Privacy Policy

Information we collect

• Account information: name, email address, and password, managed through our authentication provider, Better Auth.
• Booking details: name, email, phone number, and appointment information you provide through the booking wizard, including any information you provide about a family member you book on behalf of.
• Order and shipping information: your shipping and billing address and order details when you purchase from our shop.
• Payment information: handled directly by our payment processor, Stripe. We never store your full card number.
• Membership information: your membership plan and subscription status.
• Clinic records: files that our staff upload to your client record, such as assessments, lab results, treatment protocols, and consent forms.
• Health and fitness data: readings you log manually or sync from Apple HealthKit or Android Health Connect, such as heart rate, resting heart rate, sleep, steps, blood pressure, blood glucose, body temperature, oxygen saturation, weight, and height. These readings are securely uploaded to your account so you and your care team can view them.
• Device data: push notification tokens and device identifiers used to send you appointment reminders and clinic updates.

How we use your information

We use the information above to manage your appointments, fulfill your shop orders, operate your membership subscription, send transactional email, display your health trends, and maintain clinic records for the care we provide you.

We do not sell your personal information, and we do not use health data from Apple HealthKit or Android Health Connect for advertising.

Who we share information with

We share information with the service providers that operate parts of this platform, and only for the purpose of operating that part of the platform:

• Stripe — processes payments and membership subscriptions.
• Resend — sends transactional email, including account verification, password reset, order confirmation, and shipping notifications.
• Vercel Blob — stores images uploaded to the platform.
• Google, Apple, or Facebook — only if you choose to sign in using one of these providers instead of an email and password.

Data retention

We keep personal information only for as long as needed to provide our services, or as required by law:

• Account information: kept while your account is active, and permanently deleted within 30 days after you delete your account.
• Health and fitness data (including readings synced from Apple HealthKit or Android Health Connect): stored in your account until you delete those readings or your account. When you delete your account, this data is permanently deleted within 30 days.
• Booking and appointment details: kept while your account is active, and for as long as needed to maintain accurate clinic records.
• Clinic records: kept for the period required by applicable Ontario professional and health-records regulations, then securely deleted.
• Order, payment, and membership records: kept for at least 6 years as required by Canadian tax and accounting law, then securely deleted.
• Device data: push notification tokens and device identifiers are deleted when you delete your account or when the token is no longer valid.
• Backups: deleted data may remain in encrypted backups for up to 30 additional days before it is permanently overwritten.

Your rights and account deletion

You may ask to access or correct the personal information we hold about you, and you may withdraw any consent you have given, by contacting us using the details below.

You can request deletion of your account and all associated personal data in either of these ways:

• In the mobile app: go to Profile > Settings > Delete Account and confirm. This permanently deletes your account and the personal data linked to it, including health and fitness readings synced from Apple HealthKit or Android Health Connect.
• By email: send a deletion request from the email address linked to your account to marketing@novathera.ca with the subject "Account Deletion Request". We will verify your identity, confirm your request, and complete the deletion within 30 days.
• You can also ask us to delete specific data (for example, only your synced health readings) without deleting your whole account by emailing us at marketing@novathera.ca.
• Deleting your account does not remove Nova Thera's access in Health Connect or Apple Health on your device. You can revoke that access at any time in your device's Health Connect or Health settings.
• This platform is operated by a private-sector business in Ontario, Canada, and personal information is handled in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). If you believe we have not handled your information appropriately, you may file a complaint with the Office of the Privacy Commissioner of Canada.

Not medical advice

Nothing on this website or platform constitutes medical advice. Our services do not replace assessment, diagnosis, or treatment by a qualified healthcare professional.

Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision.

Contact us

If you have questions about this policy or your personal information, contact us at marketing@novathera.ca or Unit 2, 156 Chrislea Rd, Woodbridge, ON L4L 8V1.