How we collect, use, and protect your information
Morava (moravacare.com) is a mobile application designed to help SoonerCare, Medicaid, and uninsured patients in Oklahoma find and connect with healthcare providers. Morava is operated by Moise Kouassi, Oklahoma, United States.
This Privacy Policy applies to the Morava mobile app, the provider dashboard at dashboard.moravacare.com, and any related services. If you have questions, contact us at support@moravacare.com.
| Data | Why We Collect It |
|---|---|
| First and last name | To personalize your experience and identify you to providers when booking |
| Email address | Account creation, verification, and password reset |
| Birth year | COPPA compliance only — to verify users are 13 or older. Not used for any other purpose. |
| Insurance type | To filter providers who accept your coverage (SoonerCare, Medicaid, uninsured) |
| Insurance plan name | To show relevant providers and surface your saved plan in the app |
| Appointment details | Date, time, provider, and reason — to manage your bookings |
| Location (optional) | GPS or city/ZIP to find nearby providers. Never stored permanently. |
| Profile photo (optional) | If you choose to add one to your profile |
We do not use your information for advertising. We do not sell, rent, trade, or share your personal information with third parties for marketing. Morava does not display advertisements and never will.
Your data is stored on Google Firebase (Firestore and Firebase Authentication), a secure cloud platform operated by Google LLC. All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
We use Sentry for crash monitoring. Before any error data is transmitted to Sentry, our app automatically strips all PII fields including names, emails, phone numbers, insurance details, and appointment information. Stack traces are truncated in production to prevent data leakage through file paths.
Morava operates under a Business Associate Agreement (BAA) with Google for Firebase services. While Morava is primarily an appointment scheduling platform (not a covered entity under HIPAA), we maintain HIPAA-aligned data practices including audit logging, minimum necessary data collection, and access controls.
We share your information only in these limited circumstances:
We never sell your data. No exceptions. No future carve-outs. This is a founding principle of Morava.
Morava is not directed to children under the age of 13. We require all users to provide their birth year during signup. If a user indicates they are under 13, account creation is blocked and they are directed to contact us with a parent or guardian.
We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us immediately at support@moravacare.com and we will delete the account and all associated data within 72 hours.
For users aged 13–17, a parent or guardian may contact us to request access, correction, or deletion of their child's data.
Birth year is collected solely for age verification. It is stored in your user record but is never used for profiling, analytics segmentation, or any purpose other than verifying you are 13 or older.
To exercise any of these rights, email support@moravacare.com. We respond to all privacy requests within 30 days.
Morava's founding member voucher program tracks the total number of
signups using an atomic counter. If you are among the first 100 users
to create an account, your user record is flagged with
voucherEligible: true. This flag:
voucherUsed: true only after a provider
confirms a Meet & Greet appointment
| Data Type | Retention Period |
|---|---|
| Account information | Until account deletion |
| Appointment records | 12 months from appointment date |
| Audit logs | 6 years (HIPAA-aligned) |
| Analytics events | 24 months |
| Crash reports (Sentry) | 90 days (Sentry default) |
| Location data | Not stored — used in-session only |
| Birth year | Until account deletion |
When you delete your account, all personal data is removed within 30 days. Audit logs are retained for the legally required period in anonymized form.
| Service | Purpose | Data Shared |
|---|---|---|
| Google Firebase | Database, authentication, hosting | All user data (under BAA) |
| Google Maps | Provider location, static maps, geocoding | Location coordinates only |
| Sentry | Crash monitoring | PII-scrubbed error reports |
| Twilio | SMS appointment notifications | Phone number + message text |
| Expo / EAS | App builds and OTA updates | No personal data |
We may update this Privacy Policy as Morava grows and adds new features. The Effective Date at the top of this page reflects the most recent revision.
For material changes — changes that significantly affect your rights or how we use your data — we will notify you by email and display an in-app notice at least 14 days before the change takes effect.
Continued use of Morava after the effective date of a change constitutes acceptance of the updated policy.
We respond to all privacy requests within 30 days. For urgent matters involving children's data, we respond within 72 hours.