Your health data should work for you—not become the product.

Who we are and what this covers

Evo is a consumer health and nutrition service operated by Darwin Life Inc., a Delaware corporation (“Evo,” “we,” “us,” or “our”). This policy applies to evo.med, the Evo mobile application, and related services (together, the “Services”). It is effective September 2, 2026.

This is a direct-to-consumer service. Darwin Life Inc. is generally not a health plan, health care provider, or health care clearinghouse covered by HIPAA, so information you give Evo is not necessarily protected by HIPAA. It is protected by this policy and applicable consumer-health and privacy laws. If a future clinical service has a separate privacy notice, that notice will govern that service.

Residents of states with consumer health data laws should also read our Consumer Health Data Privacy Notice.

Information we collect

Account and contact information

This includes your email address, authentication provider, display name, profile image if supplied by a sign-in provider, account identifiers, preferences, and messages you send to support or through feedback forms. Authentication providers process credentials; Evo does not receive your password in readable form.

Health, nutrition, and meal information

If you choose to provide it, this may include height, weight, target weight, birth date, sex used by metabolic formulas, activity level, nutrition goals and targets, meal times, meal photos or nutrition-label photos, camera depth and calibration data, ingredients, nutrition estimates, corrections, and analysis history. A meal photo can incidentally contain people, text, location clues, or other details outside the meal, so please frame captures to avoid information you do not want to upload.

Apple Health information

Only after you grant permission, Evo may read the Apple Health categories shown in the system permission sheet: height, body mass, active energy, dietary energy, and recent workout summaries. Evo does not write to Apple Health. You can change permission at any time in Apple's Health or Settings app. Disconnecting stops new collection but does not automatically delete data already saved to your Evo account.

Device, use, and website information

We receive ordinary network and device information such as IP address, browser or app version, device and operating-system type, language, approximate region, pages viewed, product events, crash diagnostics, and timestamps. Evo's website analytics do not collect calculator inputs or results, free text, full outbound URLs, session recordings, or broad page interactions. Native analytics do not include meal names, images, ingredients, calories, body metrics, email, or support text.

Information from other services

We may receive profile details from Google sign-in, Apple Health information you authorize, and information needed to complete a request from services you connect. If you follow a merchant or partner link, that third party receives the normal web request and applies its own policy; Evo does not send it your account or health record.

How we use information

• Provide accounts, cross-device storage, meal analysis, nutrition estimates, and features you request.
• Personalize the Services using the health and preference information you choose to provide.
• Authenticate users, prevent abuse, secure the Services, debug failures, and enforce our terms.
• Respond to support, privacy, export, and deletion requests.
• Send transactional messages and, only if you opt in, product or marketing messages.
• Comply with law, protect rights and safety, and establish or defend legal claims.
• Measure and improve reliability, usability, accuracy, and our own AI and machine-learning systems under the safeguards below.

Where law requires consent for sensitive or consumer health data, we rely on your affirmative choice or use the information only as necessary to provide the feature you requested. We do not use sensitive data to infer characteristics unrelated to Evo's health and nutrition features.

Product improvement and AI model training

Evo's value depends on learning where meal estimates are wrong. We may use meal photos, depth data, nutrition-label evidence, model outputs, and your corrections to evaluate and improve Evo and to develop or train models owned or controlled by Evo. Before placing customer meal data in an improvement or training dataset, we use technical and organizational measures reasonably designed to de-identify it, such as removing direct account identifiers and file metadata, separating it from account records, limiting access, and screening for visible faces, names, or other identifying content.

We do not use directly identifiable health data or Apple Health data to train models without a separate, explicit opt-in. Where applicable law requires consent for another improvement use, we will ask before that use. You may opt out of future use of your meal data for model improvement by contacting us. An opt-out does not affect processing needed to analyze a meal for you.

Evo uses AI service providers to perform analysis on our behalf. We configure and contract for those providers not to train their general models on Evo customer inputs. We do not sell training data or license identifiable customer health data to others. Once information has been lawfully de-identified and incorporated into aggregate statistics, evaluation results, or model parameters, it may no longer be reasonably possible to identify or remove one person's contribution.

When information is disclosed

We disclose information only as described here. Service providers must process it for defined purposes under contractual and legal protections. The providers currently supporting the Services include:

• Google Firebase and Google Cloud for authentication, databases, private file storage, and infrastructure.
• Vercel for website and API hosting, including transient routing of meal-analysis requests.
• OpenAI for meal-image and depth analysis using a pseudonymous safety identifier rather than your email or Evo account ID.
• PostHog for limited product analytics that exclude health values and meal content.
• Sentry for crash and performance diagnostics with default personal-information collection and screenshots disabled.
• Resend for account and other email delivery.

We may also disclose information when you direct us to; to comply with valid legal process; to protect users, the public, or our rights; or as part of a financing, acquisition, reorganization, or sale of business assets. A successor must honor this policy for information collected under it unless you receive notice and any choice required by law. We do not currently share personal data with a corporate affiliate for its own independent use.

What we do not do

• We do not sell or rent personal data or consumer health data.
• We do not use or disclose health data for targeted or cross-context behavioral advertising.
• We do not share Apple Health data with advertisers, data brokers, or information resellers.
• We do not use health data to determine insurance, employment, credit, housing, or similar eligibility.
• We do not use geofences around health care facilities to identify or target people seeking care.

Retention and deletion

We keep account and health information while your account is active and as needed to provide the Services. Shorter-lived operational copies, logs, and abandoned uploads are deleted or overwritten on their normal schedules. We may retain limited records longer when reasonably necessary for security, fraud prevention, legal obligations, disputes, or enforcing agreements.

When you delete your account or make a valid deletion request, we delete or de-identify covered active data and instruct relevant processors to do the same, subject to legal exceptions. Encrypted backups are isolated from ordinary use and expire through normal backup cycles; if restored for disaster recovery, deletion controls are reapplied. De-identified information that cannot reasonably be linked back to you may be retained.

Your choices and rights

Regardless of where you live, you may ask to access, correct, export, or delete your account data; withdraw consent for future processing; opt out of future meal-data model improvement; or appeal a privacy-request decision. Applicable law may provide additional rights, including the right to know, portability, restriction, objection, or freedom from discrimination for exercising a right.

Email privacy@evo.med from the address associated with your account. We may verify your identity before acting. Authorized agents may make requests where law permits, subject to proof of authority. You can unsubscribe from promotional email through the message itself. Browser Global Privacy Control signals are treated as opt-out requests where legally required, though Evo does not currently sell or share data for targeted advertising.

Security and international processing

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including access controls, encryption in transit, private storage rules, data minimization, and separation of health data from public profile information. No system is perfectly secure. If a qualifying breach occurs, we will notify affected users and regulators as required by law.

Evo is operated in the United States and providers may process information in the United States and other countries. Where required, we use recognized safeguards for international transfers. Local mandatory privacy rights continue to apply.

Children

Evo is not directed to children under 13. If local law requires a higher minimum age to consent to data processing, that higher age applies. A minor who may use Evo must have a parent or legal guardian's permission. If you believe a child provided data contrary to this section, contact us so we can investigate and delete it when appropriate.

Changes and contact

We may update this policy as the Services and law change. We will post the new date and, for a material change, provide additional notice and seek consent when required. We will not retroactively expand how we use identifiable health data without any consent required by law.

Questions, requests, or complaints: privacy@evo.med. You may also write to Darwin Life Inc., Attn: Privacy, 927 E Main St STE 67435, Louisville, KY 40206, United States.