Trust and transparency
Privacy policy
How MERALVIA plans to process, protect and separate personal data.
Last updated:
Controller and contact
Controller: To be completed before public launch. Tax identification: To be completed before public launch. Address: To be completed before public launch. Privacy contact: privacidad@meralvia.com. These details and this policy require professional review before public launch.
Data and purposes
Accounts use a private email, protected credentials, status, role and session security data. Experiences may contain self-reported health data and remain separated from public identity, newsletter, votes and anti-abuse signals.
- Account: provide access, verify users and secure sessions.
- Experiences: receive and moderate submissions; anonymous text publication and aggregate use are separate choices.
- Newsletter: separate, voluntary marketing consent.
- Security: temporary HMAC signals; IP addresses are never public.
Legal bases and health data
The applicable basis depends on the purpose. Explicit, granular and versioned consent is requested for self-reported health data. Consent may be withdrawn without affecting earlier lawful processing. The final basis for account, security and legal duties requires professional review before launch.
Processors, transfers and retention
The project currently uses Neon PostgreSQL and has no production analytics, advertising or email provider. Processors, locations, transfer safeguards and contracts must be completed before launch. Unapproved legal retention periods remain unset.
United Kingdom scope
English-language availability does not by itself establish full UK compliance. Before actively targeting the UK, MERALVIA must confirm territorial scope, UK GDPR/DPA 2018 and PECR requirements, any representative obligation, transfer safeguards and the appropriate ICO-facing procedure.
Rights and withdrawal
You may request access, rectification, erasure, restriction, objection, portability or withdraw consent via privacidad@meralvia.com. MERALVIA will use proportionate identity checks and retain only necessary request evidence. EU residents may complain to their competent supervisory authority.
Publication and decisions
Free text is never published automatically. Only approved experiences with active purposes may feed public statistics. Private identity is never displayed and no automated medical decisions are made.