How Kova handles your data.

• ●Account. Email address, handled by Supabase Auth. Kova is passwordless: you sign in with Apple or a one-time link emailed to you.
• ●Profile. The treatment paths you tell us about (IVF, surrogacy, donor, etc.) and feature consents.
• ●Care data you choose to enter. Medications and dose logs, appointments, journal entries, insurance details and claims, cycle and embryo data, and doctor questions. Nothing here is automatic.
• ●Technical logs. Standard request logs (IP address, timestamp, page or endpoint, browser) generated by Supabase and Netlify to keep the service running.

• ●We do not sell or share your personal information for cross-context behavioral advertising. There is no opt-out link because there is no sale to opt out of.
• ●We do not use your data to train AI models.
• ●We do not share your information with third parties except the service providers listed below.
• ●We do not use your data for advertising.
• ●We do not knowingly collect data from anyone under 18.

• ●Supabase. Database, authentication, and file storage. Hosted on AWS in the United States with AES-256 encryption at rest.
• ●Netlify. Web hosting and CDN.
• ●Stripe. Payment processing for paid subscriptions when those become available. Card details go directly to Stripe; we never see or store them.

• ●Access. Most of your data is visible to you directly in the app. For a complete export, email us.
• ●Correction. Edit anything inside the app.
• ●Deletion. Open Settings and use Delete account. Removal is immediate and irreversible.
• ●Portability. Email us for a machine-readable copy.

California, Virginia, Colorado, Connecticut, Texas, Utah, and comparable state-law rights are all honored under this policy. EU and UK residents have the same access, correction, portability, and erasure rights under GDPR and UK GDPR.

Account and care data stay as long as your account is open. When you delete your account, active data is removed immediately and backups containing it are purged within 30 days. Technical logs roll off at 90 days. Anything we are required to keep by law (tax records, fraud-prevention records) is retained only for the period the law specifies.

Connections use TLS 1.2 or higher. Storage is encrypted at rest with AES-256. Row-level security policies in our database keep one user's data isolated from another. Multi-factor authentication is available on your account. No system is one hundred percent secure; if a breach affects your data we will notify you by email within 72 hours of discovery.

Kova is not directed to children under 18 and we do not knowingly collect their data. If you believe a minor has created an account, email hello@heykova.co and we will investigate and remove it.

For material changes we will post a notice at the top of this page and email active users at least 14 days before the changes take effect. The Last reviewed date above reflects the most recent update.

Kova is operated by Kindling Health LLC, a Colorado limited liability company. Questions about this policy or your data go to hello@heykova.co.

Kova is a wellness and organization tool. It helps you track and organize the medications, appointments, paperwork, and questions that come with fertility treatment. Kova does not diagnose, treat, or provide medical advice. Always follow the instructions from your clinic.