Evity Club AB is the data controller for all personal data processed through the Evity Club iOS application and the website at evityclub.com.
When you create an account we collect your email address and, optionally, your first name and organisation name. This data is used to authenticate you and provide the service.
We collect sleep, heart rate variability, and resting heart rate data from your connected wearable device. This data is used solely to calculate your Decision Readiness score and to generate usage patterns within the app. Providing this data is required to use the core features of the app. We collect it only with your explicit consent, which you provide during onboarding. You can withdraw this consent at any time in Settings, though doing so will prevent the app from calculating your score.
Biometric values are never included in error reports, analytics events, or any external service. Raw biometric values are never shared with third parties for advertising or any purpose other than providing the service.
Evity Club uses your biometric data to calculate a personalised Decision Readiness score. This is a form of automated profiling. It does not produce any legal effect or similarly significant consequence. It is a personal wellness indicator intended to help you make more informed decisions about your day.
Evity Club includes an optional peer benchmarking feature. If you choose to opt in, your aggregated readiness, sleep, and deep focus scores are included in anonymous comparisons with other opted-in users who share the same role and, if provided, the same biological sex. This feature is strictly opt-in and can be disabled at any time in the Insights tab.
To protect your privacy, no benchmark results are shown unless the cohort contains at least 20 opted-in users. Individual scores are never visible to other users. Only percentile rankings derived from aggregated data are returned to your device. Opting out removes your data from the comparison pool immediately.
The legal basis for this processing is your explicit consent. We process your role and biological sex for this purpose only when you have opted in.
If you join a team, your daily Decision Readiness score and deep work session hours contribute to aggregated team statistics. These aggregates are the only data visible to other team members: your individual score, biometric values, and identity are never exposed. Team aggregates include the team's average readiness score per day and total deep work hours by category. You can leave a team at any time in Settings, after which none of your data contributes to that team's statistics.
Your reflection journal entries and decision log entries are encrypted on your device before being sent to our servers. The encryption key is stored only in your device's secure keychain. Evity Club cannot read the content of your entries. We store only the encrypted data, the date of each entry, and a snapshot of your score for that day.
During your daily check-in you may choose to log stress level, alcohol consumption, hours worked, and deep focus hours. This data is user-entered, not collected from your wearable. It is stored on our servers, is not end-to-end encrypted, and is used solely to personalise your Decision Readiness score and generate insights within the app. Providing this data is entirely optional.
Notes you write during your weekly planning session are stored on our servers. They are not end-to-end encrypted.
We collect pseudonymised usage data to understand how the app is used and to improve it. Examples include which features you open and whether you complete your weekly planning. No biometric values are ever included. You are identified only by a random identifier that cannot be directly linked to your name or email. You can opt out of analytics collection at any time in Settings.
Our error monitoring service captures crash reports. All reports are scrubbed to remove biometric values before they leave your device. We do not send personally identifiable information in error reports.
Files stored locally on your device by Evity Club, including cached data and temporary files, are protected by iOS Data Protection. Those files are hardware-encrypted and inaccessible when your device is locked.
We process your data under the following legal bases:
When you connect a WHOOP device, you authorise Evity Club to read sleep, heart rate variability, and resting heart rate data from the WHOOP API. Your WHOOP credentials are never stored by Evity Club. We store only an access token in your device's secure keychain. If you disconnect your WHOOP or delete your account, we delete all daily metrics data sourced from WHOOP from our servers within 30 days. WHOOP's own privacy policy governs how WHOOP collects and processes data from your device: whoop.com/privacy. Evity Club is not affiliated with or endorsed by WHOOP.
When you connect an Oura Ring, you authorise Evity Club to read sleep, heart rate variability, and resting heart rate data from the Oura API. Your Oura credentials are never stored by Evity Club. We store only an access token in your device's secure keychain. If you disconnect your Oura Ring or delete your account, we delete all daily metrics data sourced from Oura from our servers within 30 days. Oura's own privacy policy governs how Oura collects and processes data from your device: ouraring.com/privacy-policy. Evity Club is not affiliated with or endorsed by Oura.
When you connect Apple Watch, you grant Evity Club permission to read sleep and heart rate data from Apple HealthKit on your device. HealthKit data is never used for advertising and is never sold. Apple's own privacy policy governs how HealthKit data is managed on your device: apple.com/legal/privacy. Evity Club is not affiliated with or endorsed by Apple.
Evity Club Teams is a voluntary wellness feature. Team members participate by connecting their own wearable device and choosing to join a team. No individual biometric data is ever shared with other team members or team creators. Only aggregated statistics, such as the team's average readiness score and total deep work hours by category, are visible at the team level.
When Evity Club Teams is used in an employment or organisational context, the team creator may qualify as a data controller under applicable data protection law, including the General Data Protection Regulation (GDPR), with respect to their team members' data, independently of Evity Club AB. Health and biometric data constitutes special category data under GDPR Article 9. Team creators who use Evity Club in an employment context are responsible for ensuring they have a valid legal basis for their team members' participation, including any necessary employee consents, works council approvals, or other authorisations required by law in their country.
Evity Club AB processes team data in aggregated form only and bears no responsibility for a team creator's compliance with applicable employment law, data protection law, or works council requirements in their jurisdiction.
We do not sell your personal data. We share it only with the following service providers, each bound by a data processing agreement:
We may also disclose personal data if required by law, court order, or to protect the legal rights and safety of Evity Club or its users.
Our primary database is hosted in Frankfurt, Germany, within the EU. Some third-party processors are based in the United States. Where we transfer data outside the EU we rely on the EU-US Data Privacy Framework or Standard Contractual Clauses (SCCs) approved by the European Commission, depending on which safeguard the processor participates in, to ensure adequate protection of your data.
We retain your data for as long as your account is active. On account deletion:
Some data may be retained longer where we have a legal obligation to do so, for example for accounting or tax purposes.
You can delete your account at any time from Settings, or by emailing [email protected].
Under GDPR you have the following rights regarding your personal data:
To exercise any of these rights, email [email protected]. We will respond within 30 days.
Evity Club is not intended for anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has created an account, please contact us and we will delete it promptly.
We may update this policy from time to time. When we make material changes, we will notify you by email or by a notice inside the app before the changes take effect. If any changes require your explicit consent under data protection law, for example changes to how we process your health data, we will ask for your consent at that time rather than relying on prior acceptance.