Privacy Policy

1. Who you are dealing with

Raven Fitness, Inc., doing business as Prova Health, is a technology and wellness membership company. We provide at-home blood testing, digital tools, and administrative services.

Medical care is provided by independent, third-party licensed physicians in Prova's telehealth network. Those clinicians make all clinical decisions, including whether to prescribe any treatment. Prova does not practice medicine, does not employ physicians, and does not control clinical judgment.

Because Prova and independent clinical partners play different roles, different privacy rules can apply to different records:

• Medical records created by independent telehealth clinicians and pharmacy records are maintained by those licensed providers and governed by their legal obligations, including HIPAA where applicable.
• Information Prova collects directly—such as account details, intake responses, lab history, device-linked data, and website/app usage—is governed by this policy and applicable federal and state privacy laws.

In practice, these records overlap. We describe the distinction so you know who to contact: for clinician-created medical records, contact the independent provider network; for account, membership, and product data, contact Prova.

2. What we collect

Information you give us

• Account details: your name, email address, phone number, date of birth, state, and payment/billing details.
• Intake information: goals, symptoms, menstrual and reproductive history, pregnancy status, medications, allergies, past conditions, and family history.
• Messages and updates: what you share through the platform, including side effects and care-related questions.
• Self-entered measurements: weight, blood pressure, sleep, cycle dates, and similar wellness data.

Information created by using Prova

• Lab information: panel results, collection dates, and trends over time.
• Care coordination information: whether an independent physician reviewed your file, treatment decisions, and follow-up testing cadence.
• Treatment fulfillment information: prescription status, refill activity, shipping updates, and outcome tracking you report.
• Payment information: our payment processor handles full card data; we receive limited details like card brand, last four digits, and expiration.

Information collected automatically

• Device and usage data: IP address, browser type, pages viewed, actions taken, and referral source.
• Cookies and similar technologies, described in section 8.

Information from other sources

• Accredited laboratories and phlebotomy partners that collect and process your bloodwork.
• Pharmacies that dispense prescribed treatments.
• Independent physicians and other clinical partners we work with.
• Wearables and health apps you choose to connect.
• Other providers, if you ask us to request or send records.

3. How we use information

We use information to:

• Create and manage your account and membership.
• Coordinate blood draws and present your biomarker results in the app.
• Share necessary information with independent telehealth physicians so they can evaluate you and make clinical decisions.
• Coordinate pharmacy fulfillment for treatments prescribed by independent clinicians.
• Process payments and prevent fraud.
• Provide customer support and service communications.
• Monitor platform quality and safety, including identifying results that may need prompt attention.
• Improve our products and develop models using de-identified data, as described in section 5.
• Send marketing messages where permitted, with unsubscribe options.
• Comply with legal obligations and enforce our terms.

4. Four things we do not do

These commitments are central to how we handle your information:

• We do not sell information that identifies you. Data we license commercially is de-identified first.
• We do not provide identifiable health data to pharmaceutical companies, data brokers, insurers, or employers, unless required by law.
• We do not place health data in advertising pixels or use it for cross-platform ad targeting.
• We do not use your data to make decisions about insurance, employment, housing, credit, or eligibility outside Prova.

If we ever propose changing these commitments, we will provide clear notice before the change takes effect.

5. Research, product development and de-identified data

This section explains how we use de-identified data for product development and research.

What we are trying to learn

Prova can connect longitudinal biomarker data with treatment pathways selected by independent clinicians and observed outcomes over time. This helps us evaluate which approaches appear to move specific markers for different populations.

De-identification

Before using data for these purposes, we de-identify it to standards described in 45 C.F.R. § 164.514(b). For longitudinal datasets, we may use Expert Determination by qualified statisticians to confirm re-identification risk is very small. We maintain supporting documentation and refresh determinations when datasets materially change.

What we do with de-identified information

We may use, analyze, retain, publish, license, and sell de-identified and aggregated information for lawful purposes, including:

• Improving Prova's product features and biomarker insights.
• Developing and testing statistical and machine learning models.
• Supporting wellness and clinical research, including with academic or clinical collaborators.
• Creating datasets, benchmarks, and reports for third parties, including life sciences and healthcare organizations.

In some cases, we share only aggregate outputs instead of row-level data, or let partners run approved analyses and receive summary results.

We may earn revenue from these activities. That revenue helps fund the platform and membership experience.

Everything we license or sell under this section is de-identified first. We rely on legal exclusions for de-identified data only where requirements are met, including reasonable safeguards and contractual restrictions on recipients.

Limits we accept

• We do not attempt to re-identify de-identified data, except to test our de-identification methods.
• We contractually prohibit recipients from re-identifying data or trying to contact individuals represented in it.
• We do not provide identifiable health information for these purposes.
• If we ever want to use identifiable information for separate research, we will obtain any consent or oversight required by law.

Your choice

You can ask us not to include your information in future research or model development, including in de-identified form, by emailing privacy@startprova.com. We will apply that choice going forward. It will not change your care access, membership status, or pricing. We cannot retract analyses already completed or de-identified datasets already shared.

6. Who we share information with

We disclose identifiable information only as needed to operate the service and as described below:

• Independent, third-party licensed physicians in Prova's telehealth network and affiliated clinical partners, so they can evaluate and treat you.
• CLIA-certified laboratories and phlebotomy partners.
• Licensed pharmacies and dispensing partners.
• Service providers that process data on our behalf, such as cloud hosting, messaging, support tools, analytics, payment processing, and shipping vendors.
• Other parties you direct us to share with, such as your local physician.
• Regulators, law enforcement, courts, or others when required by law or legal process, or to protect rights, safety, and security.
• A buyer, investor, or successor in a merger, financing, reorganization, acquisition, sale, or bankruptcy transaction, subject to applicable legal protections.

We also share de-identified and aggregated information as described in section 5.

7. How we protect information

We use administrative, technical, and physical safeguards designed to protect information. These include encryption in transit and at rest, access controls, monitoring, and vendor due diligence.

No method of storage or transmission is completely secure. If we learn of a breach involving your information, we will provide notices required by law.

8. Cookies, analytics and advertising

We use cookies and similar technologies to keep you signed in, remember preferences, improve site performance, and measure marketing effectiveness.

Consistent with section 4, we do not place health information in advertising tags or use health information for ad targeting across third-party platforms.

You can control cookies through browser settings. We honor legally recognized privacy preference signals where required.

9. Your rights and choices

Depending on where you live, you may have rights to:

• Access information we hold about you.
• Correct inaccurate information.
• Delete information, subject to legal exceptions.
• Receive a portable copy of certain information.
• Opt out of marketing messages.
• Object to or limit certain processing where available under law.
• Withdraw consent you previously provided.

Email privacy@startprova.com to make a request. We may verify your identity before acting, and we will respond within timelines required by law. If we deny a request, you may appeal as allowed by law.

California

California residents may have rights under the CCPA, including rights to know, access, delete, and correct personal information, plus rights related to sensitive personal information. We do not sell or share personal information as those terms are defined by the CCPA. De-identified information is not personal information under the CCPA.

Washington and Nevada

If you live in Washington or Nevada, our Consumer Health Data Privacy Policy provides additional disclosures and rights for consumer health data.

Other states

Residents of other states may have similar rights under applicable privacy laws, including access, deletion, correction, portability, and appeal rights.

10. How long we keep information

We keep information for as long as needed to provide the service, meet legal obligations, resolve disputes, and enforce agreements.

Independent telehealth clinicians and pharmacies keep medical records under their own legal retention requirements. When Prova no longer needs identifiable information, we delete it or de-identify it. De-identified information may be retained indefinitely as described in section 5.

11. Children

Prova is for adults age 18 and over. We do not knowingly collect personal information from children under 18. If you believe a child provided information, email privacy@startprova.com.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the date above and provide additional notice where required by law.

13. Contact us

Email privacy@startprova.com. For questions about records maintained by an independent clinician or pharmacy, email us and we will route your request to the appropriate partner.