill your request.
We may also share data (i) to comply with a court order, request from an authority or legal obligation; (ii) to exercise rights in legal proceedings; (iii) in a corporate reorganization or sale of the business, in which case you will be informed and this Policy will remain in effect.
Your doctor: the PDF summary is generated and shared by you. We do not send your data to healthcare professionals, health plans or insurers.
6. International transfer
Cloudflare, Google, Apple and Meta (WhatsApp and the ad-measurement SDK) may process data outside Brazil. Vultr is a United States company; the API server we contract is located in São Paulo. Email and WhatsApp reminder delivery use Hostinger’s hosting. Photos are stored in Cloudflare’s storage.
The transfer takes place to perform the service you requested: signing in, processing the subscription in the store, delivering the reminder and protecting traffic. We do not send your health records for advertising or to train artificial intelligence.
7. Security
- Encrypted connections (HTTPS/TLS) between the app, Cloudflare and our server;
- Passwords stored only as a hash; health conditions, allergies and other medications encrypted in the database;
- Photos in private storage, accessible only through temporary links (15 minutes) generated for your account;
- Each record can only be read and changed by the account that owns it;
- Sessions with expiration and token rotation; attempt limits against abuse;
- Restricted administrative access, with audit logging.
No system is completely secure. If an incident occurs that may cause relevant risk or harm, we will notify you and the ANPD (Brazilian National Data Protection Authority) as required by the LGPD.
8. How long we keep data
| Data | How long |
|---|---|
| Account and health records | While the account exists |
| A record you delete in the app (a weigh-in, a dose, a photo) | Permanently deleted within 30 days |
| When you delete your account | Registration data anonymized and health records deleted immediately; photos deleted shortly after (within 30 days at most) |
| Proof of your acceptances (type, version, date, IP) | 5 years after account deletion, without any health data |
| Subscription billing data | For the period required by law |
| Access logs (IP, date and time) | 6 months (Marco Civil da Internet, art. 15) |
| Server technical logs | 6 months at most |
| Reminders sent via WhatsApp (internal log) | 30 days |
| Events and technical data sent to Meta by the SDK (section 3.4.1) | Kept by Meta, under its own period and rules; we cannot delete them individually |
| Server backups | Only to restore the service, and replaced on the provider’s cycle |
9. Your rights (LGPD, arts. 18 and 19)
You may, free of charge:
- confirm whether we process your data and access it (everything is shown in the app);
- correct incomplete or inaccurate data (in the app itself);
- export your data: in the app, with Premium (spreadsheet and PDF); on the free plan, by requesting it via email — we send you a file with your records;
- request anonymization, blocking or deletion of unnecessary data or data processed in non-compliance with the law;
- delete your account and the data processed based on consent (Profile → Delete account, or via the Account and data deletion page);
- withdraw consent (section 4);
- know who we share your data with (section 5) and the consequences of not consenting;
- object to processing based on legitimate interest.
How to request: through the app or at [email protected]. We respond within 15 days. We may ask for information to confirm the request is yours.
You may also file a complaint with the Brazilian National Data Protection Authority (ANPD) — gov.br/anpd.
10. Notifications and communications
- On-device reminders: generated on your phone itself, with your permission in the system settings. They show the medication name and dose. On the lock screen, they follow your Android or iOS setting for hiding sensitive content.
- WhatsApp (Premium): only with your phone number and explicit activation. No medication name and no dose. You can turn it off in the app, under Reminders.
- Transactional emails (verification code, new login alert, security, changes to these documents) are necessary for the service.
- We do not send marketing emails without your opt-in.
11. On-device storage and cookies
The app stores on your device the session, preferences and a temporary copy of your records in order to work. Files you export (PDF and spreadsheet) are kept in a temporary app folder and are deleted on the next export and when you sign out.
The institutional website does not use advertising cookies or analytics tools.
12. Children and adolescents
Novu is exclusively for people aged 18 or over. At registration you declare that you are 18 or older, and the app does not accept a date of birth of a minor. If we identify an account belonging to a minor, it will be deleted. Parents or guardians can write to [email protected].
13. Automated calculations
The app calculates estimates: medication half-life curve, supply duration, injection adherence, achievements and possible correlations between meals, doses and symptoms. They are informational only, are not a diagnosis or treatment guidance, and do not produce legal effects on you. You can request a review through our contact.
14. Changes to this Policy
Relevant changes are announced in the app and/or by email at least 15 days in advance. When a change requires new consent, the app asks for your acceptance again before continuing. The current version is always available at https://usenovu.com.br/privacidade/ (English translation at https://usenovu.com.br/en/privacy/).
15. Contact
Davi Silva Buhrer — CNPJ 45.873.032/0001-30 Email: [email protected] Phone: +55 41 9134-7276 Address: Rua Professora Olivia Nogueira, 500 — São Pedro, São José dos Pinhais — PR, Brazil