Privacy Policy

Last updated: 23 October 2026

1. Introduction and Scope

At Envol, we respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, protect, and share personal information when you visit https://envol.health (the “Website”), use the Envol mobile application (the “App”), participate in our programs or retreats, or otherwise interact with our services (collectively, the “Services”).

This Policy applies to personal data processed by Envol in connection with these Services.

For information about your rights and obligations when using our Services, please refer to our Terms & Conditions.

2. Who We Are

The controller responsible for the personal data covered by this Policy is:

Envol B.V.

  • Registered address: Weena 690, 3012 CN Rotterdam, the Netherlands
  • Chamber of Commerce (KvK): 78220661
  • VAT number: NL861307884B01
  • Email: contact@envol.app
  • Website: https://envol.health

For privacy-related questions or requests, you can contact us using the email address above.

3. Our commitment to your privacy

We believe that protecting your privacy is essential, particularly when you share information about your well-being or personal experiences.

Our approach is guided by the following principles:

  • We do not sell or rent your personal data.
  • We do not share your personal data with third parties for their own marketing purposes.
  • We collect and process personal data only for specified, legitimate purposes.
  • We aim to collect only the information necessary to provide and improve our Services.
  • We apply additional safeguards where personal information relates to health or other sensitive matters.
  • We use appropriate security measures to protect personal data against unauthorized access, loss, or misuse.
  • We respect your rights to access, correct, delete, or otherwise exercise control over your personal data in accordance with applicable law.

4. Personal Data We Collect

The information we collect depends on how you interact with Envol.

4.1 Account and Contact Information

When you create an account, contact us, or register for a Service, we may collect:

  • Your name and email address.
  • Your account credentials or authentication information.
  • Your country or region.
  • Information you provide in contact forms.
  • Communications exchanged with our team.

4.2 Purchase and Payment Information

When you purchase an access plan, program, retreat, or another Service, we may process:

  • Your name and contact details.
  • Billing information and applicable tax details.
  • Products or Services purchased.
  • Transaction dates, payment status, and order history.
  • Refund or cancellation requests.

Payments may be processed by authorized third-party providers.

Envol does not ordinarily need access to your complete payment card number when payments are handled by these providers.

4.3 App Usage and Preferences

When you use the App, we may process information related to:

  • Your account and access plan.
  • Audio experiences or features you select.
  • Your preferences and interactions with the App.
  • Technical information needed to operate and improve the App.
  • Information you voluntarily provide when using its features.

4.4 Symptoms and Health-Related Information

Certain Envol experiences are designed around users’ physical or emotional well-being.

When using features such as Press for Relief, you may choose to provide information about how you feel, including symptoms such as pain, fatigue, anxiety, stress, or difficulty sleeping.

When participating in programs such as Back to Health, you may also voluntarily provide information about your health, personal experiences, symptoms, or well-being through questionnaires, exercises, and communications.

Where this information relates to an identifiable individual, it may constitute health data under applicable data protection law.

Envol processes such information only where a valid legal basis and an applicable condition for processing sensitive personal data exist, with additional safeguards as required by law.

Where explicit consent is the applicable condition, Envol will request it separately and provide an appropriate way to withdraw that consent.

4.5 Retreat and Program Participation

If you register for a program or retreat, we may collect information necessary to organize your participation, including:

  • Registration and booking details.
  • Selected accommodation or participation options.
  • Scheduling and session information.
  • Dietary, mobility, or accessibility requirements voluntarily communicated by you.
  • Information necessary to prepare or deliver personalized content.

Health-related or other sensitive information will receive the additional protections required by law.

4.6 Technical and Website Data

When you visit our Website or use the App, certain technical information may be processed, including:

  • IP address.
  • Device type and operating system.
  • Browser information.
  • Website pages visited.
  • App or Website performance information.
  • Error reports and security logs.
  • Cookie or similar technology identifiers, where applicable.

4.7 Marketing and Communications Preferences

If you subscribe to our newsletter or agree to receive promotional communications, we may process your contact information, communication preferences, and relevant interactions with our messages.

You can unsubscribe from marketing emails using the link included in those communications.

5. Why We Process Your Data

We process personal data only for specified purposes and where an appropriate legal basis applies.

 

Purpose Legal basis
Creating accounts and providing purchased Services Performance of a contract
Managing orders, payments, bookings, and customer support Performance of a contract, or legitimate interests where appropriate
Meeting tax, accounting, and legal obligations Legal obligation
Maintaining security and preventing fraud Legitimate interests or legal obligation, as applicable
Improving the performance and reliability of our Services Legitimate interests, subject to applicable safeguards
Sending marketing communications Consent or another permitted basis under applicable marketing rules
Using optional analytics or advertising technologies Consent where legally required
Processing identifiable health-related information An applicable Article 6 GDPR legal basis together with an applicable Article 9 condition, such as explicit consent where appropriate

 

Where Envol relies on legitimate interests, we assess those interests against the rights and freedoms of the individuals concerned.

Where consent is required, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. How We Use Health-Related Information

Health-related information provided through Envol may be used, where legally permitted, to:

  • Make relevant audio experiences available based on a user’s selections.
  • Provide personalized elements of a program.
  • Prepare individual sessions or personalized materials.
  • Respond to requests for support.
  • Deliver the Service for which the information was provided.

Access to sensitive information is limited to authorized persons and service providers who need it for legitimate, defined purposes.

We do not sell, rent, or share personal health information with third parties for their own marketing purposes.

Where we use anonymous statistical information to understand or improve our Services, we take appropriate steps to prevent individuals from being identified.

7. Sharing Personal Data

Envol does not sell or rent personal data or share it with third parties for their own marketing purposes.

We may disclose personal data to trusted service providers only where necessary to operate and deliver our Services.

Depending on the Service, these may include providers involved in:

  • Website and App hosting.
  • Cloud storage and technical infrastructure.
  • Payment processing.
  • Email and customer communications.
  • Program and retreat administration.
  • Video conferencing and online sessions.
  • Website analytics, where applicable.
  • Security and technical support.

These providers may process the information necessary to perform their services for Envol.

We require service providers acting as processors on our behalf to protect personal data and process it only under appropriate contractual arrangements.

We may also disclose information where required by law or necessary to establish, exercise, or defend legal claims.

In the event of a merger, acquisition, or business transfer, personal data may be transferred in accordance with applicable law and appropriate safeguards.

8. Cookies, Analytics and Advertising

Our Website may use cookies or similar technologies for essential functionality, analytics, and marketing.

Essential technologies may be necessary for the Website to operate properly.

Optional analytics and advertising technologies are used in accordance with applicable consent requirements.

Where consent is required, users can accept, refuse, or adjust their preferences through the Website’s consent management system.

We do not use identifiable health-related information for targeted advertising.

For more information about the technologies used, their purposes, providers, and retention periods, please refer to our Cookie Policy.

9. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, or where retention is required by law.

Retention periods may differ depending on the category of information.

For example:

  • Account information may be retained while an account remains active, subject to applicable requirements.
  • Purchase and invoice records may need to be kept for statutory accounting or tax periods.
  • Customer support communications may be retained for a limited period to manage requests and disputes.
  • Program and retreat participation information may be retained for the time necessary to provide the Service and address legitimate follow-up needs.
  • Health-related information is retained only for a defined and justified period, with appropriate safeguards.
  • Marketing information may be retained until consent is withdrawn or the applicable retention period expires.

Where appropriate, information may be deleted or anonymized when no longer needed.

10. Data Security

We take appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, loss, or misuse.

These measures may include access controls, secure communications, appropriate authentication, restricted permissions, and contractual safeguards with service providers.

Access to personal data is limited according to operational needs and responsibilities.

No digital system can guarantee absolute security. However, we aim to maintain a level of protection appropriate to the nature and sensitivity of the information processed.

Where required by law, Envol will notify the relevant supervisory authority and affected individuals of personal data breaches.

11. International Data Transfers

Some service providers may process or access personal data outside the European Economic Area.

Where personal data is transferred internationally, Envol will ensure that an appropriate transfer mechanism and any required safeguards are in place.

Depending on the destination and circumstances, these may include an adequacy decision by the European Commission or approved contractual safeguards.

Further information about relevant transfers and safeguards can be requested using our contact details.

12. Your Rights Under GDPR

Subject to applicable legal conditions, you may have the right to:

  • Access: Request information about the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete information.
  • Erasure: Request deletion of your personal data.
  • Restriction: Request that certain processing activities be restricted.
  • Portability: Receive certain personal data in a structured, commonly used, machine-readable format.
  • Objection: Object to certain processing activities, including processing based on legitimate interests.
  • Withdrawal of consent: Withdraw consent where processing is based on consent.
  • Automated decision-making: Exercise applicable rights relating to qualifying solely automated decisions.

You also have the right to object to the use of your personal data for direct marketing.

To exercise your rights, please contact:

contact@envol.app

We may request reasonable information necessary to verify your identity, but will not routinely require copies of identification documents where a less intrusive verification method is sufficient.

We will respond within the periods required by applicable law, generally within one month, subject to permitted extensions.

You may also lodge a complaint with a competent data protection supervisory authority, including the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

13. Newsletter and Marketing Communications

You may choose to receive newsletters, announcements, educational content, or promotional communications from Envol.

Where required, we will request your consent before sending marketing messages.

You can unsubscribe at any time through the unsubscribe link provided in the email or by contacting us.

We may still send necessary transactional or service-related communications, such as purchase confirmations, important account notices, or information about Services you have booked.

14. Children’s Privacy

Envol’s Services are primarily intended for adults aged 18 or older.

We do not knowingly process children’s personal data in circumstances where doing so would be unlawful.

15. Third-Party Websites and Services

Our Website and App may contain links to external websites, platforms, or services operated by third parties.

These providers may process personal data under their own privacy policies.

We encourage users to review those policies when interacting with third-party services.

This does not affect Envol’s own responsibilities under applicable data protection law.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, data-processing practices, or legal requirements.

The most recent version will be published on our Website with an updated date.

Where required by law, we will provide additional notice or obtain renewed consent before making material changes to relevant processing activities.

17. Contact

For questions about this Privacy Policy, our data-processing practices, or your privacy rights, please contact:

Envol B.V.

Weena 690
3012 CN Rotterdam
The Netherlands

Email: contact@envol.app

Website: https://envol.health

Effective date: 23 October 2026