Privacy notice

What we hold

An account here consists of:

• Your e-mail address, a password hash, and an optional display name.
• The account of your symptoms in your own words, and the structured summary you confirmed.
• Your answers to the safety questions, and any medication you chose to enter.
• Your resonance profile, if you completed that optional step.
• If you asked for the optional astro glance: your date of birth, and — for a chart rather than a horoscope — your time and place of birth, the tradition you chose, the reading that came back, and the moment you agreed to it.
• Your orientation map, your practitioner suggestions, and any messages you send.
• Simulated payment records. No card details are captured anywhere: no payment provider is connected in this build.
• A reasoning trace for each analysis step: the text as it was sent for analysis, what came back, and what it cost. The stored prompt is the redacted version — the placeholders, not your name — and the trace is deleted with your case.

The waiting list

While ANOVENA is reserved for internal testing, you can join a waiting list from the front page. We store the e-mail address you give, your name if you add it, whether you joined as someone seeking care or as a practitioner, and when you agreed to be contacted. We use it for one thing only: to tell you when ANOVENA opens. To be taken off the list, write to info@anovena.com.

Where it runs

Data is stored in PostgreSQL hosted by Supabase in eu-central-1 (Frankfurt, Germany). The application runs on Vercel functions pinned to fra1 (Frankfurt). Both are processors and require data processing agreements before real patient data is accepted.

Every table has row-level security enabled with no policies, which means the credential shipped to your browser can read nothing at all. All access runs through server-side code that identifies you first and checks that a case is yours before returning it.

Analysis, and what a language model sees

Your account may be analysed to structure it and to build your orientation map. Before any text leaves this server for a model, names, e-mail addresses, telephone numbers, postal addresses, dates of birth, IBANs and insurance numbers are stripped out and replaced with placeholders. The model receives the clinical content and nothing that identifies you.

Only the count and kind of redacted items are recorded — never the values. Where no model is configured, the analysis runs entirely on this server with deterministic rules and your text is not transmitted anywhere.

We keep a record of each analysis step so that any result can be explained afterwards, and so that you can see it yourself: the reasoning panel in your case shows exactly what was sent and what came back. What is stored is the redacted text, which is what the model actually received.

Which model provider is in use, and whether it is contractually barred from training on the data, is an operational configuration. It is stated on the status indicator at the top of the patient view.

The astro glance, and the one transfer that leaves the EU

The astro glance is optional, has no medical meaning, and changes nothing about your case. Your orientation map, your safety check and your three suggestions are identical whether you complete it or skip it — the birth details are written to columns the matching logic never reads.

If you do complete it, your birth date, and for a chart also your birth time and place, are sent to astrologyapi.com to produce the reading. That provider is outside the EU. This is the only processing in the product that transfers your data to a third country, which is why it is asked for separately, at the moment it happens, rather than folded into the consent you gave when you registered. Nothing else about your case is sent: not your symptoms, not your summary, not your map.

The provider returns a health section with every daily horoscope. We remove it before it is stored, not merely before it is displayed, and we tell you on the page that something was removed and why. Astrology does not comment on your body here.

You can decline this step at any point, and declining is the default.

What we do not do

There is no advertising, no tracking, no profiling for marketing, and no sale or sharing of data with third parties for their own purposes. There are no analytics cookies — see the cookie notice.

Deletion

Deleting your account removes your login, your profile and every case, map, match, message and analysis record belonging to it. This is implemented and can be demonstrated.

One thing deliberately survives: the safety audit log. Its entries carry no foreign key to your case, so after deletion they record that a safety event occurred and when, while pointing at nothing that can be resolved back to a person. That is what allows the safety record to be auditable and your data to be genuinely erased at the same time.

Your rights

Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority. The mechanisms for exercising them in-product — a self-service export and deletion flow, and the consent centre with individually revocable consents — are v0.1 scope and are not built yet. Until they are, contact us directly.