Evity Club AB is the controller of the personal data processed through the Evity Club app, the member dashboard at app.evityclub.com and the website evityclub.com.
We have not appointed a Data Protection Officer.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: email, name, role, organisation, profile photo, consent records. From Apple or Google if you sign in with them. | Your account and the service | Contract, Art. 6(1)(b) |
| Email and first name | One welcome email when you finish setting up the app, an email when your monthly report is ready (it names the month, never your data), and emails about your account | Contract, Art. 6(1)(b) |
| Email and first name, if you switch on the newsletter | News about Evity Club, new features and events. Switch it off in Settings or with the link in any newsletter. | Consent, Art. 6(1)(a) |
| Health data: sleep, heart rate variability and resting heart rate from Apple Health or your connected wearable; your readiness score; the check-in's rating, stress, alcohol and sick days | Calculating your readiness score and showing you your own patterns | Explicit consent, Art. 9(2)(a) |
| Reflections, decisions and deep work. The written text is encrypted on your phone with a key only your phone has, so we cannot read it. | Storing your entries for you | Contract, Art. 6(1)(b) |
| Team membership and your contribution to team averages | Team features (section 3) | Contract, Art. 6(1)(b), and explicit consent, Art. 9(2)(a) |
| Role and biological sex, if you switch on peer comparison | Comparing you with others in groups of at least 20 | Consent, Art. 6(1)(a) and 9(2)(a) |
| Your conversation with Steve and, once you have one, your monthly report's figures, if you switch Steve on | Answering you as a coach (section 4) | Explicit consent, Art. 6(1)(a) and 9(2)(a) |
| Your voice, if you talk with Steve | Turning what you say into text for Steve, and his answers into speech (section 4) | Explicit consent, Art. 6(1)(a) and 9(2)(a) |
| Your week, if you switch Steve on: the things you name for a week and what done looks like for each, times you tell Steve you are busy, your plan, your to-do list, and how long you slept each night | Planning your working week with Steve (section 4) | Explicit consent, Art. 6(1)(a) and 9(2)(a) |
| What you tell Steve about yourself, if you choose to: your usual working week, whether and when you train, what helps you recover, and what you want help with most | Fitting Steve's suggestions to you when he plans your week (section 4) | Explicit consent, Art. 6(1)(a) and 9(2)(a) |
| Steve's short summary of each brainstorm, if you let him remember them | Building on earlier brainstorms when you brainstorm with Steve (section 4) | Explicit consent, Art. 6(1)(a) and 9(2)(a) |
| Google Calendar, if you connect it: when you are busy (never what the meetings are), the events in the Evity Club calendar, and a sealed token for the link | Planning around your meetings and copying your plan to your calendar (section 5) | Consent, Art. 6(1)(a) |
| Usage events, if you switch on analytics | Improving the app | Consent, Art. 6(1)(a) |
| Which parts of Evity Club you used each week, for example the app, Your week or The Lab (never what you did in them). You can turn this off in Settings | Seeing which parts members use, to improve the service | Legitimate interests, Art. 6(1)(f) |
| Website visits, if you accept statistics cookies (see our Cookie Policy) | Understanding how the website is used | Consent, Art. 6(1)(a) |
| Error reports, with health values and your writing removed | Keeping the service working and secure | Legitimate interests, Art. 6(1)(f) |
| Payments and membership status | Selling and managing memberships | Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c), for accounting |
| Waitlist: name, email, and if given LinkedIn and company | Contacting you about membership | Steps before a contract, Art. 6(1)(b) |
| Contact details of people at firms that buy memberships | Running the agreement with the firm | Legitimate interests, Art. 6(1)(f) |
Account data is needed to use Evity Club, and health data is needed for the readiness score. Everything else is optional.
Profiling. Your readiness score is calculated automatically from your health data. It has no legal or similarly significant effect on you, and nobody else sees it.
A firm can pay for its people's memberships. Evity Club AB remains the controller. The firm does not receive your score, health data, check-ins or entries.
Members of your team see: who is in the team (name, role and join date), how many members have synced or checked in, and team averages. An average is shown only when at least five members are behind it. Everyone in the team, including admins, sees the same figures.
You can leave a team at any time, and a team admin can remove you. After that nothing new of yours is used. Team days already shown keep their averages. A membership paid for by the firm ends when you leave or are removed. You keep your account and your data.
Steve is an AI. He is off until you switch him on, in his tab in the app or on the dashboard, and you can switch him off there at any time.
What is sent. When Steve is on, each message you write is sent to Anthropic, the company that makes the AI model Claude, together with up to your last six exchanges with Steve and, once you have one, the figures of your monthly report (such as your readiness score for each day of that month, your sleep and your logged stress), so that Steve can answer. Anthropic processes this on our behalf in the United States.
Planning your week. On the Your week page Steve plans your working week with you. To do that he also receives the things you name for the week and what done looks like for each, how long you slept each night before each day (measured by your wearable or, for nights ahead, estimated), your estimated sleep need and recent sleep debt, the titles of your open to-dos, and, if you connect Google Calendar, the times you are busy, never what the meetings are. Evity Club keeps your plan for each week for 12 weeks, then deletes it. Anthropic deletes what it receives within 30 days, unless it is flagged under its usage policy.
What you tell Steve about yourself. If you choose to, you can answer a few questions for Steve on the Your week page: your usual working week, whether and when you train, what helps you recover, and what you want help with most. It has its own consent, given by ticking a box, and you can skip any question. Evity Club keeps your answers, and when Steve plans your week they are sent to Anthropic with your question. You can see, change or delete them under What Steve knows about you, in Settings on the Your week page. We delete them when Steve has not used them for 180 days, and with your account. You can also turn off any of Steve's recovery suggestions: that choice stays in Evity Club and is not sent to Anthropic.
Brainstorms. On the Your week page you can also brainstorm with Steve: he talks your week through with you, and nothing changes on your calendar. What you write is sent to Anthropic as when he plans your week. If you let him remember your brainstorms, which has its own consent, Evity Club keeps his short summary of each, in his own words, and sends the newest with your next brainstorm. You can see and delete each summary, or turn this off and delete them all, under What Steve remembers, in Settings on the Your week page. We delete a summary 180 days after it was last updated, and with your account.
Talking with Steve. If you choose to talk with Steve instead of typing, which has its own consent, your voice, his answers, your first name when he greets you and your internet address go to ElevenLabs, which turns speech into text and text into speech on our behalf in the United States. Evity Club keeps no recordings.
What is never sent. Your email address and your reflections and decisions; your name never goes to Anthropic.
What is kept. We do not store your conversations: the messages stay on your screen until you close the app or switch Steve off. The only exception is Steve's summaries of your brainstorms, if you let him remember them. We keep only a record that a message was sent, when, and whether it was answered, never its text, to apply the daily limit; it is part of your data export and is deleted with your account. Anthropic does not use your conversations to train its models and normally deletes them within 30 days.
What Steve is not. He coaches from what The Lab teaches and from your report. His answers are not medical advice and nobody else sees them.
You can connect Google Calendar on the Your week page. Evity Club then reads when you are busy in your main calendar (start and end times only, never titles, guests or places) for the week on screen and the week after, and writes the blocks you accept and the times you hold into a separate calendar called Evity Club, which it creates in your account. It never reads or changes any other calendar. Busy times are read when you open the page and are not stored; they are sent to Anthropic with your questions to Steve so he can plan around them. Evity Club stores a sealed token that lets it do this, until you disconnect or delete your account; disconnecting removes the Evity Club calendar and revokes the token. Evity Club's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell personal data. We share it with service providers that process it on our behalf under data processing agreements: database and hosting (Supabase, EU), email (Resend), website and dashboard hosting (Cloudflare), error monitoring (Sentry, EU), app analytics if you switch it on (PostHog, EU), website analytics if you accept cookies (Google Analytics), membership management (RevenueCat), payments (Stripe), if you switch Steve on, the AI behind him (Anthropic), and, if you talk with Steve, ElevenLabs. Apple and Google process data under their own terms when you use Apple Health, App Store purchases or their sign-in, and Google when you connect Google Calendar (section 5). We disclose data to authorities where the law requires it.
Your account, health data and entries are stored in the EU. Resend, Cloudflare, RevenueCat, Stripe and Google may process data in the United States, Anthropic does when you switch Steve on, and ElevenLabs when you talk with him. These transfers rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
You have the right to access, correct and delete your data, to data portability, to restrict processing and to object to processing based on legitimate interests. You can withdraw any consent at any time in the app, without affecting processing before the withdrawal. Most of this can be done in Settings, including downloading and deleting your data. For anything else, email [email protected].
You can complain to the Swedish Authority for Privacy Protection (IMY) at imy.se.