Privacy Policy

including our Consumer Health Data Privacy Notice

Operated by ClientValley OÜ (Estonia)

Last Updated: 14 September 2026 · Effective Date: 15 July 2026

1. Introduction

This Privacy Policy explains how ClientValley OÜ ("we," "us," or "our") collects, uses, shares, and protects information about you when you use the EELO iOS application and related services (the "Service"). EELO is the product name. The legal entity is ClientValley OÜ.

EELO is currently offered only to adults aged 18 or over who are located in the United States.

This Privacy Policy also serves as our Consumer Health Data Privacy Notice for the purposes of the Washington My Health My Data Act, the Nevada consumer health data law, and comparable laws. Section 6 addresses consumer health data specifically. That notice is also posted separately at eeloapp.com/health-privacy.

2. Who We Are and How to Contact Us

The controller of your personal information is:

ClientValley OÜ, a private limited company registered in Estonia, operating the product EELO.

Registry code: 14802223

Tallinn, Estonia

Privacy and legal contact (including written notices): eeloocd@gmail.com

We have not appointed a Data Protection Officer. If we are required to appoint one, or choose to, we will update this Policy with their contact details.

3. A Summary of Our Approach

• We collect the minimum we need to run the Service.
• Where end-to-end encryption is applied, the content of your entries is encrypted on your device, and we cannot read it.
• We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
• We do not use your health-related entries to train advertising profiles, and we do not disclose them to advertisers or data brokers.
• You can request access to, correction of, or deletion of your information at any time.

4. Information We Collect

4.1 Information you provide directly.

• Account information: your email address, and your password or authentication credentials. If you sign in with a third-party provider such as Apple or Google, we receive the identifiers that provider shares with us.
• Practice content (consumer health data): the fears, triggers, habits, challenges, steps, notes, written reflections, distress or intensity ratings, completion records, timestamps, and other content you enter when using the Service. This content can reveal information about your mental health, so we treat it as sensitive.
• Support communications: information you send us when you contact support, provide feedback, or report a problem.

4.2 Information collected automatically.

• Device and technical data: device type, operating system and version, browser type, language, and general technical diagnostics.
• Usage data: app version, feature usage, session activity, crash and error logs, and performance data.
• Approximate location: derived from your IP address, used for security, fraud prevention, and to confirm that the Service is being used in a jurisdiction where we offer it. We do not collect precise GPS location.
• Local notifications: if you enable practice reminders, the app schedules notifications on your device. Those reminders stay on the device. We do not send them from our servers.

4.3 Payment information.

Subscriptions are processed by the Apple App Store and by RevenueCat, Inc., which manages subscription status and entitlements. We do not collect or store your full payment card number. We receive limited transaction data, such as subscription status, plan, renewal date, and an anonymized transaction or receipt identifier.

4.4 Information we do not collect.

• We do not collect information from anyone we know to be under 18.
• We do not collect precise geolocation.
• We do not collect biometric identifiers.
• We do not purchase personal information from data brokers.

5. End-to-End Encryption, and Why We Cannot See Your Answers

Your practice content is end-to-end encrypted. It is encrypted on your own device, using a key derived from your credentials, before it is transmitted to or stored on our infrastructure.

WE CANNOT SEE YOUR ANSWERS. WE CANNOT READ, DECRYPT, ACCESS, REVIEW, MONITOR, ANALYZE, RESTORE, OR RECOVER THE CONTENT YOU ENTER, AND NO EMPLOYEE, CONTRACTOR, OR ADMINISTRATOR OF CLIENTVALLEY OÜ CAN DO SO. OUR SERVICE PROVIDERS HOLD ONLY ENCRYPTED DATA THAT THEY CANNOT READ. WE COULD NOT PRODUCE YOUR CONTENT IN READABLE FORM EVEN IF WE WERE ASKED OR LEGALLY COMPELLED TO DO SO.

Because we cannot read your entries, we also cannot detect distress, risk, or crisis in them, and we cannot intervene. EELO is not monitored and is not an emergency service.

5.1 Your recovery code.

Because the encryption key is derived from credentials only you hold, EELO issues you a recovery code when you set up encryption. You must store it somewhere safe, offline, and private.

If you created your account with an email address and password, your password normally unlocks your content, and the recovery code is your backup. Resetting a forgotten password does not by itself restore access to content encrypted under the old password. You will be asked for your recovery code so that your content can be re-secured under the new password.

If you sign in with Apple or Google, you do not have an EELO password, and your recovery code is the only way to open your content on a new device.

WE DO NOT HOLD OR STORE YOUR RECOVERY CODE OR YOUR ENCRYPTION KEY, AND WE CANNOT RETRIEVE THEM, RESTORE THEM, OR USE THEM TO OPEN YOUR CONTENT. IF YOU LOSE THE CREDENTIALS THAT PROTECT YOUR ENCRYPTION KEY, YOUR ENCRYPTED CONTENT IS PERMANENTLY AND IRREVERSIBLY LOST, AND CANNOT BE RECOVERED BY US, BY YOU, OR BY ANYONE ELSE. THIS IS THE INTENDED CONSEQUENCE OF ENCRYPTION THAT PROTECTS YOUR PRIVACY, NOT A DEFECT.

5.2 Starting fresh if you lose your recovery code.

If you no longer have your recovery code, EELO can issue you a new one so that you can continue using the Service. This does not recover your existing content and is not a way for us to access it. Choosing to start fresh permanently deletes the content encrypted under your previous key, including your courage ladders, reflections, anchors, and strategies. That content cannot be recovered by anyone, including us. Your account, your subscription, and your settings are not affected. You will be warned before this happens and it cannot be undone.

Anyone you give your recovery code to may be able to read all of your content. Keep it private.

5.3 What is not encrypted in this way.

Some information must remain readable to us in order to run the Service, and is therefore not end-to-end encrypted. This includes your email address, your authentication data, your subscription status, and technical and diagnostic logs. This information is still protected by encryption in transit and at rest, and by access controls.

6. Consumer Health Data Privacy Notice

This section applies to "consumer health data" as defined by the Washington My Health My Data Act, the Nevada consumer health data law, and comparable United States state laws. It applies to all users. Residents of Washington and Nevada have the additional rights described below.

6.1 What consumer health data we collect.

The practice content described in Section 4.1, including the fears, triggers, habits, challenges, reflections, distress ratings, and completion records you enter, together with the fact that you use a mental wellness application at all, may constitute consumer health data because it can reveal information about your mental health status or your attempts to seek mental wellness support.

6.2 How we collect it.

We collect consumer health data only when you voluntarily enter it into the Service, or when it is generated by your use of features you choose to use. We do not collect consumer health data from any third party, and we do not infer health data from data brokers or from external sources.

6.3 Why we collect it.

• To provide the core functionality of the Service to you, that is, to store and display your own entries back to you and to track your own progress.
• To operate, secure, maintain, and troubleshoot the Service.
• For no other purpose, unless we obtain your separate, specific, informed consent first.

6.4 Who we share it with.

WE DO NOT SELL CONSUMER HEALTH DATA. WE DO NOT SHARE CONSUMER HEALTH DATA FOR ADVERTISING, MARKETING, PROFILING, OR ANY CROSS-CONTEXT BEHAVIORAL ADVERTISING PURPOSE. WE DO NOT DISCLOSE IT TO DATA BROKERS.

The only parties that may process consumer health data are our infrastructure service providers, acting solely as processors under contract and solely to host and operate the Service on our behalf. They are listed in Section 8. Where end-to-end encryption is applied, those providers hold only encrypted data that they cannot read.

We may also disclose data where required by law, as described in Section 8.3.

6.5 Your consumer health data rights.

You have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and to access that data.
• Obtain a list of all third parties with whom we have shared your consumer health data.
• Withdraw your consent to the collection and sharing of your consumer health data.
• Have your consumer health data deleted, including from our archives and backups, subject to the backup limits described in Section 9 and to any legal retention obligation.

To exercise these rights, contact us at the privacy contact address in Section 2. We will not discriminate against you for exercising them. You may appeal a denial, and if your appeal is denied, you may contact your state Attorney General.

6.6 Separate Consumer Health Data Privacy Policy.

This Section 6 is our Consumer Health Data Privacy Policy for the purposes of the Washington My Health My Data Act and comparable laws. We also post it separately and conspicuously at eeloapp.com/health-privacy. We collect consumer health data when you voluntarily enter it after you have been given this notice (including by agreeing to this Privacy Policy). We will obtain a separate, specific authorization from you before any sale of consumer health data (we do not sell it). You have a private right of action under the Washington My Health My Data Act if we fail to comply.

7. How We Use Information, and Our Legal Bases

We use information for the following purposes, and, where the EU General Data Protection Regulation applies to our processing, on the following legal bases:

• To provide the Service and perform our contract with you. Legal basis: performance of a contract.
• To process your consumer health data and other special category data. Legal basis: your explicit consent, which you may withdraw at any time. Withdrawing consent means we can no longer provide the core features of the Service to you.
• To authenticate you, secure accounts, and prevent fraud, abuse, and unauthorized access. Legal basis: legitimate interests and legal obligation.
• To operate, maintain, debug, and improve the Service, using aggregated or de-identified data wherever possible. Legal basis: legitimate interests.
• To process payments and manage subscriptions. Legal basis: performance of a contract and legal obligation.
• To communicate with you about the Service, including service messages and support. Legal basis: performance of a contract and legitimate interests.
• To send marketing communications, only if you have opted in. Legal basis: consent. You may opt out at any time.
• To comply with law and to establish, exercise, or defend legal claims. Legal basis: legal obligation and legitimate interests.

WE DO NOT USE YOUR PRACTICE CONTENT TO TRAIN ARTIFICIAL INTELLIGENCE OR MACHINE LEARNING MODELS, AND WE DO NOT USE IT FOR ADVERTISING, PROFILING, OR AUTOMATED DECISION-MAKING THAT PRODUCES LEGAL OR SIMILARLY SIGNIFICANT EFFECTS.

7.1 A note on artificial intelligence.

Artificial intelligence tools were used to help build EELO, including to help write its software and its educational content. This is a fact about how the product was made. It is not a description of how your data is processed.

YOUR ENTRIES ARE NOT SENT TO ANY ARTIFICIAL INTELLIGENCE SYSTEM, ARE NOT USED TO TRAIN ANY MODEL, AND ARE NOT ANALYZED BY ANY MODEL. THEY ARE END-TO-END ENCRYPTED, AND WE CANNOT READ THEM, SO WE COULD NOT SUBMIT THEM TO SUCH A SYSTEM EVEN IF WE WANTED TO.

Because AI tools were used to create the content of the app, that content may contain errors or inaccuracies. Please see our Terms of Service, which explains this and disclaims reliance on it.

8. How We Share Information

8.1 We do not sell your information.

WE DO NOT SELL YOUR PERSONAL INFORMATION, AND WE DO NOT SHARE IT FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING, AS THOSE TERMS ARE DEFINED UNDER CALIFORNIA AND OTHER UNITED STATES STATE PRIVACY LAWS. WE HAVE NOT DONE SO IN THE PRECEDING TWELVE MONTHS.

8.2 Service providers (processors).

We share information with vendors that process it on our behalf, under contract, and only on our instructions:

• Supabase (Supabase, Inc.): authentication, database, file storage, and server functions. Processes your email address, authentication data, encrypted user content, wrapped encryption keys, and subscription status. Hosted in the United States (US East region).

• Hostinger (Hostinger International, Ltd.): web hosting for eeloapp.com. Processes standard web-server log data such as IP address and request metadata. Hosted on Hostinger infrastructure.

• Resend (Resend, Inc.): transactional email, such as account-confirmation and password-reset messages. Processes your email address and email delivery metadata. Hosted in the United States.

• Apple (Apple Inc.): app distribution, in-app purchases, and subscription billing, acting as merchant of record, and, where you use Sign in with Apple, authentication. Processes purchase and subscription records and, for Sign in with Apple, your name and email address or Apple private-relay address. Operated on Apple infrastructure in the United States and globally.

• Google (Google LLC): authentication, where you choose Sign in with Google. Processes your name, email address, and Google account identifier. Hosted in the United States. When you visit eeloapp.com, Google Fonts may also receive your IP address and browser data in order to serve the website typeface. That website font request does not apply inside the iOS app.

• RevenueCat (RevenueCat, Inc.): management of subscription status and entitlements. Processes an app user identifier, subscription and entitlement status, and purchase receipts. Hosted in the United States.

• Porkbun (Porkbun LLC): domain registration and DNS. Processes domain and DNS records only, not user content. Located in the United States.

We do not use any third-party analytics, advertising, or crash-reporting services. If we add one in the future, we will update this list before or when we begin using it.

8.3 Legal and safety disclosures.

We may disclose information if we believe in good faith that disclosure is reasonably necessary to: comply with a law, regulation, legal process, or governmental request; enforce our Terms of Service; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of ClientValley OÜ, our users, or the public. Where encryption prevents us from reading content, we cannot produce that content in readable form.

8.4 Business transfers.

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will require the recipient to honor this Privacy Policy, or we will give you notice and an opportunity to delete your information before it becomes subject to a materially different policy.

8.5 Aggregated and de-identified data.

We may create and use aggregated or de-identified data that cannot reasonably be used to identify you. We will not attempt to re-identify it, and we will require others not to.

9. Retention

We retain personal information only as long as necessary for the purposes described in this Policy:

• Account and practice content: for as long as your account is active.
• After you delete your account: we delete or de-identify your personal information within a commercially reasonable period, except where we must retain it to comply with law, resolve disputes, or enforce our agreements.
• Backups: residual copies may persist in our routine encrypted backups for a limited period after deletion, in the ordinary course of backup rotation, after which they are overwritten.
• Billing records: retained as required by tax and accounting law, generally seven (7) years under Estonian law.

10. Deletion

You may delete your account and your data at any time from within the app, or by contacting us. Deletion is permanent and irreversible.

Please note that deleting the app from your device does not delete your account or your data. You must use the deletion feature or contact us.

11. Security

We implement technical and organizational measures designed to protect your information, including encryption in transit, encryption at rest, end-to-end encryption for practice content where applied, access controls, and least-privilege access for personnel.

HOWEVER, NO METHOD OF TRANSMISSION OR STORAGE IS COMPLETELY SECURE. WE CANNOT AND DO NOT GUARANTEE THE ABSOLUTE SECURITY OF YOUR INFORMATION. YOU USE THE SERVICE AT YOUR OWN RISK, AND YOU ARE RESPONSIBLE FOR SAFEGUARDING YOUR CREDENTIALS, RECOVERY CODE, AND DEVICE.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, you, in accordance with applicable law.

12. Your Privacy Rights

12.1 Rights available to all users.

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct inaccurate information.
• Deletion: request that we delete your information.
• Portability: request a copy in a portable, machine-readable format.
• Withdraw consent: withdraw consent to processing that is based on consent, including our processing of your consumer health data.
• Object or restrict: object to or request restriction of certain processing.
• Opt out of marketing: unsubscribe at any time.
• Non-discrimination: we will not deny you service, charge you a different price, or provide a different quality of service because you exercised a privacy right.

To exercise any right, contact us at the privacy contact address in Section 2. We will verify your identity, usually by confirming control of the email address associated with your account, and we will respond within the period required by applicable law. You may use an authorized agent where the law permits.

Because practice content is end-to-end encrypted, we cannot produce that content in readable form. Access and portability for practice content are limited to what you can export from a device that already has your encryption key. We can still provide account, authentication, subscription, and other information that is not end-to-end encrypted.

12.2 United States state privacy rights.

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you have the rights listed above, together with the right to appeal a refusal and the right to lodge a complaint with your state Attorney General.

Under the California Consumer Privacy Act, as amended, we disclose that: the categories of personal information we collect are identifiers, commercial information (subscription status), internet or network activity, approximate geolocation, and sensitive personal information (health-related content); we collect it for the business purposes described in Section 7; we obtain it from you and from your use of the Service; we disclose it only to the service providers described in Section 8.2; and we do not sell it or share it for cross-context behavioral advertising.

We use and disclose sensitive personal information only for the purposes permitted under applicable law, that is, to provide the Service you requested, and not for inferring characteristics about you.

12.3 Rights under the GDPR.

Because we are established in Estonia, the EU General Data Protection Regulation may apply to our processing. Where it does, you have the rights described in Section 12.1, and you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or with your local supervisory authority.

13. International Transfers

We are established in Estonia, and our service providers may be located in the United States and elsewhere. This means your information may be transferred to, stored in, and processed in countries other than the one in which you live, including countries whose data protection laws may differ from those of your jurisdiction.

Where such transfers are subject to the GDPR, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, or on an applicable adequacy decision. Where personal information is transferred outside your country, we also rely on equivalent data-protection terms in our agreements with our service providers.

14. Cookies and Similar Technologies

We use only the storage and cookies necessary to operate the Service, such as keeping you signed in and remembering your settings. We do not use advertising cookies, attribution SDKs, or third-party analytics. If we add any of those in the future, we will update this Policy, including Sections 4, 7, 8, and 12, and we will use a consent mechanism where the law requires one.

The EELO website loads a typeface from Google Fonts, as described in Section 8.2. That is a website request only. The iOS app does not load Google Fonts.

15. Children

EELO is strictly for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from someone under 18, we will delete it promptly. If you believe a minor has provided us with personal information, contact us immediately.

16. HIPAA Does Not Apply

We are not a healthcare provider, health plan, or healthcare clearinghouse, and we are not a business associate of any such entity. The Health Insurance Portability and Accountability Act (HIPAA) does not apply to EELO, and the information you enter is not protected health information under HIPAA. This does not reduce our commitment to protecting your information as described in this Policy, and it does not affect your rights under the state consumer health data laws described in Section 6.

17. Third-Party Resources and Links

EELO may link to third-party crisis lines, directories, or websites. Those third parties have their own privacy policies, and we are not responsible for their practices. If you contact a third-party resource, any information you give them is governed by their policy, not by ours.

18. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will provide notice, for example by in-app notice or by email, before it takes effect. Where a change requires your consent under applicable law, we will obtain that consent. The "Last Updated" date at the top shows when this Policy was last revised.

19. Contact and Complaints

To exercise a right, ask a question, or make a complaint, contact us at:

ClientValley OÜ

Registry code: 14802223

Tallinn, Estonia

eeloocd@gmail.com

If you are not satisfied with our response, you may lodge a complaint with the Estonian Data Protection Inspectorate, or with your state Attorney General if you are a United States resident.