The short version
evolve is built so that we never see your health data. There’s no account and no evolve server. The app has no analytics, advertising or tracking code, and it makes no network requests of its own.
- Everything you enter — your profile, readings, ranges and reminders — is stored on your devices, and in your own iCloud if you use iCloud.
- Lab reports you import are read on your device. They’re never uploaded, and evolve keeps only the readings you confirm.
- We don’t sell or share personal information, and we don’t use it for advertising.
- You can export everything to PDF or CSV, and delete everything with one tap, at any time.
The only personal data we handle ourselves is what you choose to send us by email, basic technical data needed to run this website, and anonymous diagnostics that Apple shares with developers if you’ve allowed it. The rest of this policy explains each of these in detail.
Who we are
evolve is made by Lorenzo Salvalaio, an independent developer based in Milan, Italy (“we”, “us”). For the processing described in this policy that we decide on, we are the data controller under the EU and UK General Data Protection Regulation (GDPR).
- Controller
- Lorenzo Salvalaio
- Location
- Milan, Italy
- hello@getevolve.app
We’re not required to appoint a data protection officer. For anything about privacy, write to the address above.
What this policy covers
This policy applies to:
- the evolve app for iPhone and iPad, version 2.0 and later, available on the App Store;
- this website, getevolve.app, and any email you send us.
It doesn’t cover services provided by others, such as the App Store, iCloud or the websites that evolve links to. They have their own privacy policies, and we point to them where relevant.
What you keep in evolve
To do its job, evolve stores the following, entered by you:
- Your profile: a display name, your sex (used to pick the matching reference range) and your date of birth.
- Your readings: for each result, the biomarker, its value, unit and date.
- Your ranges: any reference range you’ve changed to match your laboratory.
- Your reminders: for each biomarker, the next date and how often it repeats.
- Your preferences: appearance, haptics, notification and Discreet Reminders settings, and whether the app lock is on.
Readings and the profile are health data — a “special category” of personal data under Article 9 of the GDPR. That’s exactly why evolve was designed so this data never reaches us. It’s stored and processed only on your devices and, if you use it, in your iCloud account. We have no copy and no way to access it.
evolve also ships with a catalog of more than 370 biomarkers, with descriptions and reference ranges from ABIM and Mayo Clinic Laboratories. That catalog is part of the app and contains no personal data.
Your data at a glance
| Data | Where it lives | Who can see it | How to delete it |
|---|---|---|---|
| Profile and readings | Your devices; your iCloud, if on | You. Never us. | Swipe to delete a reading, or Settings → Reset App for everything |
| Custom ranges | Your devices; your iCloud, if on | You | Settings → Reset Custom Range, or reset one from a marker’s ··· menu |
| Reminders | Your devices; your iCloud, if on | You | Turn it off from the marker’s ··· menu |
| Preferences | This device only | You | Change them in Settings, or delete the app |
| App lock on/off | This device’s Keychain only | You | Turn the lock off in Settings |
| Imported lab reports | Not kept — only the readings you confirm | You | Nothing to delete |
| PDF and CSV exports | A temporary file, until you’ve shared it | You, and whoever you share it with | Deleted automatically |
| Emails you send us | Our mailbox | Us | Ask us at hello@getevolve.app |
On your devices
evolve keeps its data in the app’s private storage on your iPhone or iPad, protected by iOS and iPadOS Data Protection: the database is encrypted with a key tied to your device passcode, so it can’t be read while the device is locked unless evolve already has it open.
The app runs in Apple’s app sandbox, so other apps can’t read its data. The app lock setting is kept in the device’s Keychain, marked so that it stays on that device and is never restored to another one.
iCloud sync
When you’re signed in to iCloud, evolve keeps your iPhone and iPad in step by storing your profile, readings, ranges and reminders in your private iCloud database, using Apple’s CloudKit. That database belongs to your Apple Account. It isn’t shared with other users, and we — the developer — can’t access its contents.
iCloud is provided to you by Apple under Apple’s own terms and Privacy Policy (opens in a new tab). Your data is encrypted in transit and at rest on Apple’s servers. With standard data protection, Apple holds the encryption keys; if you turn on Advanced Data Protection for iCloud (opens in a new tab), more of your iCloud data is end-to-end encrypted. See Apple’s iCloud data security overview (opens in a new tab) for the details.
To keep evolve on one device only, turn off iCloud for evolve in the Settings app, under your name → iCloud, where your device lists the apps using iCloud. To remove the iCloud copy, use Reset App (below) or manage iCloud storage in the Settings app.
iCloud uses Apple’s push notification service to tell your devices when there’s something new to sync. These silent notifications are sent by Apple, contain no health data, and are never shown to you.
Reading lab reports
When you import a PDF lab report — from Files, or by dropping it onto evolve on iPad — the app reads it entirely on your device:
- text is recognised with Apple’s on-device Vision framework;
- on devices where Apple Intelligence is available and turned on, evolve may use Apple’s on-device language model to help match results to biomarkers. It runs on the device; nothing is sent to Apple or to us;
- rows that look like identifiers rather than results — such as a patient ID, social security number, fiscal code or age — are left out.
You review every value before anything is saved. evolve stores only the readings you confirm — never the report itself. While you import, iOS gives evolve a temporary copy of the file, which the app doesn’t keep and the system clears from temporary storage.
App lock and Face ID
You can require Face ID, Touch ID or Optic ID — or your device passcode — to open evolve. Authentication is handled by iOS and iPadOS: evolve only learns whether it succeeded. Your biometric data never reaches the app, and never reaches us.
Reminders and notifications
evolve asks for permission to send notifications only when you set a reminder or turn notifications on. Reminders are local notifications: they’re scheduled by the app on your device, not sent from a server.
A reminder normally names the biomarker, for example “Time to Track Ferritin”. Turn on Discreet Reminders and it reads “Time to log a reading in evolve” instead, so nothing about your health shows on your lock screen.
To stop a reminder, turn it off from the marker’s ··· menu. To silence reminders already scheduled on a device, you can also turn off notifications for evolve in the Settings app, or delete the app.
Exporting and sharing
You can export your data at any time from Settings:
- PDF — your display name, sex, date of birth and every reading;
- CSV — every reading with its biomarker, sample type, value, unit, date, range and position against the range. No profile data.
Exports are created on your device and handed to the iOS share sheet; where they go next is up to you. The temporary file is protected, excluded from backups, and deleted once you’ve shared it. Once you send an export to someone else — your doctor, for example — its handling is up to them.
Restore from CSV reads a CSV file you pick, on your device, and adds its readings to evolve.
What we don’t do
- No account, sign-up or login.
- No evolve servers: the app doesn’t send your data anywhere except your own iCloud.
- No analytics, crash-reporting, advertising or other third-party SDKs in the app.
- No tracking, and no use of the advertising identifier. evolve never asks for App Tracking Transparency permission, because it has nothing to ask for.
- No selling, renting or sharing of personal information — with anyone, for any purpose.
- No reading from or writing to Apple Health.
- No access to your location, camera, photos, contacts, calendar, microphone or motion data.
- No profiling or automated decisions about you.
This matches evolve’s App Store privacy label — Data Not Collected — and the privacy manifest included in the app.
Diagnostics from Apple
If you’ve chosen to share analytics with app developers (Settings → Privacy & Security → Analytics & Improvements), Apple may give us crash reports and aggregated usage statistics for evolve through App Store Connect. Apple collects this data, not evolve; it doesn’t identify you to us and contains no health data. We use it only to find and fix problems. You can turn it off at any time in the same place.
Links to other websites
evolve shows where each reference range comes from and links to the source — the American Board of Internal Medicine (abim.org) or Mayo Clinic Laboratories documents hosted on Amazon Web Services. The app also links to this website and to the App Store. If you open a link, your browser connects to that site directly, and that site’s privacy policy applies. evolve doesn’t pass any of your data along.
This website
This website has no accounts, forms, cookies or advertising. It’s hosted by Vercel Inc., which processes technical data on our behalf to deliver the site and keep it secure:
- Server logs: like any web server, Vercel receives your IP address, browser and device type, the page requested and the time. They’re used to deliver pages and to prevent abuse, and kept only briefly.
- Vercel Web Analytics: counts page views, referring sites, and broad information such as country, browser and operating system. It uses no cookies and doesn’t store anything on your device; visitors are distinguished by a hash of the request that is discarded after 24 hours, so it can’t follow you across days or sites.
- Vercel Speed Insights: measures how quickly pages load (Core Web Vitals), with device and browser type, to help us keep the site fast.
Fonts are served from this site itself, so no request goes to Google or other font services. See Vercel’s Privacy Policy (opens in a new tab) and how Vercel Web Analytics handles privacy (opens in a new tab).
When you write to us
If you email us, we receive your email address, your name if you include it, your message and any attachments. We use them only to reply and follow up on your request — for example, to fix a problem you reported. Our email provider processes messages on our behalf.
Please don’t send lab reports or health results: we don’t need them to help you. If you do, we’ll use them only to answer your message and then delete them.
Legal bases for processing
Where the GDPR applies, we rely on the following legal bases for the data we handle ourselves:
| Purpose | Data | Legal basis |
|---|---|---|
| Delivering and securing this website | Server logs | Legitimate interests (Art. 6(1)(f)) — running a secure website |
| Understanding which pages are useful | Anonymous, cookieless analytics and performance data | Legitimate interests (Art. 6(1)(f)) |
| Answering your messages | Your email and what you tell us | Steps you ask us to take (Art. 6(1)(b)) and legitimate interests in supporting evolve (Art. 6(1)(f)). Any health information you volunteer: your explicit choice to send it (Art. 9(2)(a)) |
| Fixing crashes and bugs | Diagnostics shared by Apple | Legitimate interests (Art. 6(1)(f)), based on your choice in iOS settings |
The health data you keep in evolve isn’t on this list because we don’t process it: it stays on your devices and in your iCloud, under your control.
International transfers
We’re based in the European Union. Vercel is based in the United States and may process website data there. Vercel participates in the EU–U.S. Data Privacy Framework and its extensions for the UK and Switzerland, and its Data Processing Addendum includes the European Commission’s Standard Contractual Clauses. Apple’s handling of iCloud data is described in Apple’s Privacy Policy.
How long data is kept
- Data in evolve stays until you delete it. Reset App (Settings) deletes your profile, every reading, your custom ranges and your reminders, on this device and in iCloud — which means on all your devices. Deleting the app removes its data from that device; the iCloud copy remains until you use Reset App or remove it in iCloud storage settings.
- Emails are kept for as long as we need them to handle your request, and deleted within 24 months of our last exchange unless the law requires us to keep them longer.
- Website logs and analytics are kept by Vercel for the limited periods set out in its documentation. Analytics are aggregated and don’t identify you.
Your rights
Wherever you live, you control your evolve data directly in the app — no request needed:
| You want to… | In evolve |
|---|---|
| See or take a copy of your data | Settings → Export to PDF or Export to CSV |
| Correct something | Edit a reading with a swipe, or change your profile in Settings |
| Delete something, or everything | Swipe to delete a reading, or Settings → Reset App |
| Stop syncing to iCloud | Turn off iCloud for evolve in the Settings app |
Under the GDPR and UK GDPR
For the personal data we do handle — emails, website data and diagnostics — you have the right to access it, correct it, have it erased, restrict or object to its processing, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to hello@getevolve.app; we’ll answer within one month.
You also have the right to complain to a data protection authority — in Italy, the Garante per la protezione dei dati personali (opens in a new tab), or the authority where you live (opens in a new tab). We’d appreciate the chance to help first.
If you live in the United States
We don’t sell or share personal information, as those terms are defined by the California Consumer Privacy Act (as amended by the CPRA) and similar state laws, and we don’t use it for targeted advertising or profiling. The health data you keep in evolve stays on your devices and in your iCloud, so we don’t collect or process consumer health data as defined by laws such as Washington’s My Health My Data Act — except anything you choose to include in an email, which we use only to reply. In the past 12 months, the only personal information we’ve received is what’s described in “This website”, “When you write to us” and “Diagnostics from Apple”. You can ask to know, correct or delete it by emailing hello@getevolve.app; we won’t treat you differently for doing so. Global Privacy Control signals are respected — there is simply nothing to opt out of.
Children
evolve and this website are meant for adults and aren’t directed at children under 16. We don’t knowingly collect personal data from children. If you believe a child has sent us personal data, write to hello@getevolve.app and we’ll delete it.
Security
The strongest protection is not having your data in the first place: with no evolve server, there’s no central store of health data to breach. On your device, evolve relies on the app sandbox, Data Protection, an optional app lock and a device-only Keychain item. Temporary export files are excluded from backups and deleted after sharing. This website is served only over HTTPS, with strict security headers.
No system is perfectly secure, and the security of your data also depends on your device passcode and Apple Account. If you find a security issue, please tell us at hello@getevolve.app.
Not medical advice
evolve records values, dates and reference ranges; it doesn’t diagnose, treat or give medical advice, and it isn’t a medical device. Reference ranges vary between laboratories. Talk to a doctor before acting on any result.
Changes to this policy
If evolve starts handling data differently, we’ll update this policy before the change takes effect and change the date at the top. Significant changes will also be mentioned in the app’s release notes on the App Store.
History
- September 25, 2026 — New policy for evolve 2.0 and the new website, replacing the policy previously hosted on iubenda.
Contact
Questions about this policy or your data? Write to Lorenzo Salvalaio at hello@getevolve.app. You can also reach us through the contact page.
This policy is written to be read. If anything in it is unclear, tell us — that’s a bug we want to fix.