Privacy and data protection
Privacy and data protection
Privacy Policy
Privacy Policy
This policy explains how Pavelka Connect collects, uses, protects and deletes personal information, including information you choose to connect from Apple Health or Health Connect.
This policy explains how Pavelka Connect collects, uses, protects and deletes personal information, including information you choose to connect from Apple Health or Health Connect.
Effective: 28 August 2026
Effective: 28 August 2026
Applies to: Pavelka Connect mobile app and related services
Applies to: Pavelka Connect mobile app and related services
Your participation and health connection are voluntary
Your participation and health connection are voluntary
You can use Pavelka Connect without connecting Apple Health or Health Connect. Where manual entry is available, you can record relevant activity yourself. We do not sell health data or use it for advertising, insurance, credit or employment decisions.
You can use Pavelka Connect without connecting Apple Health or Health Connect. Where manual entry is available, you can record relevant activity yourself. We do not sell health data or use it for advertising, insurance, credit or employment decisions.
You choose whether to connect
Health access is requested only after you choose to connect and review the disclosure.
Health access is requested only after you choose to connect and review the disclosure.
You control permissions
You can manage or revoke platform permissions and disconnect your health source.
You can manage or revoke platform permissions and disconnect your health source.
Limited purpose
Connected activity is used to provide the challenges and progress features you selected.
Connected activity is used to provide the challenges and progress features you selected.
Deletion is available
You can disconnect health data or delete your Pavelka account and associated personal information.
You can disconnect health data or delete your Pavelka account and associated personal information.
Who we are
Who we are
Pavelka Connect is provided by Pavelka Ltd and its relevant affiliates (together, “Pavelka”, “we”, “us” or “our”). Pavelka provides workplace wellbeing programmes, challenges, learning experiences and digital resources to participating organisations and their authorised users.
For privacy questions, contact support@pavelka.global. Your participating organisation may also provide its own privacy contact or notice.
Pavelka Connect is provided by Pavelka Ltd and its relevant affiliates (together, “Pavelka”, “we”, “us” or “our”). Pavelka provides workplace wellbeing programmes, challenges, learning experiences and digital resources to participating organisations and their authorised users.
For privacy questions, contact support@pavelka.global. Your participating organisation may also provide its own privacy contact or notice.
Scope and privacy roles
Scope and privacy roles
This policy applies to the Pavelka Connect iOS and Android applications and the related Pavelka web and Webex experiences where they link to this policy.
Privacy roles depend on the context:
Your employer or participating organisation will normally decide why an employer-sponsored programme or challenge is offered. For that processing, the organisation is generally the controller and Pavelka processes information on its instructions.
Pavelka may act as controller for activities it determines itself, such as application security, service administration, support, legal compliance and management of Pavelka’s direct relationship with you.
Sahha Pty Ltd generally acts as Pavelka’s processor or service provider for the optional Apple Health and Health Connect integration, subject to the applicable agreement and privacy law.
Apple, Google and Cisco/Webex process information within their own platforms under their respective terms and privacy notices.
This policy applies to the Pavelka Connect iOS and Android applications and the related Pavelka web and Webex experiences where they link to this policy.
Privacy roles depend on the context:
Your employer or participating organisation will normally decide why an employer-sponsored programme or challenge is offered. For that processing, the organisation is generally the controller and Pavelka processes information on its instructions.
Pavelka may act as controller for activities it determines itself, such as application security, service administration, support, legal compliance and management of Pavelka’s direct relationship with you.
Sahha Pty Ltd generally acts as Pavelka’s processor or service provider for the optional Apple Health and Health Connect integration, subject to the applicable agreement and privacy law.
Apple, Google and Cisco/Webex process information within their own platforms under their respective terms and privacy notices.
Information we collect
Information we collect
Category
Category
Examples
Examples
Source
Source
Account and identity
Account and identity
Name, work email address, Pavelka user ID, Webex user or organisation ID, participating organisation and account status
Name, work email address, Pavelka user ID, Webex user or organisation ID, participating organisation and account status
You, your organisation and Webex authentication
You, your organisation and Webex authentication
Profile
Profile
Profile photo, country, timezone, language and preferences
Profile photo, country, timezone, language and preferences
You
You
Programme and challenge activity
Programme and challenge activity
Enrolment, participation, goals, completion, manually entered activity, challenge score, progress and leaderboard position
Enrolment, participation, goals, completion, manually entered activity, challenge score, progress and leaderboard position
Your use of Pavelka Connect
Your use of Pavelka Connect
Health and fitness
Health and fitness
The specific activity types you authorise, such as step count and active-minutes information where enabled
The specific activity types you authorise, such as step count and active-minutes information where enabled
Apple Health or Health Connect through Sahha
Apple Health or Health Connect through Sahha
Library and product use
Library and product use
Resources viewed, programme progress, app interactions and notification preferences
Resources viewed, programme progress, app interactions and notification preferences
Your use of Pavelka Connect
Your use of Pavelka Connect
Device and technical
Device and technical
App version, operating system, device type, push token, security events, crash and performance information
App version, operating system, device type, push token, security events, crash and performance information
Your device and our service providers
Your device and our service providers
Support
Support
Messages, contact details and information you provide when requesting help or exercising privacy rights
Messages, contact details and information you provide when requesting help or exercising privacy rights
You
You
We do not intentionally collect medical diagnoses, clinical health records, payment-card information or precise location through the current Pavelka Connect service.
We do not intentionally collect medical diagnoses, clinical health records, payment-card information or precise location through the current Pavelka Connect service.
How long do we keep your information?
How long do we keep your information?
Optional connection
Pavelka Connect uses technology supplied by Sahha Pty Ltd (“Sahha”) to facilitate the connection to Apple Health and Health Connect. We request only the activity categories needed for the feature shown to you. The operating system displays the permissions requested and lets you decide which categories to allow.
Pavelka Connect uses technology supplied by Sahha Pty Ltd (“Sahha”) to facilitate the connection to Apple Health and Health Connect. We request only the activity categories needed for the feature shown to you. The operating system displays the permissions requested and lets you decide which categories to allow.
If you connect a health source, Pavelka and Sahha may process:
a Pavelka-assigned user identifier;
the health platform and connection status;
the activity categories you explicitly authorise, such as steps and active minutes where enabled;
limited device and technical information required to operate, secure and troubleshoot the connection; and
challenge progress or other outputs calculated from permitted activity data.
Connected information is used to provide visible Pavelka features such as activity progress, challenge calculations and your selected wellbeing experience. It is not sold, shared with advertising networks or data brokers, or used to determine eligibility for employment, credit, lending, insurance, housing or benefits.
Connecting is optional. You can decline permission and continue using other available features, including programmes, the library and manual activity entry where supported. You can manage permissions in Apple Health or Health Connect and disconnect from Pavelka Connect.
For more information about Sahha’s processing, read the Sahha End User Privacy Policy.
If you connect a health source, Pavelka and Sahha may process:
a Pavelka-assigned user identifier;
the health platform and connection status;
the activity categories you explicitly authorise, such as steps and active minutes where enabled;
limited device and technical information required to operate, secure and troubleshoot the connection; and
challenge progress or other outputs calculated from permitted activity data.
Connected information is used to provide visible Pavelka features such as activity progress, challenge calculations and your selected wellbeing experience. It is not sold, shared with advertising networks or data brokers, or used to determine eligibility for employment, credit, lending, insurance, housing or benefits.
Connecting is optional. You can decline permission and continue using other available features, including programmes, the library and manual activity entry where supported. You can manage permissions in Apple Health or Health Connect and disconnect from Pavelka Connect.
For more information about Sahha’s processing, read the Sahha End User Privacy Policy.
Important
Revoking an operating-system permission stops future access but may not by itself remove data already transmitted. Use the disconnect or deletion controls in Pavelka Connect, or contact us, to request deletion of previously synced information.
How and why we use information
How and why we use information
Category
Category
Examples
Examples
Source
Source
Authenticate and provide access
Authenticate and provide access
Account, Webex identity and organisation information
Account, Webex identity and organisation information
Contract, client instructions and legitimate interests
Contract, client instructions and legitimate interests
Deliver programmes, challenges and the library
Deliver programmes, challenges and the library
Profile, enrolment, progress, content use and manual activity
Profile, enrolment, progress, content use and manual activity
Contract, client instructions and legitimate interests
Contract, client instructions and legitimate interests
Connect permitted activity data
Connect permitted activity data
Authorised health and activity data, connection status and derived progress
Authorised health and activity data, connection status and derived progress
Explicit consent where required
Explicit consent where required
Operate leaderboards and reporting
Operate leaderboards and reporting
Participation, score, ranking and aggregated programme metrics
Participation, score, ranking and aggregated programme metrics
Contract, client instructions and legitimate interests
Contract, client instructions and legitimate interests
Send service communications
Send service communications
Contact details, push token and relevant programme status
Contact details, push token and relevant programme status
Contract and legitimate interests; consent where required
Contract and legitimate interests; consent where required
Secure, troubleshoot and improve the service
Secure, troubleshoot and improve the service
Device, diagnostic, security and de-identified usage information
Device, diagnostic, security and de-identified usage information
Legitimate interests and legal obligations
Legitimate interests and legal obligations
Respond to requests and comply with law
Respond to requests and comply with law
Account, support, audit and legally required records
Account, support, audit and legally required records
Legal obligations and legitimate interests
Legal obligations and legitimate interests
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal.
What your participating organisation may see
What your participating organisation may see
Depending on the programme or challenge, authorised personnel at your participating organisation may see information necessary to administer the service, such as:
whether you enrolled or participated;
your challenge score, progress or leaderboard position where the feature is visible to participants;
programme completion information where clearly disclosed; and
aggregated or de-identified reporting about programme participation and outcomes.
Pavelka does not provide raw Apple Health or Health Connect records to your employer for employment evaluation or performance management. The relevant challenge screen or programme notice may provide additional details about what is visible and to whom.
Depending on the programme or challenge, authorised personnel at your participating organisation may see information necessary to administer the service, such as:
whether you enrolled or participated;
your challenge score, progress or leaderboard position where the feature is visible to participants;
programme completion information where clearly disclosed; and
aggregated or de-identified reporting about programme participation and outcomes.
Pavelka does not provide raw Apple Health or Health Connect records to your employer for employment evaluation or performance management. The relevant challenge screen or programme notice may provide additional details about what is visible and to whom.
When we share information
When we share information
We share personal information only where needed to provide the service, follow valid client instructions, comply with law, protect the service or act on your direction.
We share personal information only where needed to provide the service, follow valid client instructions, comply with law, protect the service or act on your direction.
Category
Category
Examples
Examples
Source
Source
Your participating organisation
Your participating organisation
Programme sponsor/controller; administration and reporting as described above
Programme sponsor/controller; administration and reporting as described above
Account, participation, progress, rankings and aggregated reports as applicable
Account, participation, progress, rankings and aggregated reports as applicable
Amazon Web Services
Amazon Web Services
Cloud hosting, storage, backup and encryption services in Frankfurt, Germany
Cloud hosting, storage, backup and encryption services in Frankfurt, Germany
Pavelka production application data
Pavelka production application data
Sahha Pty Ltd
Sahha Pty Ltd
Processor/service provider supporting Apple Health and Health Connect connections
Processor/service provider supporting Apple Health and Health Connect connections
Pavelka user identifier, authorised activity data, device/connection information and permitted outputs
Pavelka user identifier, authorised activity data, device/connection information and permitted outputs
Cisco/Webex
Cisco/Webex
Authentication provider and connected workplace platform
Authentication provider and connected workplace platform
Authentication and basic organisational identity information
Authentication and basic organisational identity information
Apple and Google
Apple and Google
Independent platform providers for device permissions, health data stores, app distribution and operating-system services
Independent platform providers for device permissions, health data stores, app distribution and operating-system services
Information processed within their respective ecosystems
Information processed within their respective ecosystems
Professional advisers and authorities
Professional advisers and authorities
Legal, audit, security, claims and lawful government requests
Legal, audit, security, claims and lawful government requests
Only information reasonably necessary for the applicable purpose
Only information reasonably necessary for the applicable purpose
We do not sell personal information or health data. We do not disclose connected health data to advertising networks, data brokers or third parties for cross-context behavioural advertising.
We do not sell personal information or health data. We do not disclose connected health data to advertising networks, data brokers or third parties for cross-context behavioural advertising.
Storage and international transfers
Storage and international transfers
Pavelka’s primary production application data is hosted in Amazon Web Services’ Frankfurt region in Germany. Pavelka uses encryption at rest and in transit and limits operational access according to role.
Limited remote access may occur from countries where authorised support, infrastructure and reporting personnel are located, including the United States, India, Singapore, Indonesia, Taiwan, the United Kingdom and Switzerland. Access is restricted using controls such as multi-factor authentication, role-based access, VPNs where applicable, logging and data minimisation.
Sahha operates globally and states that it may process information in Australia, the European Union and the United States. Where personal information is transferred internationally, Pavelka uses applicable safeguards such as contractual data-protection obligations, the European Commission’s Standard Contractual Clauses, UK transfer safeguards and adequacy decisions where applicable.
You can request more information about the applicable transfer safeguards by contacting us.
Pavelka’s primary production application data is hosted in Amazon Web Services’ Frankfurt region in Germany. Pavelka uses encryption at rest and in transit and limits operational access according to role.
Limited remote access may occur from countries where authorised support, infrastructure and reporting personnel are located, including the United States, India, Singapore, Indonesia, Taiwan, the United Kingdom and Switzerland. Access is restricted using controls such as multi-factor authentication, role-based access, VPNs where applicable, logging and data minimisation.
Sahha operates globally and states that it may process information in Australia, the European Union and the United States. Where personal information is transferred internationally, Pavelka uses applicable safeguards such as contractual data-protection obligations, the European Commission’s Standard Contractual Clauses, UK transfer safeguards and adequacy decisions where applicable.
You can request more information about the applicable transfer safeguards by contacting us.
Retention, disconnection and deletion
Retention, disconnection and deletion
We retain personal information only for as long as needed to provide the relevant service, follow documented client instructions, meet legal obligations, resolve disputes and maintain security. Retention periods vary by data type and client arrangement.
We retain personal information only for as long as needed to provide the relevant service, follow documented client instructions, meet legal obligations, resolve disputes and maintain security. Retention periods vary by data type and client arrangement.
Disconnecting Apple Health or Health Connect
Disconnecting stops future collection through the connected source. Pavelka will delete covered health and activity data associated with the connection, including applicable derived information, within 30 days of disconnection, withdrawal of consent or a valid deletion request, unless a legal obligation requires limited retention.
Deleting your Pavelka account
The Delete my Pavelka account function deletes your Pavelka account and associated personal information. It does not delete your employer-managed Webex account. We will also instruct applicable processors, including Sahha, to delete information they process on our behalf.
If you later authenticate with Webex again and remain eligible, you may be invited to create a new Pavelka account. Previously deleted personal information will not be restored to the new account.
Information we may retain
We may retain limited information where legally required, necessary for security or fraud prevention, or subject to a legal hold. We may also retain information that has been irreversibly anonymised so it can no longer reasonably identify you. Encrypted backups are removed through the ordinary backup cycle and are not used for active processing.
How we protect information
How we protect information
Our safeguards include:
TLS encryption in transit and AES-256 encryption at rest for Pavelka production data;
AWS-managed encryption keys provisioned in the Frankfurt region;
role-based access, unique accounts and multi-factor authentication for administrative access;
logging, monitoring, incident-response procedures and access reviews;
data minimisation and separation of infrastructure, application-support and reporting roles; and
contractual confidentiality, security and data-protection requirements for personnel and service providers.
No internet transmission or storage system is completely secure. We therefore cannot guarantee absolute security, but we maintain safeguards appropriate to the nature and sensitivity of the information.
Our safeguards include:
TLS encryption in transit and AES-256 encryption at rest for Pavelka production data;
AWS-managed encryption keys provisioned in the Frankfurt region;
role-based access, unique accounts and multi-factor authentication for administrative access;
logging, monitoring, incident-response procedures and access reviews;
data minimisation and separation of infrastructure, application-support and reporting roles; and
contractual confidentiality, security and data-protection requirements for personnel and service providers.
No internet transmission or storage system is completely secure. We therefore cannot guarantee absolute security, but we maintain safeguards appropriate to the nature and sensitivity of the information.
Your privacy rights
Your privacy rights
Depending on your location and the circumstances, you may have rights to:
access personal information held about you;
correct inaccurate or incomplete information;
request deletion or restriction of processing;
object to certain processing;
withdraw consent;
receive certain information in a portable format; and
complain to your local data-protection authority.
You may exercise rights through the in-app controls, by contacting Pavelka, or, where your organisation is the controller, through your organisation’s privacy contact. We will coordinate with the relevant organisation where necessary.
Depending on your location and the circumstances, you may have rights to:
access personal information held about you;
correct inaccurate or incomplete information;
request deletion or restriction of processing;
object to certain processing;
withdraw consent;
receive certain information in a portable format; and
complain to your local data-protection authority.
You may exercise rights through the in-app controls, by contacting Pavelka, or, where your organisation is the controller, through your organisation’s privacy contact. We will coordinate with the relevant organisation where necessary.
Identity verification
We may need to verify your identity before completing a request. We will request only the information reasonably necessary for verification and will not make the process unnecessarily difficult.
Age restrictions
Age restrictions
Pavelka Connect is designed for authorised workplace participants and is not directed to children. The optional Sahha health-data connection is intended for users aged 18 or older. We do not knowingly collect connected health information from children.
Pavelka Connect is designed for authorised workplace participants and is not directed to children. The optional Sahha health-data connection is intended for users aged 18 or older. We do not knowingly collect connected health information from children.
Changes to this policy
Changes to this policy
We may update this policy when our services, providers or legal obligations change. We will publish the revised policy with a new effective date and provide additional notice where required.
We may update this policy when our services, providers or legal obligations change. We will publish the revised policy with a new effective date and provide additional notice where required.
Contact us
Contact us
For questions, complaints or privacy-rights requests relating to Pavelka Connect:
Pavelka Ltd and relevant affiliates
Email: support@pavelka.global
If your request concerns an employer-sponsored programme, you may also contact your employer or participating organisation’s privacy team. If your request concerns Sahha’s own processing, you may review the Sahha End User Privacy Policy.
For questions, complaints or privacy-rights requests relating to Pavelka Connect:
Pavelka Ltd and relevant affiliates
Email: support@pavelka.global
If your request concerns an employer-sponsored programme, you may also contact your employer or participating organisation’s privacy team. If your request concerns Sahha’s own processing, you may review the Sahha End User Privacy Policy.
Positive energy at work.
Solutions
Company
Resources
© 2026 Pavelka Ltd. All rights reserved.
Positive energy at work.
Solutions
Company
Resources
© 2026 Pavelka Ltd. All rights reserved.
Positive energy at work.
Solutions
Company
Resources
© 2026 Pavelka Ltd. All rights reserved.