Privacy notice

Who we are

Haeven is operated from the Netherlands. We act as data controller for the personal data described below. For privacy questions or requests, email privacy@haeven.health.

What we collect on this site

• Contact form: your name, email, and message, so we can reply to you.
• Early access signups: your email and the page you signed up from.
• Anonymous interaction events: which buttons were clicked, which sections were viewed, language, and a short-lived session id stored in your browser. No cookies, no third-party trackers.
• Safety audit events: when our standing safety line was shown to you, and which red-flag patterns (if any) were triggered. No free-text content is stored from the demo.

What we do not collect

• No health data, no diagnostic data, no biometric data.
• No data about your child unless you choose to share it through the contact form.
• No advertising profiles. We do not sell or share personal data with advertisers.

Lawful basis

• Contact form & signups: your consent (Art. 6(1)(a) GDPR).
• Anonymous interaction events: our legitimate interest in improving the product, balanced against minimal data collection (Art. 6(1)(f)).
• Safety audit events: legal obligation to maintain a duty-of-care record (Art. 6(1)(c)).

Processors we use

• Lovable Cloud (hosting & database), EU region.
• Resend (transactional email).
• Lovable AI gateway (for future chat features, not used by the current public demo, which is a scripted animation). The gateway operates under contract and does not use Haeven conversations to train models.

Retention

• Contact submissions: 24 months, then deleted.
• Signups: until you unsubscribe.
• Anonymous events: rolling 12 months.
• Safety audit & escalation events: 5 years, for regulatory accountability.

Your rights

You have the right to access, rectify, delete, restrict, port, and object to processing of your data, and to complain to the Autoriteit Persoonsgegevens. Use our data rights form or email privacy@haeven.health. We respond within 30 days.