Privacy, in plain words
Mental-health data is the most sensitive data a person has. Here we write what Bivela does with it — and where something is missing, we write that too.
In short
- The content of your health data is encrypted on your phone.
- The backup on the server is encrypted too, and its key is made only from your own password; we cannot read it.
- Every other destination — AI, research, a caregiver report and so on — is off by default and turns on only with your separate consent.
- Whenever you like, you can turn the backup off or erase everything.
What goes where
| What | On your phone | On our server | Any other destination |
|---|---|---|---|
| Mood and sleep logs, journal, thought records, safety plan, warning signs, medication and tests, questionnaires, goals, companion programs, your answers and exposure steps, conversations and profile | Encrypted (an SQLCipher database, the key in the device's secure hardware) | After sign-in, only an encrypted copy. On by default, can be turned off. | Nowhere, unless you separately consent. |
| Conversation text with the companion and the categories you allowed (for example a mood summary) | With the rest of your data | Passes through our server on its way to the AI provider; a short memory note is also kept, without end-to-end encryption, which you can see and erase | The AI provider — only with consent. This part has no end-to-end encryption. |
| Research scores | — | Without an account ID | Only with explicit consent for research mode. |
| If you turn on «Pseudonymous research»: each finished day's numbers — mean mood, energy, anxiety and sleep, the sleep diary, the daily rhythm, how many medicines were marked taken, the warning-signs level, counts of sessions and notes (not their text) and questionnaire scores | With the rest of your data | Under a random code, without an account ID; turning it off or «Delete all data» deletes the code and all its days | Researchers of Bivela's panel, as an Excel file; every download is logged. Off by default. |
| Caregiver reports: only the kinds you turned on, with your name, age, diagnosis type, medicines and therapist from your profile | — | Pass through our server, which keeps no report text; it keeps only the caregiver's Telegram chat id and the name Telegram gave | The Telegram chat of the caregiver you connected with a one-time link and confirmed; a message sent stays in their Telegram. Off by default. |
| Answers to your doctor's questionnaires and, if you turn it on, a daily mood and sleep summary (warning signs only with a separate yes) | With the rest of your data | Encrypted for that doctor; our server cannot read it and keeps it only until the doctor collects it | Only a doctor you linked with yourself, by code. |
| Usage counts and errors: how often each part of the app was opened, kinds of error, the app and phone versions | Until sent | With the account id and no content at all; on by default, switched off in «Privacy» and erased by «Delete all data» | — |
| If you turn on «Share with Bivela's clinical team»: your data key, sealed to the team's key | — | Until you turn it off; the server cannot open it | The admins of Bivela's panel, with the team's key in their own browser, can see everything you have synced, and every opening is logged. Off by default; turning it off in «Privacy» closes access at once. |
| Full crash log (text and details) | On the phone only | Never uploaded automatically; only the kind of error is counted above | — |
How the encryption works
When you sign in, the app builds an encryption key from your password on that same phone (Argon2id). Your data is encrypted with this key (AES-256-GCM) and only the encrypted bundle goes to the server. The key itself never leaves the phone.
It cuts both ways. The good: the server and its administrators cannot read your backup — journal, entries and notes (unless you turn on «Share with Bivela's clinical team»; below) — and someone who stole the server's database would get only encrypted data. The bad: if you lose your password, we cannot open the backup either. A code sent to your email lets you set a new password and get back into your account, but a backup encrypted with the old password does not open with the new one — except with your recovery code: a code the app shows you once and you keep. It opens the backup, and from then on the new password is enough. Lose both the password and the code, and no one can open the backup.
One technical point, stated plainly: the backup key is made from your account password, and the account password is sent to our server when you sign in — over an encrypted connection. The server does not store the password itself; it keeps only a scrambled (hashed) form for signing in. So this protection rests on two things: a strong password, and the server behaving honestly at the moment you sign in. Choose a password you do not use anywhere else.
Consent, category by category
The app knows 30 kinds of data and 7 destinations separately. You can say “send my mood summary to the companion, but not my journal” and the app does exactly that. The server checks independently and accepts nothing without a recorded consent. Withdrawing consent stops new sending on the phone at once, and the revocation is sent to the server.
The only destination that is on by default is the encrypted backup after sign-in — so that changing phones does not lose anything. You turn it off in settings and the phone remembers that choice.
AI: what goes and what does not
The companion is off by default. If you turn it on, the text you send and the categories you have separately allowed go from our server to an AI provider. To be able to answer, it has to see the text unencrypted; this is the only part of Bivela without end-to-end encryption.
The companion also keeps a short memory note on our server (up to 8 notes, without end-to-end encryption) so it can remember you in later conversations; you can see the list and erase it. And one limit you should know: we do not yet have written assurance about how long the AI provider keeps data. If that matters to you, do not turn the companion on — the app works fully without it.
What do we see?
Our admin panel sees account information and counts: each account's email, its consents, its last sign-in and activity, how many encrypted items it holds, and — unless you switched «Usage counts and errors» off — how often each part of the app was opened, which errors happened and which app and phone versions you have. It does not see the text of your journal, your questionnaire answers or your messages — except for someone who turned on «Share with Bivela's clinical team» in the app: then the admins, with the team's key in their own browser, can see everything that person has synced, and every opening is logged under their name; turned off, it no longer opens from that moment. Signing in to the panel requires two-step verification, and every administrator action is logged.
One exception you should know about: anyone who has an account's password can open its data — just as they could with the app itself. If a treatment center creates accounts for its patients, the center has those passwords and can see the data. For that reason our panel has a viewer that works only with the account's own password and inside the administrator's browser; the password and the content never reach the server, and every opening is recorded in the audit log. For an account whose password we do not have, we have no way to read it.
Pseudonymous research: if you turn it on, your daily numbers (never any text) go to the server under a random code. On arrival the server checks that they come from an account that consented, but it does not keep the account next to the days. Pseudonymous is not anonymous: the code is also on your phone and in your own encrypted backup, and a run of days together can say something about a person; that is why only the panel's researchers, signed in with two-step verification, can download it, and every download is logged under their name.
On the phone itself
- An app lock with a numeric PIN, fingerprint or the phone's own screen lock.
- Notifications carry no health details and are hidden on the lock screen by default.
- In the final build, screenshots and the “recent apps” preview are blocked.
- Android's automatic backup is off for sensitive data.
- The full crash log stays on the phone and is not sent automatically; «Usage counts and errors» sends counts only and is switched off in «Privacy».
- Health Connect (optional): only if you allow it, Bivela reads your sleep sessions (start and end times and the time awake) from Health Connect — only when you tap “Read” on the sleep screen — and saves the nights you choose in the encrypted sleep log. Nothing is written to Health Connect, the data is used for nothing else, and you can take the permission back at any time in Health Connect's settings.
Your data, your call
- Export: an encrypted copy with a password you choose.
- Erase: delete all data from the phone and from the server, including the companion's memory.
- Turn the backup off: Settings → Cloud sync.
Where it is kept
On a dedicated server that we run ourselves, not the cloud service of a large company. The database, authentication and the server-side logic are all there.
Limits you should know
- Bivela is in early access. An independent security audit has not been done yet.
- We do not yet have written evidence about data retention at the AI provider (see above).
- Password recovery with an emailed code only restores access to the account; a backup made with the old password does not open with the new one, except with the recovery code you made under Sync. Keep your password somewhere safe and make the recovery code.
- The backup key is made from your account password (see above); choose a strong password you do not use elsewhere.
- Changing the account password does not yet re-encrypt the cloud backup with a new key; if you change your password, you may need to enter the old one to open the backup on a new phone.
- Questionnaire scores are not clinically validated.
A question or a security report?
If you have found a security problem or have a privacy question, write to: