Consumer Health Data Privacy Policy

"Consumer health data" is information about your physical or mental health. In Thrive Coach, that includes:

• Whether you're under a healthcare provider's care for your GLP-1 medication.
• Your medication, how you take it, your dose, your start date and any dose changes you record.
• Pregnancy status, whether you have type 1 diabetes, and your answer to the eating-disorder screening question.
• Symptoms and their severity, your daily stomach answer, and perimenopause status.
• Weight, mood and energy, notes in your check-ins, protein, fiber, water and strength days.
• Food preferences, intolerances and your goal.
• What you tell the coach, which often includes health information.
• Meal photos, which are analysed and discarded, never stored.

All of it comes from you: what you enter during setup, log in the app or write to the coach. We don't buy health data or collect it from other sources, and we don't use your location.

Only to provide Thrive Coach to you:

• To show your Today screen, Nutrition guide, Journey and appointment summary.
• To set your protein target and pick tips that fit your stage and symptoms.
• To give the coach the context it needs to answer you.
• To keep you safe: for example, setup doesn't continue for someone who reports a recent eating disorder, and points them to support instead.

We never sell your health data, use it for advertising, or use it to make decisions about you outside the app.

We share health data only with the service providers that run Thrive Coach for us, and only so they can provide that service:

• Supabase: stores your account and everything you enter.
• Vercel: hosts the app.
• OpenAI: generates the coach's replies, your welcome summary and meal-photo estimates. Not used to train its models.

Our analytics provider, PostHog, never receives health data: it runs only on our public pages. When you use the microphone, your browser's maker (Google or Apple) processes the audio under its own policy.

We may disclose health data if the law requires it, or to prevent serious harm to you or someone else.

We ask for your consent before collecting any health data, as a separate step during setup. You can withdraw it at any time by deleting your account in Profile, which deletes your health data, or by emailing contact@thrive-coach.app.

You can:

• Confirm whether we hold your health data, and get a copy of it.
• Get the list of everyone we've shared it with (the providers above).
• Withdraw your consent.
• Have your health data deleted, including by our providers.

To use any of these rights, email contact@thrive-coach.app from the address on your account, or delete your account in Profile. We answer within 45 days. If we decline a request, we'll explain why, and you can appeal by replying to that email; we'll answer your appeal within 45 days. If you're not satisfied, you can contact your state attorney general. Using your rights never affects how you're treated in the app.

Health data travels encrypted, each account can read only its own records, and access within Lyonheart AI LLC is limited to what's needed to run and support the app. If a breach affects your health data, we'll notify you as the law requires.

Lyonheart AI LLC runs Thrive Coach. Questions or requests: contact@thrive-coach.app. See also our Privacy Policy and Terms of Service.