Who is responsible
Michael Waters, trading as Nivvi, United Kingdom. Contact [email protected]. A separate registered-business identity and postal service address have not been established for a commercial launch.
On your iPhone
Local monitoring needs no online account. The app stores profile name, date of birth, optional gender and avatar, heart-rate and oxygen readings where supported, connection and alert events, notes, alert settings and the selected Bluetooth identifier. Main history retains today and the previous 29 calendar days. Diagnostic captures from the first two minutes of a manual session are stored separately and are not automatically cleaned with that window.
There is no advertising SDK, analytics SDK, AI service or subscription billing in this build. Phone backups may include app data under your operating-system settings. Bluetooth and notification permissions are used only for connection, readings and alerts.
Family sharing test
When you enable sharing, the nearby iPhone sends the latest heart rate, supported oxygen value, timestamp, source description, connection status and alert state to the test server. Avatars, birth dates, notes and historical files are not included. The server stores email, a salted password hash, hashed session and invitation credentials, family label and membership. The latest snapshot overwrites the previous one and expires after 24 hours.
This is not end-to-end encryption. Someone with authorised administrative access to the host or database may access stored snapshots. Recipients may keep a screenshot. Stop sharing removes the hosted group and latest snapshot; delete online account removes that account. Local iPhone history is separate.
This website
These pages are hosted on Vercel and may process IP addresses and request metadata. Nivvi has not added forms, advertising, analytics scripts or tracking pixels. See Vercel’s privacy policy. Support email is hosted by Microsoft Outlook.
Children
Nivvi is used by adults and can contain a child’s personal and health information. Use a nickname where practical. Only enter information you have authority to manage. The in-app sharing acknowledgement is not a completed legal assessment of UK GDPR Article 6 and Article 9 processing for a public commercial service.
Your choices
You can edit the profile, change its avatar, stop a session, export history, delete history, stop sharing and delete an online account. To request access, correction or deletion of information handled by the operator, contact [email protected]. You can raise a concern with the UK Information Commissioner’s Office.