Cravora Terms of Service

When you create a Cravora account, or use Cravora in any other way, you agree to these terms and to our Privacy Policy. If you do not agree with them, do not use the service.

We record each acceptance with a version identifier and the time you accepted. For the acceptance you give when you create your account, we also store the country we used to work out which version applied to you; an acceptance you give later, from inside the app, does not carry that country. Each of those later acceptances also writes an audit entry holding your IP address and your browser's user-agent string. And when you accept from inside the app, the version identifier we store is the one your app reports to us. It reports the version we told it was in force, but we do not check what it reports against the version in force before we store it.

The version in force can differ from one country to another, because parts of this agreement are shaped by local law. That is built but not used. Today the same version is in force in every country, and there is one set of terms for everyone rather than a version tailored to where you live.

When we put a newer version in force, the check that compares the version you accepted against the version in force, and the prompt to accept the newer one, run only in the web app. The iOS and Android apps do not run them. So if you use only the mobile app, you will not be stopped and you will not be asked again when we change these documents, and the app keeps working exactly as before on your older acceptance. Where these terms say the app stops you until you accept a new version, that describes the web app only.

We should be equally precise about the web prompt. It is a screen the web app puts in front of you, not a rule our servers apply: no request is refused because your acceptance is out of date, and if the check that raises the prompt fails to load, you are not prompted that time. The prompt itself has no decline button and no way to close it; the only ways past it are to accept or to leave the page. Leaving does not close your account, we do not record that you refused, and it does not affect your use of the iOS or Android app.

If an employer, insurer or other organisation gives you access to Cravora, that organisation has its own agreement with us. That agreement settles matters between them and us. These terms settle your own use of the service.

Cravora is a wellness and health-benefits platform. Depending on your plan and your country it can include an AI wellness coach, tracking for the health and activity data you enter, wearable and health-device data from services you connect, medication reminders and safety checks, insurance, claims and savings tools, benefits and provider discovery, wellness content and programmes, and a community side: groups, posts, comments, direct messages, teams, challenges and leaderboards. Not everything you put there reaches the same people, and the default is the widest setting. A post you make without choosing a group is addressed to nobody in particular: it goes to a feed that every signed-in Cravora member can read, with your name and profile picture beside it, whoever they work for. A post in a public group can be read the same way. A post inside a private group is seen by that group's members. We also attach the country and city held on your account to every post you make, and we use them to show your post to members in the same place; you do not type that location, we take it from your account. A post someone reports goes to our moderators with a copy of what it said. Where we offer a marketplace or telehealth, we introduce you to independent third parties rather than serving you ourselves.

Four things are worth knowing before you start, and each is set out in full further down. What you write to the coach is sent to an outside AI provider. Every message you send the coach is scanned for signs of a crisis, and when one matches we keep the whole message and our staff read it. Where a coach message reads as an immediate risk to your life, or where a blood-sugar or heart-rate reading posted to our health endpoints is critical — with no message from you at all — Cravora is built to send a text message to the emergency contacts you have saved. Text messaging is not switched on yet, so today no such text is sent and nobody outside Cravora is contacted; what follows describes it as it will work once it is. That message gives your first name and asks them to check on you; it carries no health detail. Unless you have ticked one of those contacts as primary yourself and given us a phone number for them, every contact you have saved is texted. A critical blood-sugar reading goes further than a single text. It also opens a record our staff read, holding the reading and its units, and unless the alarm is resolved we text that same first group again about fifteen minutes later and every contact you have saved about thirty minutes later. The section on the AI coach says how you can stop that, and which of the buttons we show actually stops it. A critical heart rate does none of that: it texts your contacts once, opens no record, and is not followed up. Be careful which readings that check covers, because it is narrower than it sounds. It runs only on readings posted to our health endpoints by an app signed in to your account, and nothing we ship posts a reading to them today. It does not run on the wearables and monitors you connect by signing in to the maker's account, such as Dexcom, FreeStyle Libre, Fitbit, Garmin, Oura or Withings. We store those readings, and we never check them against these thresholds. Nothing is watching them for you.

The fourth we have to state as an absence. Where we need to confirm who you are, an identity check would collect a photo of an official identity document and, in some cases, a photo of your face. It is not switched on. No screen in Cravora asks you for those photos today, and we have not built anything for our staff to review them with. We have written the wiring for Stripe Identity, Jumio and Onfido and have not turned any of it on, so no outside identity company receives anything from us. If we switch one on, we will name it here and ask you to accept the updated terms.

Cravora is not a healthcare provider, a medical practice, a hospital, an insurer, a pharmacy or an emergency service, and we do not practise medicine. Where we help you reach an independent provider, that provider is responsible for the care and advice they give. We are not.

Cravora does not give medical advice. It cannot diagnose you, it cannot treat you, and it cannot replace a clinician. Nothing you read or receive through Cravora is a diagnosis, a prescription or a treatment plan.

In an emergency, call your local emergency number or go to an emergency department. Cravora cannot dispatch emergency services and cannot reach a clinician for you. It does scan what you write to the coach for signs of a crisis, it flags a PHQ-9 questionnaire when you answer the ninth question, the self-harm one, with anything above zero, and it records a critical blood-sugar reading sent to our health endpoints. All three create a record our staff can read and review; the first two also show you crisis resources. For a coach message that record keeps the message you wrote, in full. For a flagged questionnaire it keeps your answer to that question, your total score and the severity label we gave it. For a blood-sugar reading it keeps the reading and its units.

For the most serious signals in what you write to the coach, it is built to send a text message to the emergency contacts you have saved in Cravora. Text messaging is not switched on yet: until it is, no text goes to your contacts, nobody outside Cravora is told, and you need to call for help yourself. A flagged assessment answer works differently: it goes to our staff for review only, and it never contacts anyone else.

A health reading can also reach your contacts on its own, with no message from you at all. A blood-sugar reading above 250 or below 70 mg per dL, or a heart rate above 120 or below 50, is treated as a critical alert and texts those same contacts. Be clear about which readings that covers. The check runs only on a reading posted straight to our health endpoints by an app signed in to your account. There are two such endpoints. Both check blood sugar; only one of them checks heart rate. The check does not run on the wearables and monitors you connect by signing in to the maker's account, such as Dexcom, FreeStyle Libre, Fitbit, Garmin, Oura or Withings. We never compare those readings to these thresholds, so disconnecting one of those devices stops nothing, because nothing was running on it. And nothing in the Cravora web or mobile app posts a reading to those two endpoints today. If you would rather no text ever went out, do not save emergency contacts. Until text messaging is switched on, no such text is sent.

A critical blood-sugar reading is followed up. It alerts you, it texts your contacts, and it opens a record our staff can read that holds the reading. Unless the alert is resolved we text your contacts again about fifteen minutes later, and every contact on your account about thirty minutes later; at the hour mark we alert you once more. A further blood-sugar reading of the same kind within the hour is normally folded into the alert that is already open: you see the new reading, but we do not text you about it, no second record is written and nobody else is contacted — and if that check cannot be run we start a second round rather than risk missing a real emergency. What resolves an alert is the action on it that says you are OK, and today that action works only on the Emergency Escalation entry in your notifications list in the web app; on the alert itself, and on the button on your phone's notification, it usually stops nothing and tells you nothing, so assume the later texts will go out. A critical heart rate is treated differently: it alerts you, it texts your contacts once, and it stops there, writing no record for our staff and sending no further text if that first text reaches nobody. A critical coach signal runs the same fifteen- and thirty-minute follow-up and opens the same kind of record, as the section on how the AI coach works sets out. Until text messaging is switched on, none of the texts in this paragraph is sent. Nobody is watching your account in real time, so please never treat any of this as a substitute for calling your emergency number.

Some screens show an emergency number for your country as a convenience, and it may not be current. After a coach message that reads as a crisis, Cravora shows you the emergency number, and a crisis line where we have a verified one, for the country saved on your account; if we hold no country for you, or have no verified number for it, it tells you to call your local emergency number instead. The crisis resources returned after a flagged questionnaire are still United States numbers, whatever country you are in. Use the number you know for the place you are actually in.

Talk to a doctor or another qualified health professional about any medical question, and before you start, stop or change any medicine, supplement, diet or exercise plan. Never delay or ignore professional advice because of something Cravora told you.

• The coach's answers are general wellness information, not clinical advice, and they can be wrong.
• Symptom and health tracking is for your own record keeping. It is not a diagnosis. The mental-health questionnaires work differently: when you finish a PHQ-9 or GAD-7 we add your answers up, turn the total into a severity label — minimal, mild, moderate or severe, and for the PHQ-9 also moderately severe — and store that label on your account beside your answers. If the total is 10 or more we store suggested next steps with it, such as discussing it with your healthcare provider. That label comes from the total alone. No clinician has looked at you to produce it, and it is not a diagnosis.
• Medication features are reminders, information and safety checks. Cravora does not prescribe, and nothing it shows you is a dose worked out for you. Some of what a safety check returns is written as a flat instruction all the same: "Start with lower doses" whenever we hold a date of birth putting you at 65 or over; "DO NOT take this medication" when your profile says you are pregnant or breastfeeding and your medicine matches a short fixed list of names built into the app; "DO NOT TAKE THIS MEDICATION" when it matches an allergy you have recorded as severe or life-threatening; and "Do not take this medication if you have..." when a condition you have recorded matches the medicine's own contraindication list. None of that is a dose or a decision we are making for you. Wherever you meet it, treat it as a prompt to speak to your doctor or pharmacist. The checks are also thinner than the word safety suggests. The age warning fires on your date of birth alone and says nothing about the particular medicine. The pregnancy and breastfeeding checks run only when your profile says you are pregnant or breastfeeding, and the lists they compare against are short — four names for pregnancy, sixteen for breastfeeding — so a medicine that is not on them gets the same general "verify this with your doctor" warning however risky it really is. And a quiet result is not a clearance. A medicine we cannot match to our own medication database is not checked for contraindications at all. The allergy check only knows the allergies you have typed in. The interaction check can only report a pair of drugs already loaded into our interaction table, which nothing in the app fills in. No warning means we found nothing, not that it is safe.
• Nothing in Cravora may be used to make a clinical decision, for yourself or for anyone else.

The wellness coach is an artificial intelligence system, not a human, and the app tells you so on the coach screens. That stays true however conversational the replies feel. No person reads your conversation live. There are two exceptions, and both are set out below. A message that reads as a crisis is recorded in full and read by a person. And if you report a coach message to us, that message goes to a staff review queue with your name and email address beside it.

Your messages and the health profile the coach works from are sent to a third-party AI provider exactly as they are written. That profile can include your display name, or your email address if you have not set a name, along with your age, the country and region on your address, the conditions you have recorded, your goals, the medicines you have logged with their doses and how often you take them, your symptoms from the last thirty days with the severity you gave them, your appointments for the next thirty days with the name of the provider, your health score and the parts it is made of, but only while Health Insights is on under Privacy in your settings (while it is off, or if we cannot check the setting, the coach is told instead that no score is included and why, and is asked not to work one out), your steps, calories, distance, sleep and heart rate from any wearable you have connected, and the titles and categories of the benefits available to you. Each part of the health score that can be measured carries an up, stable or down marker, and a part that cannot is sent as not measured. We should be plain about that marker: we work it out from that part's current score, not from any change over time. We do not strip, mask or de-identify any of it before sending. Exactly one company writes the reply, either OpenAI or Anthropic, and never both: if both are configured and we have not named which of them to use, the coach stops rather than choosing, and you get an error instead of an answer. We do not currently set a no-training instruction on those requests, so what the provider does with them is governed by the provider's own terms. That company is not the only one that can receive coach text, so here is the rest of the path. If you switch Read aloud on, under Accessibility in your settings, each reply the coach writes is sent to ElevenLabs or Google Cloud Text-to-Speech to be read to you. Read aloud starts switched off, and while it is off nothing is sent to be spoken; with it on and neither of those configured, your own device speaks the reply and the text goes no further than our own servers. There is also a knowledge-base step on this path that would send your message to OpenAI a second time, to be turned into a numerical embedding, and send that embedding to a vector-database provider to search our own knowledge base. It does not run: neither vector-database client is installed in the product, so the step fails before your message is sent anywhere, and the coach answers without it. Please do not type anything into the coach that you would not want a processor to receive.

The coach writes its answers automatically. It can be confidently wrong, out of date, or simply wrong for you. Do not rely on it for a clinical decision.

How much you can use the coach depends on your plan. If your account is not on our premium tier or above, you get ten coach messages a day; the count resets at midnight UTC, and the eleventh is refused with a message telling you to upgrade. A message that reads as a crisis is never refused by that cap, because the check described next runs before it.

Every message you send the coach is checked against a list of crisis patterns before anything else happens to it. That check runs on our own servers and does not involve the AI provider, so it still works when the coach itself is unavailable.

When it matches, three things usually happen. You are shown emergency and crisis-support resources. The conversation is flagged. And we create a durable record that stores the message you wrote, in full and word for word, not a summary and not an excerpt of it. That record goes into a queue our staff work through, where it appears next to your name and email address, and every active administrator, other than you if you are one, is emailed and notified in the app that a review is waiting. If you send another message of the same kind within about fifteen minutes, we usually reuse the record already waiting rather than opening a second one, so our staff are not alerted again; you still get the resources. That reuse only happens where the earlier record is about the same kind of crisis, is still open, and was at least as serious as the new message.

Where the message reads as an immediate risk to your life, meaning it carries a plan, the means, the intent and a timeframe, we do more, and we never fold it into an earlier record: a message like that always opens a fresh record of its own, and that record always joins the staff queue. We alert you first, and the design sends a text message to the emergency contacts you have saved in Cravora. Text messaging is not switched on yet: until it is, no text goes to them and nobody outside Cravora is contacted. Here is how it will work once it is. Who receives that text matters, so here is the rule as it actually works. If you have ticked at least one contact as primary and that contact has a phone number, your primary contacts are the ones texted first. Nothing ticks that box on your behalf, so unless you have ticked it yourself, every contact you have saved is texted straight away. If the alarm is still unresolved we text that same first group again about fifteen minutes later, and every contact you have saved about thirty minutes later. At the hour mark, if it is still unresolved, we alert you once more and write a note on your own account recommending a manual review. Nothing routes that note to a member of staff, so no review follows from it. So a contact you save can hear from us more than once about a single alarm. You can stop the follow-ups, but only from one place. In your notifications list on the web, the entry headed Emergency Escalation carries a button saying you are OK, and pressing it there cancels every stage still to come. The same button sits on the Emergency Alert entry beside it and on the alert your phone shows; on those two the press is recorded on your account and does not stop the follow-ups. If the press on the Emergency Escalation entry does not reach us, the page says so; the button on your phone says nothing either way.

What we hold back on a repeat is the alerting, not the record. If an alert we sent about you for the same kind of crisis in the previous fifteen minutes actually reached somebody, we do not text your contacts or notify our staff again about the second message, although the fresh record is still written and still waits in the queue. A push notification or a text that reached only you, on your own phone, counts as reaching somebody. If the earlier alert got through to nobody at all, the whole sequence runs again. An alert about a different kind of crisis, a blood-sugar alert for example, never holds this one back.

A more general crisis message, including a broad medical-emergency phrase, goes to human review only and does not contact anyone else.

Nothing ages any of this out on a schedule. We keep your coach conversations, and the crisis records they produce, until you delete your account. The retention job that clears out old data covers behavioural analytics, notification delivery logs, audit logs, revoked consents and health journal entries, and none of its categories covers a coach conversation or a crisis record. Data Management in your settings shows a chat-history retention period. Whatever you set there does nothing today, because no deletion code reads it. You can delete a conversation yourself and that deletes its messages, but it does not delete a crisis record that conversation produced: the record keeps your message and only loses its link to the conversation.

This is a real monitoring and escalation process, not just a safety prompt, which is why we describe it in this much detail. One honest caveat about the outbound half: text messaging is not switched on yet, so no text is sent at all today; once it is, at best we can tell you a message was accepted for sending, never that anyone received it. When a dispatch reaches nobody we record that it reached nobody, rather than recording an escalation that did not happen, and the case stays in the staff queue. It is still not an emergency service: we cannot call an ambulance for you, nobody is watching your account around the clock, and a review may not be read for some time. In an emergency, call your local emergency number.

You must be at least 13 years old to have a Cravora account. We refuse accounts for children under 13, and if we learn we hold a younger child's data we delete it. We should be straight about how that works: nothing in Cravora looks for such an account on its own, so it depends on somebody telling us. That rule is about accounts. It does not cover family dependants: an adult with an account can add a dependant of any age, and we then store that child's name, relationship, date of birth and any benefit claim made for them. There is no control in the app that removes a dependant once they have been added. If you believe we hold data about a child under 13, email privacy@cravora.com.

If you are under 18, or under the digital-consent age where you live when that age is higher, a parent or guardian must consent before you use Cravora. Nobody can sign in to that account until they do. To send them the email we have to create the account first, so what you enter at sign-up, including your name, email address, date of birth and any phone number, is stored from the moment you submit the form, before anyone has approved it. If they never approve it, nothing deletes it on its own: the account and what you entered stay on file until you or they email privacy@cravora.com and ask us to remove them.

We email them a single-use verification link that expires after 72 hours, and we store only a hash of that link, never the link itself. What we do keep is the name and email address you give us for your parent or guardian: those stay on the consent record after the link has been used, as our record of who consented and when. We stamp that record with a one-year expiry, counted from when we send the link rather than from when they click it, and we look at that date in one place only, the step that switches a waiting account on. Nothing looks at it afterwards. We never ask a parent to renew, we send no reminder, and an account that is already running keeps running once the year is up.

We should be straight about the limits of the check itself. We do not verify that the address you give really belongs to a parent or guardian. When you give it at sign-up, the only tests we make are that it is a valid email address and that it is not the same address as your own, and whoever opens the link approves the account without proving who they are.

A parent or guardian can withdraw consent and ask us to close the account at any time by emailing privacy@cravora.com. There is no self-service control for withdrawing that consent in the app yet, so we handle those requests by hand.

Your account is personal. Use your own account, keep your password to yourself, and do not let anyone sign in as you. You are responsible for what happens under your account, and you should tell us straight away if you think someone else has got into it.

Cravora has a free plan, which stays free, and a paid plan, Premium, that you can buy on your own account. If an employer or another organisation gives you access to Cravora, that access is covered by its agreement with us and you are not charged for it; buying Premium yourself is separate, and works as this section describes.

Premium is billed monthly or annually through Stripe, our payment processor. The plan, the price and the billing period are shown at checkout before you pay, the price shown at checkout is the price you agree to, and those checkout terms form part of this agreement. Your card details go to Stripe, not to us. Stripe emails a receipt for every payment, including each renewal, to the email address on your account.

Premium has no free trial: it is paid from the first day, and the free plan stays free. It does come with a 14-day money-back guarantee, wherever you live. Within 14 days of your first Premium payment, the Cancel and refund button in your billing settings cancels the subscription at once, ends Premium, and refunds what you paid for it in full to the card you paid with. We count the 14 days from when that first payment reached us, and they do not start again if you subscribe a second time. If the button fails you within the 14 days, email privacy@cravora.com and we will refund you by hand. Our Refund and Cancellation Policy sets all of this out step by step.

A Premium subscription renews automatically at the end of each billing period, every month or every year, until you cancel, and you can cancel at any time in your billing settings. After the first 14 days, cancelling stops the next renewal: you keep Premium until the end of the period you have already paid for, and we do not refund the rest of that period unless you delete your account or the law where you live requires it. Until that date you can resume the subscription from the same screen. If a renewal payment fails and keeps failing, Premium ends and your account returns to the free plan. Deleting your account also stops your subscription from renewing, and once the account is erased we refund the unused part of the period you paid for, as the section on ending your account describes.

If you think you have been charged twice, or charged when you should not have been, email privacy@cravora.com and we will put it right, refunding any charge that should not have been made.

Nothing in this section takes away a right you have under the consumer law where you live, including any statutory right to withdraw from an online purchase. Where that law gives you more than this section does, the law applies.

Use Cravora lawfully, for your own wellbeing, and in a way that does not harm anyone else. You agree not to do any of the following.

If you break these rules we can restrict, suspend or close your account, and we report the matter to the authorities where the law requires it.

We can also take down something you posted. When a moderator removes a post or a comment of yours it stops being visible to everyone else, and we write you a notice — whatever your notification settings say — naming the kind of content that came down, the moderator’s reason if they gave one, and a link to contest it. That notice and that link live in the web app only: the mobile app has no notification list and no appeal screen, so from a phone use the web app, or email privacy@cravora.com. You can appeal once, and if a moderator agrees with you the post or comment goes back up. An appeal cannot put a coach or provider listing back — re-listing runs through our separate approval queue — and nothing in the app takes a group down at all, so a report about a group is a decision a moderator records rather than something the product carries out.

• Use Cravora for anything unlawful, fraudulent, harmful or infringing, or in breach of health, privacy or consumer law.
• Rely on Cravora for diagnosis, treatment or emergencies, or pass its output to someone else as medical advice.
• Enter another person's personal or health data without their authority.
• Upload content that is unlawful, defamatory, hateful or harmful.
• Reverse-engineer the service, scrape it, or extract data from it, including to train a competing model.
• Get around security, rate limits or access controls, or reach accounts and data that are not yours.
• Push the AI features into producing harmful, illegal or deceptive content, or into giving the clinical output they are built not to give.
• Resell, sublicense or commercially exploit Cravora unless we have agreed to it in writing.
• Overload, disrupt or interfere with the service or the systems behind it.

What you write, log and upload stays yours. To run the service we need your permission to store and process it, so you give us a worldwide, non-exclusive, royalty-free licence to host, process and use your content for one purpose: operating, securing and improving Cravora and providing it to you.

Research is separate and only happens if you say yes to it. During onboarding we ask whether your data may be used for anonymous research, and you can change that answer later — but not on every screen that offers the switch. The research switch on the health-tracking privacy screen does not work. It saves to that screen only and never touches the consent record our research queries actually read, so switching it off there withdraws nothing and switching it on there grants nothing. The research switch in the mobile app's settings, and the one on the privacy screen for your connected devices, do change that record. Until the third one is fixed, use one of those two, or email privacy@cravora.com and we will do it for you.

If you say yes, approved researchers can run queries that return group statistics only, never your name, your email address or any row of your data. Every group figure is capped at the number of members whose research consent is active, so a query can never report more people than have said yes. For a group of fewer than ten people we withhold the statistics: the mean age, the percentage breakdown, all of it. One number still leaves our servers, and that is the size of the group. Our own researcher screens do not display it, but it is in the query response, so a researcher reading that response directly can see that four people match a set of filters. They chose the filters, so that count is itself something about those four. The ten-person test is applied once, to the group as a whole; no individual figure inside a result is tested against it separately. Our own administrators can run these same queries without holding a research approval, because the admin role passes that gate on its own, and the consent cap and the ten-person rule bind them exactly as they bind an outside researcher. Today both the group size and the statistics are placeholders while the research warehouse is being built, and every result says so on its face.

Health data and other personal data are governed mainly by our Privacy Policy and by data-protection law, not by this licence. We do not sell your personal data, and we do not share it with anyone for cross-context behavioural advertising. We run no advertising pixel and no ad-network tracker of our own. Two caveats we would rather state than hide. The first is that where Google Analytics is configured, and once you have accepted analytics cookies, its tag loads and we send a few conversion-style events through it, such as a newsletter sign-up or a contact-form submission. Withdrawing consent does not unload that tag from a page you already have open. What it does stop is what we send through it: each of those events re-reads your cookie answer at the moment we send it, so a sign-up or contact-form submission you make after withdrawing analytics is not sent, in that tab or any other, and you do not have to reload the page. The second is that the app does not set Google's advertising signals either way: whether they are on is decided by the settings on our Google Analytics account rather than by anything in the product, so we cannot promise Google makes no advertising use of what that tag receives. The section on third-party services says what is sent.

Two things worth repeating. What you type into the coach is sent to a third-party AI provider exactly as you wrote it. And a message that reads as a crisis is stored in full and put in front of our staff to read. Read the section on how the AI coach works before you put something sensitive there.

If you send us feedback or an idea, we can use it without owing you anything for it.

Cravora, including its software, its content, its design, its trademarks and the Cravora name, belongs to us or to the people who licence it to us, and it is protected by intellectual-property law. That covers our own material and nothing else. The names and logos of the other companies these terms name — the payment, messaging, sign-in, analytics, AI, voice, calendar and device services listed in the section on third-party services — belong to them, not to us, and Cravora itself is built on top of dozens of third-party software packages, each used under its own licence. We claim none of that as ours.

We give you a limited, personal, non-transferable licence to use the service for what it is meant for, and we can revoke it. Anything we have not expressly granted, we keep. Do not use our name or our logo without our permission.

That reservation is about our material. It is not a restriction on the files the app builds out of your own records. Your JSON data export, the CSV summary and the report the app puts together for a doctor's appointment download to your own device, and they are yours to keep, print and hand to your doctor, your family or anyone else you choose. The personal licence above does not limit that.

This section is also not a claim over what the coach writes back to you. "Its content" above means the material we put into Cravora. These terms do not settle who owns the words an AI produces, and they do not decide it against you. What we can tell you is what happens to those replies. They are stored in your account, the app hands a conversation only to the account it belongs to, and they are erased with the rest of your data when your account is deleted. They are not in the self-service export, so email privacy@cravora.com if you want a copy. Two things carry a reply further, and both are set out elsewhere in these terms: if you switch Read aloud on and one of our voice providers is configured, the reply is sent to ElevenLabs or Google to be read to you, and if you report a reply to us, a copy of it goes to a staff review queue with your name and email address beside it.

Other people's rights matter here too. Do not post or upload anything you do not have the right to share. If you believe something on Cravora infringes your copyright or your trade mark, email privacy@cravora.com and tell us what the work is and where it appears. That address is the route to use: no report control in the app offers copyright or a trade mark as a reason. Reporting a post or a comment on the web files the report as “other” and carries nothing you have written about it. The mobile app, and the coach-reply report on the web, do ask you to pick a reason and do take a note in your own words that a person here reads — so a claim written there does reach someone, but nothing routes it as an infringement claim.

Cravora runs on other companies' services, and it can connect you to independent providers, coaches, insurers and pharmacies. Those third parties operate under their own terms and privacy policies. We are not responsible for what they do.

We do not endorse any particular provider, test or treatment, but there are two things we would rather state than let you assume otherwise. Our administrators can mark a supplemental insurance product as recommended: that puts it at the top of the supplemental marketplace, gives it a green Recommended badge, and lifts it in the personalised ordering you see. And we ship an endpoint, reachable by a signed-in account although no screen in the app calls it today, that ranks providers from health conditions and symptoms sent to it and returns a written reason for each one. Both are our own ranking, not clinical or financial advice, and neither is a judgement that the provider or the product is right for you.

The list below covers the third-party services involved in running Cravora. For each one we say what it actually receives today, and where a service is named but receives nothing, we say that rather than leave it out. Two names belong here that the list does not carry as entries of their own: Zocdoc and Doctolib, the outside booking platforms. Booking through them is not switched on. We have no credentials configured for either, so the endpoints that would search their listings, read their availability, book an appointment and fetch a confirmation never reach either company: a request to book is refused rather than answered, no booking is made, and neither company receives anything. Those endpoints are reachable by a signed-in account calling our API directly, and no screen in the app calls them. What the booking request accepts is your first and last name, your email address, your phone number, your date of birth, the reason you give for the visit, your insurance member number where you give one, and, for Doctolib, your social security number. Behind those endpoints there is no call to either company at all — the code that would make one has not been written — so nothing you send that way is passed on or kept. If we connect either platform we will say so here and update these terms first. Our full sub-processor register is still being completed, so this list is not yet exhaustive; we will publish every recipient here once that work is done.

One more thing about the list, because it changes what the entries mean. The written data-processing agreements and international-transfer clauses with these providers are still being put in place. Until each is signed, the terms governing a given provider are that provider's own published terms rather than a contract we have negotiated. If that matters to your decision to use Cravora, write to privacy@cravora.com and we will tell you where a specific provider stands.

• Stripe, for payments.
• Google reCAPTCHA, to check that a sign-up or a contact-form submission comes from a person. It is reCAPTCHA and nothing else. The sign-up form loads Google's script as soon as the form is shown, and the contact form loads it when you press send, so Google receives your IP address before your account exists. When we check a contact-form result we send Google your IP address again; the sign-up check sends Google only the token. We carry unused code for hCaptcha and Cloudflare Turnstile, but no form in the product selects either of them, so neither company receives anything today.
• Twilio or Amazon SNS, for text messages and one-time codes, including the messages we would send to your emergency contacts. Neither is switched on yet, so no text message is sent today.
• SendGrid, Amazon SES or Resend, for the emails we send you, such as verification and parental-consent links, security alerts, notifications, and any report you ask us to send.
• Mailchimp, when you enter your email address in one of the marketing sign-up forms on our public pages, and only where we have configured it. It receives your email address and the language you are browsing in; a name and a country can be sent as well, but no form in the app collects either. Where we ask you to confirm the sign-up from your inbox, nothing reaches Mailchimp until you click that link. Unsubscribing does not remove you from Mailchimp: we tell them to mark you unsubscribed, and they keep that record so a later import cannot make you mailable again. If you have a Cravora account and delete it, we also ask Mailchimp to erase the contact permanently.
• Firebase Cloud Messaging, which is Google, and Apple's Push Notification service, for push notifications to Android and iOS devices. We would rather tell you than let you assume otherwise: some of those notifications carry health information. A medication reminder puts the name of the medicine and the dose in the notification itself and in the data attached to it, and those reminders go out by push and in the app only, never by email — so push is the way that information leaves us.
• Google, Apple, Microsoft and Facebook are not sign-in providers for Cravora. Signing in with one of them is not offered: the endpoint that would start it refuses every request, and nothing in Cravora sends a sign-in token or a profile request to any of them, so none of them learns from a sign-in that you hold a Cravora account. Some of these companies do appear elsewhere in this list, for unrelated jobs such as the bot check, analytics and push notifications. Sign in with an email address and password, a magic link sent to your email, or your organisation's single sign-on. If we ever build social sign-in we will name the provider here and update these terms first.
• Sentry, for error reporting, for page-timing measurements and for session replay. The error reports your browser sends follow the Crash Reporting switch under Privacy in your settings, which starts on; your analytics answer does not affect them. That switch does not reach everything: your answer travels in a cookie we write when you sign in and clear when you sign out, so while you are signed out we report anyway, and errors raised by our own servers while handling your requests are sent whatever you chose. The page timings your browser sends need both: the switch on and analytics accepted. Session replay needs both as well, and nothing is recorded unless you have them. If you do, nothing is sent from a session in which nothing goes wrong — but once something does, the part held in memory is sent and the recording then continues and keeps being sent every few seconds for the rest of that session. Turning either one off stops the recorder; it discards what it was holding if nothing had gone wrong, and sends the last part if something had. Text on the screen is masked and images and video are blocked, but the recording of what you clicked and where you went is still sent.
• Datadog, for our application logs where we have configured it. Those logs carry things like your account id, your IP address and the request that failed. Passwords, tokens and other secrets are redacted before a log leaves us, and so are phone numbers and email addresses — but only where they sit in a field named for them. The check reads the name of the field, not the value inside it, and it never looks at the text of the log message. So an address written into a message, or into a field with some other name, reaches Datadog in the clear. One we know about: after five failed sign-in attempts we raise an alert, and the description on that alert carries the email address that was tried. We also carry unused code for LogRocket, a session-recording tool: its script is never loaded, and the code that would use it is only ever reached on our servers, where it can do nothing, so nothing about you reaches LogRocket and nothing is recording your browser on its behalf.
• PostHog and Google Analytics, for product analytics, and only once you have consented to analytics. Google Analytics is set to anonymise IP addresses. Nothing else about an event is anonymised: analytics events are recorded against your account, and your user id is sent to PostHog, so events there can be linked back to you. We do not send your user id to Google Analytics. The app does not set Google's advertising signals either way, so whether they are on is decided by the settings on our Google Analytics account rather than by anything in the product.
• Segment, where we have switched on event forwarding. It receives the same analytics events with your user id attached. That forwarding runs over events we have already stored, and it still does not read your cookie answer. Three limits now hold events back. Your searches are forwarded only while save search history is on in your privacy settings, and that switch also decides whether a search is recorded at all. If you have objected to our product analytics, nothing of yours is forwarded. And nothing recorded before we made this change is forwarded, for anyone. Separately, events we cannot tie to an account, including the ones left behind by an erased account, are dropped rather than sent under the name 'anonymous'. On a health product a search box is a health question, so we would rather be plain about that one: we no longer keep the words. A search we record now holds the number of results, the number of filters and a rough length for what you typed. Searches recorded before that change still hold the words, and anything Segment received before these limits existed is still there. Email privacy@cravora.com if you want your stored events excluded or removed.
• Our AI provider, either OpenAI or Anthropic. It receives what you write to the wellness coach, and it also receives health information from features that have nothing to do with the chat. The appointment-preparation tools — your questions for the doctor, your pre-visit checklist, your symptom summary, your action items and your post-visit notes — send between them your recent symptom logs with their severity and the notes you wrote on them, the medicines and doses on your list, the conditions recorded on your profile, your age, the provider's name, the notes you took at the appointment, and the opening of up to twenty of your recent health-journal entries. The analysis of a lab result or other medical document you upload sends the test values, dates, provider names and diagnosis codes we read out of it. The summary on your insights panel sends your high-priority insights and recommendations, your goals, and the correlations we found between your metrics. The AI-guided insurance enrolment recommendation sends the plans being compared together with the age, conditions, budget and priorities given for it. Of these, only the insights summary has a switch: it runs only while Health Insights is on under Privacy in your settings. The others have none. There is also a knowledge-base lookup on this path, and it does not run. We built a step that would turn your coach message into a numerical embedding — at OpenAI where OpenAI is the AI provider we have configured, on our own servers where it is Anthropic — and would send that embedding, not your words, to a vector-database provider, Pinecone or Weaviate, to search our own knowledge base. Neither vector-database client is installed in the running product, so the client cannot be built at all and the lookup fails before anything is sent. That is true in every deployment: setting a key or an address for either one would change nothing, because the package it needs is not there. Your coach message does not leave us a second time. No embedding of it reaches OpenAI, Pinecone or Weaviate today, and the coach answers without the knowledge base. If we install one of them, we will say so here and update these terms first.
• OpenAI, for turning a recording into text. This does not happen today: the coach's microphone button is broken and sends nothing, and the health-journal voice note is not wired to any transcription service — it fails before anything is sent, so no recording, transcript or summary of one is created or stored. The endpoint that would send a recording to OpenAI is reachable by a signed-in account, which is why OpenAI is named rather than left out.
• ElevenLabs or Google, for reading text aloud where you switch that on and one of them is configured. Otherwise your own device does it and no text leaves it.
• Identity checks, where we ask you to confirm who you are. The check collects a photo of an identity document, such as a passport, driving licence or national ID card, its number, and in some cases a photo of your face. It is not switched on: no screen in the app asks you for those images today, and we have not built a queue for our own staff to review them in. The endpoint that would record one is reachable by a signed-in account, which is why we describe it here rather than leave it out. Anything recorded that way — the document number and the links to the images — is stored by us, and no automatic deletion rule covers it, so it would stay until you asked us to remove it. We have built the wiring for Stripe Identity, Jumio and Onfido but have not switched any of them on: each of those paths writes a record in our own database instead of calling the vendor, so no outside identity vendor receives your images. If that changes we will name the vendor here and ask you to accept the updated terms.
• Video visits are not switched on and no video provider is integrated yet, so no company receives anything for a video call. If we turn them on, we will name the company that carries the call here, and update these terms, before you use it.
• The wearable and health-device services you choose to connect: Fitbit, Google Fit, Garmin, Oura, Whoop, Samsung Health, Withings, Apple Health, Polar, Suunto and Amazfit; the Dexcom and FreeStyle Libre glucose monitors; the Omron, Qardio and Withings blood-pressure monitors; the Kardia heart-rhythm monitor; and the Kinsa thermometer. Which of these you can connect depends on which vendors we have registered credentials for on this deployment: where we have not, the connection is refused rather than offered. Apple Health works differently — it grants access on your device rather than on our servers. Neither of those depends on your country or your plan.
• Google, Microsoft or Apple, if a calendar account is connected to Cravora. Nothing in the app offers that connection today: no screen starts it, and the endpoint that would is reachable only by calling our API directly. Completing it exchanges an authorisation code with the provider, so the provider learns an account has been linked to Cravora, and we keep the token it issues. Nothing is then read from or written to your calendar: the code that would read your events and write appointments back exists, but nothing in the product calls it. A connection that already exists is listed under Settings, Integrations, where you can switch it off. That switches off our side only — it does not delete the token we hold and it does not revoke the access you granted at Google, Microsoft or Apple, which you would need to revoke in your account with them. If we ever switch calendar reading and writing on, we will say so here and update these terms first. One thing does reach Google without any of that. After you book an appointment, the confirmation screen offers to add it to your calendar, and neither choice happens until you press it. One downloads a calendar file, which stays on your device and sends nothing. The other opens Google Calendar in a new tab carrying the appointment's start and end times, the type of appointment, and the name and street address of the place you are going — but not the reason you gave for the visit; the file you download carries that.
• Other outside services the app loads content from. When we show the QR code for your referral link, that link is sent to api.qrserver.com, an outside QR-code service, so it can draw the code. The QR button on the benefits comparison screen goes further: it opens that service in your own browser with the address of the page you are on inside the request, so the service receives that address and your IP address. Separately, when you switch the benefits screen to its map view, your browser loads Google's mapping script from maps.googleapis.com, so Google receives your IP address. Before that map draws, the app asks your browser for your exact location; your browser asks your permission first, and if you refuse, the map opens on a default view instead. Help articles and video tutorials can carry a video from YouTube or Vimeo, or a video file hosted somewhere else. Nothing is requested from any of them when the page opens: you see a still of our own naming the company, and only pressing play fetches the video and gives that company your IP address. We do not remember the press, so the next page starts the same way, and an address we do not recognise is left as a plain link rather than embedded. The pictures beside those videos, and on the resources and community-stories lists, are fetched by our own servers and passed on to you, so your browser never contacts whoever hosts them.

Where telehealth is available, Cravora introduces you to a clinician. That clinician is independent, and the relationship is between you and them. They are responsible for their advice, their diagnosis and their treatment. We are not, and we cannot review or second-guess their clinical judgement.

We do not check any clinician's licence against a medical register, a licensing board or the NPI registry. No such check exists in the product. When a clinician applies to us to be marked as verified, the only automatic test is that the licence number is the right shape for the country they name; an administrator here then approves or refuses the application by hand. We ask for a copy of the licence but do not require one, so an approval can rest on a licence number and an expiry date the clinician typed themselves. A listing we add to the directory ourselves goes live at once and can carry no licence number at all. Satisfy yourself about a clinician's credentials before you rely on them.

Nothing in the product checks where you are against where a clinician may practise. We store a licence state on a listing and nothing ever reads it. Whether a clinician may lawfully treat you where you are is for you and them to establish.

The introduction is not the whole of it. What you send a clinician through Cravora stays with us. A message you write to a provider is kept against your appointment record, and the words you write are encrypted at rest. The file is different: the name, type, size and web address of anything you attach are kept beside the message as ordinary database text. A store-and-forward visit — the concern you describe, the photos you upload, and the symptoms, duration, severity, medicines and allergies you list — is kept in the same appointment record, and that one is stored as ordinary database text rather than encrypted field by field.

Before you send any of it, know that nothing in Cravora delivers it. A clinician-side messages screen exists on the web and in the app, but it calls an address on our API that does not exist, so it never loads a message, and the reply it offers posts to that same missing address. No clinician can open a message you send them or a store-and-forward visit you submit, and none can reply. The message API accepts a category, and urgent is one of the values it takes. Sending it alerts nobody. Never use either for an emergency, or for a change in your condition. Contact the clinician directly, or call your local emergency number.

Nothing removes any of this on a schedule. The nightly clean-up job does not touch appointment records, so the concern, the photos and the messages stay until your account is erased.

No video platform is integrated yet, so video visits stay switched off. We will name the platform that carries the call, and update these terms, before we switch them on.

Health data gets the strongest protection we can give it. Where the law requires it, we ask for your explicit consent before we process health data, and you can withdraw that consent whenever you like. Withdrawing it does not undo processing that has already happened.

The AI coach is one exception, and it is not the only one. The coach has no consent record of its own to withdraw, so the only way to stop that processing is to stop using it; the one exception is your health score, which the coach is given only while Health Insights is on. The appointment-preparation tools work the same way and are wired into the app today: opening the preparation screen for an appointment sends your symptoms from the last thirty days and up to twenty of your health journal entries to our AI provider, with no switch to turn it off. Two further paths have no switch either, and we would rather name them than let you assume they are not there: an endpoint that sends a lab result or medical document to our AI provider to be analysed, and an endpoint that sends the conditions and medicines in a health profile to get an AI-guided insurance enrolment recommendation. Nothing in the app calls either of those two today, and both are live. The AI summary on your insights panel does have a switch: it runs only while Health Insights is on under Privacy in your settings, and it starts off. This is what we have confirmed, and we do not claim it is the complete list.

We do not yet ask for a separate consent before health data crosses a border, and we would rather tell you than let you assume it. This is not only about the coach. There is one primary database serving every country, and every provider named in the section on third-party services processes your data wherever it operates, so your health data leaves your country whether or not you use the coach. Where a screen inside the app names a region as your storage location, it is describing an arrangement we have planned rather than where your data sits today. The coach is the sharpest case, and more than one company is on that path. What you write to it and the profile it reads go to our AI provider, which is likely to be outside your country. By default every message you send the coach also searches our own knowledge base, which sends the text of your message a second time, to OpenAI, to be turned into a numerical vector, and sends that vector on to our vector-database provider, Pinecone or Weaviate depending on which we have configured. That second pair runs where OpenAI is the AI provider we have configured; where it is not, that leg stays on our own servers. Neither of those two companies is named yet in the list of third-party services above.

You can export what we hold about you from inside the app, and we want to be precise about what that gets you. The JSON export covers a large part, but not all, of what we hold. It includes your profile, your wearable readings, your sleep sessions and workouts, your glucose, ECG, blood-pressure, stress and recovery readings, your body measurements, your medicines and medication logs, your symptom logs, your mood, pain, energy, nutrition, bowel, digestive, cycle, fertility, pregnancy, menopause, diabetes, asthma and blood-pressure logs, your custom metrics, the records of your health photos, your mental-health assessment answers, the side effects you reported, your health journal, the lifestyle answers you gave during onboarding, your appointments, your goals, habits and achievements, your insurance and benefits, your points and rewards, your consent history, your audit log, and the product-analytics events we have recorded against your account. It does not yet include several things you can put into the app: the image files of your health photos, your voice notes, your emergency contacts, your support tickets, or anything you posted in the community. Your coach conversations are not in it either; if you want those, email privacy@cravora.com and we will send them to you by hand. We are working on making the export cover everything we hold, and until it does, email that address for the rest.

The CSV option is a short summary rather than a copy of your data: your email address, your name, and a count of your wearable readings, medication logs, appointments, goals and habits. Choose JSON if you want the fuller of the two.

You can ask us to delete your account from inside the app, on the web and in the mobile app alike, without emailing anyone. Every delete button refuses to run until your email address is verified, so verify it first if you have not, and if you cannot receive mail at that address, email privacy@cravora.com and we will do it by hand.

The delete controls in the product do different things. From your own member account settings, deletion is scheduled and your data is erased thirty days later. Scheduling deletion signs you out straight away and no sign-in will re-admit the account, so the way to change your mind is not a button inside the app: at the moment we schedule the erasure we email you a single-use link that stops it, good for the whole thirty days, and opening that link and giving your account password calls it off. If it never arrived you can ask for another, from the page the link points at or from the sign-in screen, which tells you the date your account is due to be erased. You can also email privacy@cravora.com inside those thirty days and we will stop it by hand. The data settings inside the employer, provider, coach, partner, researcher and moderator portals work differently: the delete button there erases everything at once, including files you have uploaded, with no grace period and no way back. One consequence is worth knowing before you press either: if you created a community group, erasing your account deletes that group along with everyone's posts, comments, invitations and membership in it, and that cannot be undone. Some records survive either deletion. Your payment records do: we keep the amount, the currency, the status and the references Stripe gave us, for tax and accounting and to answer a late refund or chargeback. Deleting your account removes your account id from those rows, so nothing in Cravora ties them to you, but the Stripe references stay, so the row can still be matched to the transaction at Stripe. A suppression record survives too, where we hold one: if your address ever bounced, was reported as spam or was unsubscribed, we keep the address, that reason and what the mail provider told us about it, so erasing your account does not start the mail again. Anonymising your account instead of deleting it is not a control you can reach in the app, so email privacy@cravora.com and we will do it by hand.

We do not sell your personal data and we do not share it for cross-context behavioural advertising, with the one caveat set out in the sections on your content and on third-party services: the app does not set Google's advertising signals either way, so whether they are on is decided on our Google Analytics account rather than in the product. California-specific opt-out controls are not built into the product yet: there is no Global Privacy Control signal handling, no Do Not Sell or Share My Personal Information control and no Limit the Use of My Sensitive Personal Information control. Until there is, email privacy@cravora.com and we will handle the request by hand.

On security: Row-Level Security is switched on for effectively every table in our database, so an ordinary request can only reach the rows that belong to the person making it, and in production the application refuses to start against a database role that could bypass it, unless we deliberately set an override in our own deployment configuration. Named system work runs in a separate, marked service context that can read across accounts. That is not a short list. It covers the scheduled clean-up jobs, the staff queue that handles crisis escalations, a second staff queue that reads any coach answer you report along with your name and email address, our admin and moderator tools for account support, our admin analytics on revenue, retention and usage across all accounts, admin actions on an account's appointments or medications, the deletion and anonymisation jobs, the payment, device, messaging and sign-in flows, and the access you have granted to a coach, a clinician, a family member or an employer, along with a few hundred smaller pieces of plumbing such as counting how many people viewed a benefit. Every one of those frames is named in the code at the point where it runs, and every one of them can read rows that are not yours. We have also built support impersonation, which lets approving administrators open your account as you for a limited time, with your coach conversations, private messages and payment screens blocked. It is switched off by default, and we will tell you here if that changes.

Wearable connection tokens are encrypted at the application layer with AES-GCM, as are messages with providers and your two-factor secret. Backup recovery codes are not stored at all: we keep only a one-way hash of each, so nobody, ourselves included, can read them back. Other entries you write, including your health journal, symptom logs, medications and coach conversations, are stored as ordinary database columns protected by those access controls rather than by field-level encryption. No system is perfectly secure, and we will not tell you otherwise.

On how long we keep things: analytics events are deleted after 730 days, notification logs after 90 days, and a record that you withdrew consent is kept for about three years as proof that you did. Health records and audit logs have a six-year floor, because health-record and audit law requires one. That floor is not a deadline. Above it we keep your health journal for as long as you want it, which by default means indefinitely, as your own archive. The data settings offer you a shorter window, and you should know that choosing one changes nothing today: every finite option there is shorter than the six-year floor, and we have not built the step that would archive or anonymise a record once it passes that floor. You can correct a single health journal entry in the web app, and delete one on its own in either app; it is removed from the live service at once, though copies of it can stay in our database backups for as long as those backups are kept, and we have not yet set a limit on how long that is. Deleting your account removes them all. Audit logs are stripped of identifying detail after seven years. Your coach conversations have no retention rule at all, and no scheduled job removes them; the chat-history window in your data settings is connected to nothing, so setting it changes nothing either. The photos and document number from an identity check are not covered by any of these rules yet, so they stay until you ask us to remove them.

A daily job applies most of these limits automatically: the analytics, notification-log, consent-evidence and audit-log ones. It applies nothing to your health records — it counts them and holds them. It works in bounded batches, so a large backlog takes several nights to clear, and it has not yet run against production data. If you want data gone sooner, use the deletion tool in the app, remembering what each one does: from a member account it starts the thirty-day delay described above, and from a portal account it erases straight away.

As far as the law allows, Cravora is provided as it is and as available, with no warranties of any kind. We do not promise that it will be uninterrupted, error-free or secure, that the information in it is accurate, complete or current, or that it suits your particular situation. We do not promise any health, wellness, financial, savings or insurance outcome.

Our services come with guarantees that cannot be excluded under the Australian Consumer Law. Nothing in these terms excludes, restricts or modifies any right, remedy, guarantee, warranty or other term implied or imposed by law that cannot lawfully be excluded or limited. That holds for the whole of these terms, including the sections on the limits on what we owe you and on when you cover our costs.

Some countries do not allow the exclusions above. Nothing here removes a right you have under a law that cannot be contracted out of, including consumer guarantees in the EU, the UK and elsewhere.

As far as the law allows, we are not liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, lost data, lost goodwill or business losses, arising out of the service or out of anything the AI coach produced.

As far as the law allows, our total liability for all claims about the service is limited to what you have paid us for it in the twelve months before the claim.

Some liability cannot be limited, and we do not try to limit it: death or personal injury caused by our negligence, fraud or fraudulent misrepresentation, and any statutory consumer right that cannot be waived. If a sponsor pays for your access and you have paid us nothing, this section still does not take away the remedies the law where you live gives you. Like every section of these terms, this one is subject to the Australian Consumer Law statement in the section "The service comes as it is".

If you misuse Cravora, break these terms or the law, or infringe someone else's rights, and we face a claim or a cost because of it, you agree to cover our reasonable losses and legal fees.

This is aimed at misuse and at business and sponsor users. It does not apply where you are a consumer and the law where you live does not permit such an indemnity, and it never reduces a consumer protection that cannot be waived. Like every section of these terms, it is subject to the Australian Consumer Law statement in the section "The service comes as it is".

You can close your account from inside the app, on the web and in the mobile app alike, with one qualification we would rather state than let you discover: every delete button refuses to run until your email address is verified. If yours is not verified, verify it from the verify-email page in the app first, and if you cannot receive mail at that address, email privacy@cravora.com and we will close the account for you. If we refuse the request, the screen tells you so. If it goes through, the screen puts the erasure date in front of you, says whether we managed to email you the link that stops it, and signs you out when you acknowledge that.

What closing does depends on which account you close, and the section on health data, security and your control over it sets it out: from a member account it starts a thirty-day grace period before erasure, and from an employer, provider, coach, partner, researcher or moderator portal account it erases everything at once, with no grace period and no way back.

Be sure before you press the member one, and know how to undo it. The moment deletion is scheduled your account stops being active: you are signed out, and no sign-in route will let you back in, so the way back is not a button inside the app. It is a link. When we schedule the erasure we email you a single-use link that stops it, and it stays good for the whole thirty days: opening it and giving your account password calls the erasure off. If it never arrived you can ask for another, from the page the link points at or from the sign-in screen, which tells you the date your account is due to be erased. Stopping the erasure does not sign you in; you sign in again afterwards in the ordinary way. You can also email privacy@cravora.com inside those thirty days and we will stop it by hand. The erasure itself is carried out by a job that runs once a night, so it happens on the first night after the thirty days are up, and later than that if any part of it has to be retried.

There is a third button beside those two, Deactivate account, and it is not deletion: it switches your account off and keeps your data. It takes effect at once, ends every session, and while it is off you cannot sign in. Signing in will not switch it back on. If you had already added a backup email address and confirmed it, you can switch the account back on yourself, using the backup-email option on the forgotten-password screen. If you had not, email privacy@cravora.com and we will switch it back on for you. Deactivating stops your paid plans renewing first, in the way the next paragraph describes, and switching the account back on does not restart them: turn your Cravora subscription back on from your billing settings with Resume.

Closing your account stops your paid plans before anything else happens. When you press a delete button or Deactivate, we first tell Stripe to stop every recurring charge on your account. From a member account, deleting or deactivating sets a running plan to stop renewing, so it is not charged again and its paid period simply runs out, and cancels at once a plan with a payment outstanding, so Stripe stops trying to collect it. From a portal account, where deleting erases everything at once, every plan is cancelled outright. Either way, a checkout you started but did not finish is closed, so it cannot be completed later. The screen shows you what will happen to each plan before you confirm, and what did happen afterwards. If Stripe does not confirm all of that, nothing else happens: your account is not scheduled for deletion, deleted or switched off, you stay signed in, and the screen says so. Try again later, or email privacy@cravora.com and we will do it by hand. Stopping a scheduled deletion does not restart your plans either. Your Cravora subscription stays set to end until you press Resume in your billing settings; a paid coach engagement cannot be restarted from inside the app yet, so email privacy@cravora.com if you want to keep it. When the erasure itself runs, whether thirty days later for a member account or at once for a portal account or one we delete, anything still running is cancelled outright, and if Stripe does not confirm that, the erasure waits and is tried again rather than going ahead with a charge still live. After the erasure we refund the unused part of the paid period in which your access ended, counted from the day you asked us to delete the account, or the day we deleted it, whether or not the plan had run out in the meantime. A supplemental insurance premium you have already paid is not refunded this way; email privacy@cravora.com about it. We also remove your name, email address, phone number and address from your customer record at Stripe and take your saved cards off it. That refund and clean-up are retried every night until they succeed, and they never hold up the erasure. A payment that still goes through after you asked us to delete your account, such as a checkout finished in another tab, is refunded automatically. If a charge appears after that anyway, email privacy@cravora.com with the date and the amount.

We can suspend your access, and we can delete your account outright, if you seriously break these terms, if we have a legal, security or risk reason, or if the sponsor arrangement that funds your access comes to an end. A deletion we carry out is immediate: it does not use the thirty-day grace period. It runs the same erasure the app's own delete button runs, so the files you uploaded, such as health photos, insurance cards and documents, go with everything else. If any part of it fails, your account stays queued and the nightly job finishes what is left. Where it is fair and practical to do so, we will tell you first.

When access ends, the licence we gave you ends with it. The parts of this agreement meant to outlast it do so, including the permission you gave us over feedback, our intellectual property, the disclaimers, the liability limits, the indemnity, and the sections on which law applies and on resolving a disagreement.

What happens to your data afterwards is set out in our Privacy Policy. Some records outlast your account. Audit logs do: we keep them, with your account unlinked from them. Payment records do, kept anonymised for tax and to answer a late refund or chargeback. So does some of what you wrote on shared things and on other people's records. Most of it is removed with your account, but where someone else's record depends on it, such as a community challenge you created or content kept as the evidence for a moderation decision, we keep your words. And if we have ever had to stop mailing your address, because it bounced, was reported as spam or was unsubscribed, that record stays too, so erasing your account does not start the mail again. Your health records are not among the survivors. Deleting your account erases them, and the six-year medical-record floor described in our Privacy Policy governs our scheduled clean-up, not a deletion you ask for.

We can act at once, without warning you first, when we reasonably believe it is necessary to protect you, to protect someone else, to protect Cravora, or to comply with the law. That includes responding to a credible safety or crisis signal, in the way the section on how the AI coach works describes.

You should know how you will find out, because the product does not tell you. When we suspend your account under this section, it sends you nothing: no email, and no message in the app. If you are signed in at the time, you are signed out on every device, with no explanation. When you try to sign in again with your password, you are told only that your account is not active and to contact support. Sign in with a magic link instead and you are told only that you must be logged in, which says nothing about your account at all. None of it tells you that you were suspended, why, or that the address in this section is the one to write to.

While your account is suspended you cannot use anything that needs you to be signed in. That includes the export and the delete tools this agreement describes elsewhere as things you can do from inside the app, without emailing anyone. Until access is restored, the only way to get a copy of your data, or to have it deleted, is to email privacy@cravora.com.

We should also be straight about what a review of the decision has to work with. The tool our staff use to suspend an account does not ask them to record a reason, and no reason is stored on your account. What is written down is that your account was suspended, by whom, and when. So there is no written ground for a review to read.

A suspension does not expire on its own. Nothing lifts one automatically and nothing reviews it on a timetable, so it lasts until a member of our staff turns your account back on. We restore access where it is appropriate to do so, and you can ask us to look at the decision again by emailing privacy@cravora.com.

This agreement is governed by the law named in the company details at the top of these terms: the laws of New South Wales, Australia. Changing the governing law is a change to these terms, and we will ask you to accept it.

That choice never takes away the protection the law where you live gives you as a consumer. If you are a consumer, you keep the mandatory protections of the law where you live, and you can bring a claim in your local courts. Consumers in the EU, the EEA, the UK and India in particular do not give up their home protections by accepting this document. Local law that cannot be contracted out of wins over anything written here.

Talk to us first. Email privacy@cravora.com with what went wrong and give us 30 days to put it right. That is the address we ask you to use for a dispute. Writing to support@cravora.com, the general address published on our contact page, reaches us too and starts the same 30 days. So does the contact form on that page, and so does a support ticket or a support chat you open in the app. A ticket or a chat is stored on your account and our support staff can read it. Neither appears in the data export you can run in the app, and erasing your account takes both with it, so keep your own copy of anything you may need. This step is a request rather than a condition: nothing in this agreement makes writing to us first a precondition to a claim. Most disagreements end there, and it costs you nothing to try.

Send written notice of a dispute by one of the routes above, such as an e-mail to privacy@cravora.com or support@cravora.com, or by post to our registered address, which is in the company details at the top of these terms.

If you live in the United States, we intend to add an arbitration clause: individual arbitration under the Federal Arbitration Act, a waiver of class, collective, consolidated and representative claims, small-claims cases and claims for an injunction to protect intellectual property left outside it, and 30 days to opt out. That clause is not in force. We have not settled the arbitration body, the seat of the arbitration or the opt-out address, and until we publish those and ask you to accept updated terms, nothing in this document requires you to arbitrate and nothing in it gives up a class or representative claim. No opt-out window is running against you.

Arbitration and a class waiver do not apply where local law makes them unenforceable, and we will not attempt to enforce them there. Consumers in the EU, the EEA and the UK keep their local courts, their collective-redress rights, and the alternative and online dispute-resolution routes open to them. Consumers in India keep their rights and forums under the Consumer Protection Act, 2019. Consumers in Australia, where we are based, keep their rights and forums under the Australian Consumer Law. The same holds in Canada, Brazil and any other country whose consumer law voids clauses like these.

Where arbitration does not apply to you, disputes go to the courts of the country where you live, under the law described in the section on which law applies to this agreement.

We will change these terms as Cravora changes and as the parts still with counsel are settled. On the web, when a change is material we do not let it slip past you: the app compares the version you last accepted against the version in force for your country, and if yours is older it stops you and asks you to read and accept the new one before you carry on.

That check runs in the web app only. Our mobile apps do not re-prompt, and we do not email you about a revision, so if you use only the mobile app nothing in the product will tell you that a new version is in force. The date at the top of this page is the way to check.

When the prompt does appear there is no decline button and no way to dismiss it. It covers the whole web app behind it, including your privacy settings and the pages you would use to export or delete your data, so you cannot reach those pages without accepting. It is also a gate in the browser rather than a lock on your account: the page asks our server whether you are out of date after it loads, and if that request fails we let you carry on rather than shut you out. Nothing on our servers refuses work from an account whose acceptance is out of date. The same prompt shows a marketing-email checkbox. It always opens unticked, whatever your current setting is, and whatever you do with it there is not recorded, because only the two acceptances are sent.

We can set a different in-force version for a single country, which would re-prompt only the people in it. We have not done that: one version is in force everywhere today. The country we would compare against is the one recorded on your account, and we do not ask for it when you sign up — every new account starts as the United States until you set your country in the app.

We record which version you accepted and when. That record is a version label and a date, not a copy of the text you agreed to: only the current wording is published, and we keep no archive of older wording for you to compare against. Nothing in the app judges whether a change is material — it compares version labels and nothing else — so which changes trigger a fresh acceptance is a decision we make by hand each time. Smaller updates we do not treat as material take effect without a fresh acceptance where the law allows that.

We may also add, change, suspend or withdraw features, including free ones. Where the law requires notice of a materially adverse change to a paid feature, we give it.

Email privacy@cravora.com. That address covers everything: these terms, a dispute, your privacy, and a request to see, correct, export or delete what we hold, and it reaches the people who actually handle those requests. We also publish support@cravora.com on our contact page as our general address, and it reaches us too, so use whichever you prefer. The message form on that page reaches us as well: it sends what you write to our support inbox, and if the send fails it tells you so instead of thanking you. We do not offer support by telephone, and the support hours printed on that page are not hours you can reach anyone by phone. If you think someone else has got into your account, email us and say so in the subject line; we deal with those first.

We normally reply to the email address on your account, or in the app.

Our registered company name, company number and registered address are set out in the company details at the top of these terms. Where one of them is still marked as to be published, we have not published it yet, and we are not going to invent it. Two places in the product used to print invented details, and we would rather tell you than let you rely on them; both have been removed. Our contact page showed a postal address, 123 Healthcare Street in San Francisco, and a telephone number: both were placeholders left in the software, not ours, and post sent to that address would not have reached us. Our site also used to generate a second, separate privacy summary automatically at /api/gdpr/privacy-policy, and it printed invented details: it named "Cravora Inc." at "123 Main St, City, Country" as the data controller and gave example.com as the website of the supervisory authority you can complain to, and none of those three was real. The same address now serves the very privacy policy on this site, in a form software can read, and it invents nothing: it carries the same company details as the top of these terms, marking any that are still to be published, and it names no supervisory authority as ours to complain to. It does still carry the privacy policy's own sections, which describe the authorities you can go to in Europe, the United Kingdom and elsewhere. We have also not appointed the named contacts some regions expect, so there is currently no data protection officer, no EU representative, no UK representative and no India grievance officer. When any of them are appointed we will name them here. You can also complain to your local data-protection authority or consumer regulator. For a privacy complaint, outside India and Australia you do not have to contact us first; our Privacy Policy says what those two expect. Use the contact details the authority publishes itself; for a privacy complaint in Australia, that is the Office of the Australian Information Commissioner, at oaic.gov.au.