Ravo Privacy Policy

Approved by the product owner on 3 November 2026.

Version: 2026-11-03-v1 Effective date: 3 November 2026 Operator: Asare Labs Pty Ltd (ACN 703 317 739, ABN 46 703 317 739), Queensland, Australia

Current development build

Run settings controls optional GPS recording and access to nearby Bluetooth sensors. Location is recorded only during a run you start. The active-workout service continues the clock while the phone is locked and stops when the run ends. Connecting a sensor can read a current value to verify the connection; sensor summaries are saved with runs, not as an ongoing health log outside a run.

Saved run times, laps, GPS route points, available sensor summaries and your feedback stay on this device. An interrupted run can be recovered from its last local checkpoint, with the recording gap identified. Privacy & data exports saved runs and allows deletion of saved run data. Opening the default map requests map tiles from OpenStreetMap; those requests disclose your IP address and the map area being viewed to the tile provider. Android builds configured with Google Maps instead send map requests to Google through its Maps SDK. Saved route points can include GPS altitude and cumulative distance; saved runs can be used locally for comparison with a later run. No route is uploaded to Ravo's account services in this build.

The short version

Your training data says a lot about you: where you go, when you leave home, how your heart behaves and what hurts. We built Ravo on the belief that a coach should earn that trust, not assume it. Here is how we handle it, in plain English.

• We collect what coaching needs, and say why. Every data type in this policy is tied to a purpose you can see.
• Health data needs your yes. We ask before collecting health information, one category at a time, and you can change your mind whenever you like.
• Private by default. Your activities, routes and stats are not visible to other Ravo users unless you choose to share them. A small number of service providers help us run Ravo, and section 7 lists exactly who receives what.
• No selling. No ads. No brokers. We do not sell your personal information, do not show advertising based on it, and never give it to data brokers, insurers or employers.
• Saying no to AI costs you nothing. AI drafting and model improvement are both opt-in. We will never make either a condition of using Ravo, keeping your history or syncing your devices.
• You can take it with you or wipe it. Export your data in a machine-readable format, or delete your account from inside the app.
• Australian privacy law applies, including the Australian Privacy Principles. If you are not happy with how we handle a concern, you can complain to the Office of the Australian Information Commissioner.

The Ravo Promises

These ten promises shape every feature we build. If a feature ever conflicts with them, the promises win.

1. We never sell your personal information. Not to advertisers, not to data brokers, not to anyone.
2. Your health and location data is never used for advertising. Ravo does not run third-party advertising and contains no advertising SDKs.
3. Private by default. Your activities, routes, profile details and stats are not visible to other Ravo users unless you choose to share them. Service providers that help us run Ravo receive only what they need, as section 7 explains.
4. Every health permission is separate and optional. Heart rate, sleep, workouts, body measurements and other categories are asked for individually, and refusing one only switches off the feature that needs it.
5. Your home stays hidden. Privacy zones hide the start and finish of your runs near places you choose, before anything is shared.
6. AI is opt-in, and declining is free. Sending your information to an AI provider to draft explanations, and using your data to improve our models, each need a separate yes. Saying no never limits sync, history or core coaching.
7. Restricted data stays restricted. Data from connected services is used only as you allowed and as that service's rules allow. For example, Strava data is only shown to you, kept for no more than 7 days, never combined with your other Ravo data and never used with any AI.
8. Deleting means deleting. When you delete your account, your personal information is removed from our live systems within 30 days and from backups within 90 days, except for the limited records the law makes us keep.
9. A human is available. You can ask a person to review any automated decision that affects your account.
10. No surprises. If we change how we use your data in a meaningful way, we will tell you at least 30 days before and, where the change relies on consent, ask you again.

1. Who we are and what this policy covers

1.1 Ravo is provided by Asare Labs Pty Ltd (ACN 703 317 739), an Australian company ("Ravo", "we", "us", "our"). We are responsible for the personal information described in this policy.

1.2 This policy applies to the Ravo apps for iOS and Android, any Ravo web app, our websites, and related services (together, the "Services"). It explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have.

1.3 This policy is our "APP privacy policy" under the Privacy Act 1988 (Cth). Asare Labs Pty Ltd is covered by the Privacy Act because Ravo provides a health service (it helps you assess, maintain and improve your physical fitness) and holds health information. To remove any doubt, we have also opted in to the Privacy Act under section 6EA [opt-in to be lodged with the OAIC before launch]. This means the Australian Privacy Principles (APPs), the Notifiable Data Breaches scheme and the Information Commissioner's powers apply to how we handle your information.

1.4 Some terms we use:

• Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable.
• Health information includes information about your physical health, injuries, symptoms, body measurements and physiological readings such as heart rate. Under Australian law, health information is sensitive information and gets extra protection.
• Training data means workouts, routes, paces, splits, effort ratings, training plans and related records.
• Connected service means another app, platform or device you choose to link to Ravo, such as Apple Health, Health Connect, Samsung Health, Strava or a Bluetooth sensor.

2. The information we collect

We collect personal information in four ways: from you, from your training, from services you connect, and automatically when you use Ravo. We only collect what we reasonably need for the purposes in section 4.

2.1 Information you give us

2.2 Information from your training

When you record a run with Ravo, we collect:

• Location data (precise): GPS coordinates, route, elevation and speed, collected only while a workout is being recorded. We do not track your location in the background at other times.
• Performance data: distance, duration, pace, splits, cadence, laps, pauses and calculated estimates such as training load.
• Sensor data (sensitive): heart rate and related readings from a connected Bluetooth sensor or watch, if you connect one and give consent.
• Plan data: the workouts you were prescribed, the changes you made, and how each session compared to the plan.
• Calculated insights: your learned pace ranges and their confidence, readiness and load trends, and the reasons behind plan changes.

2.3 Information from services you connect

You choose whether to connect any service, and which data types to allow. Each connection can be revoked in Ravo or in the other service.

Apple Health and Health Connect data is subject to extra rules: we use it only to provide health and fitness features to you, we never use it for advertising or marketing, and we never sell it or disclose it to advertising platforms, data brokers or information resellers. We apply the same standard to health data from every other source.

2.4 Information collected automatically

• Device and app information: device model, operating system version, app version, language, time zone and a random installation identifier.
• Diagnostics: crash reports and performance data, such as which screen crashed and how long a sync took. Crash reports are designed not to contain your training data.
• Usage information (only if you opt in): which features are used and how often, so we can improve Ravo. This is off by default.
• Security information: sign-in times, IP address and approximate location derived from it, used to protect your account and detect abuse.

2.5 Information from other people

When community features are available, another member may invite you to a club or event, mention you, or report content involving you. We handle that information under this policy.

2.6 What we do not collect

To be clear, Ravo does not:

• access your contacts, microphone, messages or call history;
• use your device's advertising identifier or track you across other companies' apps and websites;
• collect your location when you are not recording a workout;
• receive your full payment card details (app stores process payments); or
• estimate body fat, muscle mass or body composition from photos.

3. Health information and your consent

3.1 We only collect health information with your consent, and only where it is reasonably necessary for a Ravo feature.

3.2 Consent is granular. We ask for each category separately, at the moment a feature needs it, and we explain why in plain language. No health category is pre-selected. You can say yes to heart rate and no to sleep, for example.

3.3 Consent is reversible. You can withdraw consent at any time in You → Privacy & data, or in your device settings. When you withdraw consent, we stop collecting that category. You can also choose to delete what we already hold for that category.

3.4 Saying no is safe. If you refuse or withdraw a health permission, only the feature that depends on it is affected. For example, without heart rate data Ravo guides your runs by effort and feel instead of heart rate zones.

3.5 Consent is separate from these terms. Agreeing to the Terms of Use does not mean you have agreed to share health information. Health consent, location permission, AI drafting, product analytics and research participation are all separate choices.

3.6 We tell you before we collect. We ask for your consent in the app before we first collect each health category, including pain and soreness ratings in post-run feedback and heart rate from a connected sensor or health platform. Each request includes a short notice explaining what we collect, why, who we disclose it to and where they are located. We keep a record of each consent and the version of the notice you saw.

4. How we use your information

We use personal information only for the purposes below, or for a related purpose you would reasonably expect, or as required or authorised by law.

5. Location and privacy zones

5.1 When we use location. Ravo uses precise location only while you are recording a workout, including when your screen is locked so the recording continues. Planning, browsing and event search work without location access; you can type a place instead.

5.2 Privacy zones. You can set privacy zones around places such as home or work. When you share an activity, the part of the route inside a zone is hidden from everyone except you. We recommend setting one up before sharing anything.

5.3 Private by default. Your activities, routes and stats are visible only to you unless you choose otherwise. When community features arrive, you will be able to choose who sees each activity, and joining a club will never publish your training history automatically.

5.4 Location is never sold and never used for advertising.

6. AI, automated processing and decisions

6.1 Ravo uses computer programs to coach you. We think you have a right to know how.

6.2 What is automated. The following happen automatically, using rules, statistics and in some cases AI models:

• Plan building and adaptation: a versioned training rules engine creates your plan and adjusts it using your baseline, completed runs, feedback, injuries and restrictions you have shared, and health data you allowed.
• Pace learning: statistical methods estimate your pace ranges from qualifying runs, and report how confident they are.
• Safety limits: rules may block, shorten or soften a plan when a goal is unsafe in the time available, a distance is unsupported, or you report pain.
• Explanations and summaries (optional): if you turn on AI drafting, AI models help draft plain-language explanations of your plan and progress. AI drafting does not decide your training limits. If you leave it off, Ravo uses standard written explanations.
• Integrity and safety checks: automated tools flag likely spam, abuse, fake activities and suspicious sign-ins for action or human review.

6.3 Decisions about you. Some decisions are made by Ravo's programs without a person involved, and section 6.6 lists them. Where Ravo changes, shortens or declines a plan, you can still edit or override individual workouts. Decisions to suspend or close an account are made or reviewed by a person. You can always ask for a human to review an automated decision by contacting support@asarelabs.com.au.

6.4 AI drafting is optional. Before we send any of your information to an AI provider, we ask for your permission in the app, separately from other choices. AI drafting is off until you turn it on. We name the provider and the country where it processes data. If you say no, Ravo shows standard written explanations and your plan is unaffected. If you say yes, we send only the minimum information needed for the task, under contracts that prohibit the provider from using it to train its own models and that limit how long it is kept. We never send Apple Health, Health Connect or Samsung Health data to an AI provider without that permission, and we never send Strava data or anything derived from it at all. You can turn AI drafting off at any time in Privacy & data.

6.5 Training our own models. We do not use your identifiable health or location information to train or evaluate models beyond your own coaching unless you opt in to research in Privacy & data. If you opt in, we de-identify data wherever possible and you can opt out at any time; opting out stops future use. Declining or opting out never limits your access to sync, history or core coaching.

6.6 Automated decisions (APP 1.7 to 1.9). The table below lists the kinds of decisions Ravo's computer programs make, or substantially and directly help to make, and the kinds of personal information they use.

6.7 Human review. People at Ravo do not routinely view your individual training or health data. Authorised staff may access it only when needed to help you at your request, to investigate a security or safety issue, or to meet a legal obligation, and that access is logged.

7. When we share information

7.1 People you choose. If you share an activity, join a club, post in a discussion or RSVP to an event, the information you share is visible to the audience you choose.

7.2 Connected services, at your direction. If you ask us to send data to a connected service (for example, writing a workout to Apple Health), we send it. Once received, that service handles the data under its own privacy policy.

7.3 Service providers. We use trusted providers to run Ravo, under contracts that require them to protect your information and use it only on our instructions. These include providers of:

• cloud hosting, databases and file storage;
• authentication and sign-in;
• email and push notification delivery;
• crash reporting and performance monitoring;
• AI model processing (see section 6.4);
• maps, geocoding and elevation data; and
• customer support tools.

The countries where our providers process information are listed in section 9. The names of our key providers and their roles are available on request.

7.4 Club organisers (later release). Organisers of clubs you join can see the information needed to run the club, such as your display name, membership status and RSVPs. They cannot see your private training, health data or routes.

7.5 Legal and safety reasons. We may disclose information where required or authorised by law, such as under a court order or a valid request from a law enforcement agency, or where we reasonably believe disclosure is necessary to prevent a serious threat to someone's life, health or safety. Where lawful, we will tell you about requests for your data and push back on requests that are overly broad.

7.6 Business changes. If Ravo is sold or merged, personal information may be transferred to the new owner, who must continue to honour this policy. We will tell you before your information becomes subject to a different privacy policy.

7.7 Aggregated and de-identified information. We may publish or share statistics that do not identify you, such as "Ravo runners completed 10,000 long runs in May". We take steps to ensure this information cannot reasonably be used to identify you, and we do not share de-identified location trails.

7.8 Never. We never sell your personal information, and we never share it with advertisers, data brokers, insurers, lenders or employers.

8. Cookies, analytics and tracking

8.1 In the app. The Ravo app contains no third-party advertising or cross-app tracking. Product analytics are off unless you turn them on. Diagnostics needed to keep the app working (such as crash reports) are on by default and can be turned off in Privacy & data.

8.2 On our websites. Our websites use only the cookies needed to make them work and, if you agree, privacy-friendly analytics. We do not use advertising cookies. We honour Global Privacy Control signals where they apply.

9. Where your information is stored

9.1 We store Ravo account and training data in Australia, in our cloud provider's Sydney region. At launch, the only other country where our service providers process personal information is the United States, for: sign-in with Google, Microsoft, Apple, Facebook or X (only if you choose that sign-in method); email delivery; crash reporting; map tiles from Mapbox (map requests reveal the area you are viewing, but not your account); and AI drafting (only if you turn it on). Connected services you choose, such as Apple Health, Samsung Health or Strava, handle data under their own policies. We will update this list and tell you before we disclose personal information to a service provider in any other country.

9.2 Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through contracts and security assessments. We remain accountable for how our service providers handle your information.

10. How we protect your information

10.1 We protect personal information with safeguards suited to its sensitivity, including:

• encryption in transit (TLS) and at rest;
• database access rules that limit each account to its own records, with server checks on every privileged operation;
• encrypted storage of connection tokens for services you link;
• multi-factor authentication and least-privilege access for staff and administrators, with access logging;
• security testing and prompt patching; and
• keeping as little data as we need, for as long as we need it.

10.2 If something goes wrong. No system is perfectly secure. If we suspect a data breach, we will assess it within 30 days. If it is an eligible data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as soon as practicable, explain what happened and tell you what you can do.

10.3 You can help by using a strong, unique password, keeping your devices updated and locked, and telling us quickly if you notice anything suspicious.

11. How long we keep information

We keep personal information only for as long as it is needed for the purposes in this policy, then delete or de-identify it.

12. Your choices and rights

12.1 You can do the following yourself in the app, under You → Privacy & data:

• See and export your data in a documented, machine-readable format, including workout files that other apps can open;
• Correct your profile, baseline, goals and run classifications;
• Delete individual workouts, health categories, feedback or your whole account;
• Withdraw consent for any health category, location, AI drafting, product analytics or research;
• Disconnect any connected service; and
• Change your sharing and notification settings.

12.2 Ask us directly. You can also ask us for access to, or correction of, any personal information we hold about you by contacting support@asarelabs.com.au. We will respond within 30 days. We do not charge for making a request. We may need to verify your identity first, to protect your data from someone pretending to be you. If we refuse a request, we will explain why in writing and tell you how to complain.

12.3 Anonymity. You can read our Terms and Privacy Policy without an account. An account is required to use the app. You may use a display name instead of your legal name, subject to the account information needed to provide the service.

12.4 Marketing is opt-in. We only send marketing messages if you ask for them, and every message includes an easy way to unsubscribe. Service messages about your account, security or changes to our terms or this policy are not marketing and you will still receive them.

13. Deleting your account

13.1 You can delete your account in the app at You → Privacy & data → Delete account, or by contacting us. If your sign-in provider is Apple, we also revoke Ravo's access to your Apple sign-in.

13.2 When you delete your account:

1. we ask you to confirm, offer you an export of your data, and remind you to cancel any app store subscription;
2. your account is deactivated straight away and you are signed out on all devices;
3. tokens for connected services are revoked, and data from those services is deleted;
4. your personal information is deleted or de-identified in our live systems within 30 days;
5. backups containing your data are overwritten within 90 days; and
6. we keep only the limited records described in section 11 that the law requires.

13.3 Content you shared with others, such as a comment in a club discussion, will be deleted or shown without your name, as you choose. If you own a club, you will need to transfer or close it first.

13.4 Deletion is permanent. We cannot restore a deleted account.

14. Children

14.1 Ravo is for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. If you believe a child is using Ravo, please contact us.

15. If you live outside Australia

15.1 Ravo is being prepared for launch in Australia first. If we offer Ravo in other countries, we will meet the privacy laws that apply there, and this section will be updated before launch in those countries.

15.2 European Economic Area, United Kingdom and Switzerland. If these laws apply to you, Asare Labs Pty Ltd is the controller of your personal data. We rely on: performance of our contract with you (to provide coaching and your account); your explicit consent (for health data, research and marketing); our legitimate interests (to keep Ravo secure, prevent abuse and improve the Services, balanced against your rights); and legal obligation (for records the law requires). You have the rights to access, rectify, erase, restrict, object to processing, data portability, and to withdraw consent, and to complain to your local data protection authority. We will appoint any required local representative before offering Ravo in these regions.

15.3 New Zealand. You have rights under the Privacy Act 2020 (NZ), including to request access to and correction of your information, and to complain to the Office of the Privacy Commissioner.

15.4 United States. If Ravo becomes available in the United States, we will publish any state-specific notices required, including consumer health data notices, before launch there. Our promises not to sell personal information or use it for targeted advertising apply everywhere.

16. Changes to this policy

16.1 We will update this policy as Ravo changes. For meaningful changes, we will notify you in the app or by email at least 30 days before they take effect, and summarise what changed. Where a change involves a new use of sensitive information that relies on consent, we will ask for your consent again rather than assume it. Previous versions are available on request.

17. Questions and complaints

17.1 Contact our Privacy Officer.

Privacy Officer, Asare Labs Pty Ltd (trading as Ravo) Email: support@asarelabs.com.au Post: Unit 1, 13 Madden Street, Collingwood Park QLD 4301, Australia Phone: +61 478 775 520

17.2 How we handle complaints. We will acknowledge your complaint within 5 business days, investigate it fairly, and give you a written response within 30 days. If we need more time, we will tell you why and when to expect an answer.

17.3 If you are not satisfied. You can complain to the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au Phone: 1300 363 992

The OAIC generally expects you to give us the chance to resolve your complaint first.

Your data. Your runs. Your call.