Privacy Policy

1About this policy

This Privacy Policy applies to personal information processed through the iThriive mobile application for iOS and Android, its in-app assistant "Thriive", the iThriive application programming interface that the app uses, these legal pages, our website at www.ithriive.com, and any communication you have with us about iThriive (together, the "Service").

"Personal information" (also called "personal data") means information about an identified or identifiable individual. This policy is written to meet the transparency requirements of the laws that apply to the Service in the countries where it is offered (the United States, Canada and India), including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25), India's Digital Personal Data Protection Act, 2023 (DPDP Act) and Digital Personal Data Protection Rules, 2025 (DPDP Rules), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), and United States federal and state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA).

If you live in Washington, Nevada or Connecticut, or are otherwise protected by a United States consumer health data law, our separate Consumer Health Data Privacy Policy also applies to you and governs where it is more protective.

This policy is also available in French: Politique de confidentialité (version française). If you live in Québec, the French version is provided to you first.

This policy should be read together with our Terms of Service. If you do not agree with how we handle personal information as described here, please do not use the Service.

2Who we are and how to reach us

The Service is provided by Metricsnumero Technology Solutions Ltd., a corporation incorporated under the laws of Ontario, Canada ("Metricsnumero", "we", "us" or "our"). We decide why and how your personal information is processed, so we are the organization accountable for it under PIPEDA, the "enterprise" under Québec law, the "Data Fiduciary" under the DPDP Act, the "body corporate" under the SPDI Rules, and the "business", "controller" or "regulated entity" under United States state laws.

Privacy Officer and Grievance Officer

We have designated one person who is responsible for our compliance with privacy law and for handling questions, requests and complaints. This person is our Privacy Officer, the person in charge of the protection of personal information under Québec law, the person who answers questions about the processing of personal data under section 8(9) of the DPDP Act and the DPDP Rules, and our Grievance Officer under Rule 5(9) of the SPDI Rules.

3Information we collect

We collect only what the Service needs. Much of it is optional: you choose whether to complete your profile, connect a calendar or a health source, track something, save health details, or use Thriive. Where a feature cannot work without certain information, we say so in the app.

3.1 Information you give us

• Account information. Your name or display name and email address. If you sign up with email, you also create a password; it is handled by our authentication provider, Google Firebase, which stores it only in salted, hashed form. We never see or store your password. If you sign in with Google or Apple, we receive your name, email address and, if available, profile photo URL from that provider. Apple may give us a private relay email address instead of your real one.
• Profile. Optionally: full name, height, weight, date of birth and gender (including any self-description you type), and the language you choose for the app.
• Planning preferences. Working hours, sleep window, scheduling preferences and rules (for example "gym in the morning" or "no meetings after 6 PM"), your choice of how much Thriive may change on its own, and, for each connected calendar, whether its imported events are locked or unlocked.
• Things you create or log. Schedule blocks, notes and the tasks in them, goals, goal check-ins and time set aside for goals, habits and habit logs, water intake, workouts (including the exercises, sets, repetitions, weights, durations, distances and effort ratings you record, live workout sessions and exercises you add yourself), meals and nutrition (calories and macronutrients, and the foods and amounts that make up a meal), foods you add yourself (name, brand, barcode and nutrition figures), meals you save to log again, nutrition plans and targets, and weight.
• Trackers and check-ins. Anything you choose to track and its values, targets, reminders and notes, which can include mood, energy, stress, a journal, sleep, symptoms or spending. Morning and evening check-ins record your mood and energy (morning) or mood and stress (evening) on a 1-to-5 scale, an optional journal entry of up to 1,000 characters, and up to three tags you pick from a fixed list (sore, tired, anxious, excited, sick, travelling, social, alone, hungover, period). Skipping a check-in is also recorded.
• Experiments. Personal experiments you set up or accept from Thriive: a title and hypothesis, the trackers they measure, their dates, how closely you followed them and their result.
• Health details. If you choose to save them, health conditions (such as diabetes, prediabetes, hypertension, heart disease, heart failure, chronic kidney disease or a history of an eating disorder), classes of medication (such as insulin, metformin, GLP-1 medicines, beta-blockers, diuretics, anticoagulants or lithium), pregnancy due date, a baby's birth date, breastfeeding status, a choice not to see calorie or weight numbers, and a short free-text note. See section 4.
• Conversations with Thriive. The messages you send to Thriive and Thriive's replies, together with structured records of actions Thriive took for you and proposals it made.
• Memories. Short facts you ask Thriive to remember (for example "I only have dumbbells at home"), each up to 140 characters.
• Feedback and reports. Thumbs-up or thumbs-down ratings on Thriive's replies, the reasons you pick, any comment you write (up to 500 characters), whether you choose to share the conversation with our team, and reports you make that a reply was harmful, offensive or wrong. A report shares that reply and the message before it with our team, as the report sheet tells you.
• Agreements and consents. A record of the version of our Terms of Service you agreed to, the version of this Privacy Policy you were shown, your confirmation that you meet the minimum age, your consent to the processing of health information, whether you have given or withdrawn your optional consent to share information with our AI provider, your consent to saving health details, and the language you agreed in, each with the date and time.
• Communications. What you send us by email, such as support requests and privacy requests, and our replies.

3.2 Information from your device and connected services

Only if you connect them, and only the data types you allow in your device's permission screen:

• Apple Health (iPhone). Steps, walking and running distance, active and resting energy, exercise minutes, flights climbed, resting heart rate, average and maximum heart rate, heart rate variability, VO₂ max, respiratory rate, blood oxygen saturation, body mass, body fat percentage, lean body mass, body mass index, waist circumference, dietary energy, protein, carbohydrates and fat, sleep analysis (including sleep stages), mindful sessions and workouts.
• Health Connect (Android). Steps, distance, active and total calories burned, exercise sessions, sleep sessions, heart rate, resting heart rate, heart rate variability, VO₂ max, weight, body fat, lean body mass, floors climbed and nutrition, and, where the version of the app you use requests them, oxygen saturation and respiratory rate. With your permission the app also reads data older than 30 days, once, when you first connect.
• Strava (where available). Your Strava athlete identifier and the permissions you granted, and your activities, including ones you have made private: each activity's identifier, name, type, start time, moving time and energy. We do not import routes, locations or heart-rate streams from Strava.
• Calendars. From your device calendar (Apple Calendar on iPhone, or your Android calendars), Google Calendar or Microsoft Outlook: for events from 14 days in the past to 60 days ahead, the title, start and end times, notes or description, whether you organised the event and how many other people are invited (not who they are), plus the identifiers needed to keep them in sync. For device calendars we also receive the name of the calendar and of the account it belongs to on your phone, which can be an email address. If you connect Google or Microsoft accounts, we also keep the email address of each connected account, the names and colours of its calendars, and which of them you chose to import. We do not import event locations or the names or addresses of attendees, and all-day events are skipped. If you move, edit or remove an unlocked imported event in iThriive, we keep your change together with the calendar's own version (see section 7).

Your device summarises Apple Health and Health Connect data into daily values, sleep sessions, workouts and daily nutrition totals before sending them to us; individual readings, such as each heart-rate sample, are not uploaded. When you first connect, up to the previous 365 days are imported; after that, the app refreshes the last 30 days when you open it. Strava activities from the last 30 days are imported when you connect or refresh. Details are in section 7.

3.3 Purchases and plan

If you buy a plan, Apple or Google processes the payment. We do not receive or store your card, bank or billing-address details. The store tells us, and we keep, the product you bought, the store's transaction or purchase identifiers, the purchase, renewal and expiry dates, and changes such as renewals, refunds, cancellations and billing problems. So that the store can match a purchase to your iThriive account, the app gives the store a random internal identifier for your account. We also keep your plan, your trial dates, how many messages to Thriive and how many seconds of enhanced voice transcription you have used, and the dates of any trial-ended or deletion notices we sent you.

3.4 Information collected automatically

• Time zone and language. Your device's time zone, refreshed each time you sign in, so that schedules, reminders and quiet hours are correct, and your device's language. We use the time zone to infer your country in order to show the right crisis helplines, apply your region's health guidelines and apply the right minimum age.
• Push notification token. If you allow notifications, a token that identifies your app installation to the notification service, and your platform (iOS or Android).
• Technical and security data. Our servers and providers record technical information when your app communicates with them, such as IP address, request times, app and operating-system version, and error details, together with internal account identifiers. Short-lived counters keyed to your account or IP address limit how often requests can be made. We use this information to operate, secure and troubleshoot the Service.
• Diagnostics. If crash reporting is enabled, technical details of app and server errors (device model, operating-system and app version, the error and your internal user identifier). Request bodies, headers, cookies and query strings are removed and fields whose names indicate health data are redacted before a report is sent, but error messages and the addresses the app called may still appear in a report.
• Usage records. Pseudonymous records of each conversation turn with Thriive and each AI-written briefing that contain codes and counts only: the model used, token counts and cost, the names of tools used, safety classifications and the length of the reply. They contain no message text, and are linked to you by a keyed, one-way hash of your account identifier and by the identifier of the reply they describe.

3.5 Information we create about you

The Service derives information from what it collects, including:

• a daily readiness score from 0 to 100, which compares last night's sleep, heart rate variability, resting heart rate, bedtime consistency, yesterday's training and the energy you report with your own last 14 days;
• patterns: statistical associations between things you track, found each night in up to 90 days of your data (for example, that your mood tends to be higher after more sleep), and the patterns you dismissed so they are not shown again;
• the results of your experiments, comparing what you tracked before and during each experiment;
• training-load and recovery summaries; nutrition, hydration and heart-rate-zone targets calculated with published formulas; goal progress; the schedule proposals that Thriive and the planner generate; and daily briefings and evening reviews;
• health conditions, pregnancy, breastfeeding or medicines that the Service detects in your recent messages to Thriive, so that its figures and advice stay safe for you; and
• safety classifications of your messages to Thriive (see section 6.6).

Derived information is treated with the same care as the information it comes from.

3.6 What we do not collect

The app does not collect your precise location, contacts or browsing history, and does not access your photo library. The camera is used only while you scan a food barcode; no image is stored or sent. The microphone is used only while you record, after you tap the microphone to talk to Thriive or dictate a note. Your phone's own speech recogniser turns what you say into text: on the phone itself where it supports your language, or otherwise through Apple's or Google's speech service, under their terms. On Plus and Pro plans, and only if you have given the optional AI consent, a recording the phone may have misheard (one longer than a minute, or one in which it heard nothing or was unsure) is sent to our server, which has OpenAI transcribe it once (see section 6.4). We do not keep your recordings: our server holds the audio in memory for that one request only and does not store it, and the app deletes its copy of the recording from your phone after use. What we keep is the text, once you send or save it, and how many seconds of enhanced transcription you used each month. The app does not use your device's advertising identifier and does not track you across other companies' apps or websites. We do not buy personal information about you from data brokers.

3.7 What happens if you don't provide information

You need an email address (or a Google or Apple account) to have an account, and you must accept the Terms, confirm your age and consent to the processing of health information to use the Service. Consent to share information with our AI provider is optional: without it, Thriive and the other AI features are off and the rest of the app works. Everything else is optional. If you leave your profile blank or don't connect a source, the features that depend on it will be less personalised or unavailable, but the rest of the app keeps working.

4Health and other sensitive information

Much of what iThriive handles is health information: data synced from Apple Health, Health Connect or Strava; what you log about workouts, meals, water, weight and sleep; your mood, energy, stress, journal and check-in tags; health details you save; readiness, patterns and other assessments we derive; and anything about your health that you tell Thriive. Several laws treat this as "sensitive" information, including India's SPDI Rules, Québec law, the CCPA, and United States consumer health data laws. Date of birth, gender, check-in tags such as "period", and account log-in credentials can also be sensitive under some of these laws.

The Service is a general-wellness and planning tool, not a medical device. We are not a healthcare provider, and the Service is not covered by the United States Health Insurance Portability and Accountability Act (HIPAA). Information you share with iThriive is protected by this policy and by the privacy laws described here, not by the confidentiality rules that apply to doctors and hospitals.

5How we use information

We use personal information only for the purposes below, and for purposes compatible with them that we tell you about first.

Legal grounds

Depending on where you live, we rely on the following legal grounds:

• Consent. Under Canadian law, we rely on your consent, which is express for health and other sensitive information, and which we ask for separately for each specific purpose (using the Service, sharing with our AI provider, and saving health details). In India we rely on your consent, given by a clear affirmative action, for all processing except the legitimate uses permitted by section 7 of the DPDP Act (for example, to comply with law or to respond to a medical emergency), and the SPDI Rules require your written consent, which you give electronically, for sensitive personal data. In the United States, we obtain your consent before collecting or using consumer health data.
• Performance of our agreement with you. Where the law recognises it, we process information as needed to provide the Service you asked for under our Terms, including your plan.
• Legal obligations and legitimate interests. We process limited information to comply with law, and where the law permits, for security, fraud prevention and keeping the Service working, in ways you would reasonably expect.

We will not use your personal information for a new purpose that is incompatible with the purposes above without telling you first and, where the law requires, asking for your consent.

6Thriive and other AI features

Thriive is an artificial-intelligence assistant. When you chat with Thriive you are interacting with an AI system, not a person. Its replies are generated by a large language model, can be wrong, and are not medical advice. The app shows this reminder under the message box at all times.

Thriive and the other AI features are provided by OpenAI through its application programming interface, and work only while you hold the optional AI consent quoted in section 4. If you have not given it, or you withdraw it in Profile, nothing is sent to OpenAI: Thriive chat, AI-written briefings, meal estimates from a description and enhanced voice transcription stop, briefings are written from a template on our server instead, and your chat history, memories and everything you have logged stay until you delete them. Information already sent to OpenAI cannot be recalled, but OpenAI deletes it as described in section 6.5. Some of these features are also limited to certain plans (see the Terms of Service).

6.1 What Thriive sends to OpenAI

To answer a message, the Service sends OpenAI:

• your message and up to the 20 most recent messages in the conversation, with short notes of the status of cards Thriive showed you and of the data Thriive looked up for up to four earlier replies;
• the current date, time and time zone, the coming days, your working hours and sleep window, and the language Thriive should reply in;
• your age (calculated from your date of birth; we do not send the date itself, except when you ask Thriive to change it), gender including any self-description, height, weight and average resting heart rate, and your saved nutrition plan and targets, if you have provided or synced them (if you chose not to see numbers, only your age, gender and plan goal);
• your saved health details, as coded conditions and medicine classes (never a drug name or dose), pregnancy week or baby's age, and your note, only while your consent to them stands;
• health conditions, pregnancy, breastfeeding or medicines you mentioned in your recent messages, which the Service detects automatically so that Thriive's figures and advice stay safe for you, even if you have not saved them as health details;
• a summary of your sleep, exercise, steps, resting heart rate and recovery over the last two weeks, changes in your heart rate variability and resting heart rate, your training load, and today's readiness score;
• up to 12 of your active trackers with today's values and targets, and today's check-in (mood, energy, stress and tags, but not your journal);
• memories you asked Thriive to keep;
• your active goals and their progress, scheduling rules, today's schedule (including the titles and times of events imported from your calendars, but not their notes or descriptions) and your free time;
• the titles of up to 15 of your notes and how many tasks they contain; and
• results of the lookups Thriive makes to answer you, such as your recent workouts and exercises, sleep, nutrition, water, habits, goals, trackers and their history, experiments, schedule, or the content of your notes and their tasks.

Your current message is also checked with OpenAI's moderation service to detect a risk of self-harm.

6.2 Briefings and evening reviews

On Plus and Pro, and only with your AI consent, a morning briefing and an evening review can be written by OpenAI. To write one, the Service sends the time and day, your readiness score and recovery, last night's sleep, the titles and times of up to 12 items in today's schedule, and, depending on the time of day, your free time, the journal you wrote the evening before (up to 280 characters), habits done, steps, the number of workouts, tomorrow's first item, your check-in and trackers, a pending proposal and the day of a running experiment. It does not send your notes, memories or chat history. If a safety concern was detected in your conversations in the previous 24 hours, or without your AI consent, the briefing is written from a template instead. Briefings are stored in your account and may be sent to you as a notification.

6.3 Meal estimates

On Plus and Pro, if you ask iThriive to estimate a meal from a description, the description (up to 200 characters) is sent to OpenAI, with no other information about you. The estimate is shown to you and saved only if you log it.

6.4 Enhanced voice transcription

As described in section 3.6, on Plus and Pro some recordings are sent to OpenAI for transcription, with an indication of whether it is a note or a message, your language and the titles of up to 10 of your active goals so that the names you use are spelled correctly.

6.5 What OpenAI may do with it

We do not send OpenAI your name or email address, unless you include them in a message, note, memory, goal or calendar entry yourself. OpenAI, in the United States, processes this information on our behalf as our service provider under its business terms. Under those terms OpenAI does not use information sent through its API to train or improve its models, and keeps it for up to 30 days to detect abuse, unless the law requires it to keep it longer. Strava data is never sent to OpenAI and is not used by Thriive, briefings or other AI features (see section 7.6). The models we use may change over time; whichever we use, these rules apply.

6.6 Actions Thriive takes for you

Thriive can act on your account when you ask it to. Some actions happen immediately, such as logging a workout, meal, water, weight, habit or tracker value, recording a goal check-in, creating or updating a goal or habit, updating your profile, adding a note, task or scheduling rule, remembering or forgetting something, and moving or cancelling items in your iThriive schedule. Others are shown to you as a card that you must approve first, such as adding new items to your schedule, starting an experiment, saving nutrition targets, changing your sleep or working hours, or saving health details. You can undo Thriive's recent actions, and we keep a record of each action for 90 days so that undo works and so that you and we can see what changed. Thriive can move or change an imported calendar event only inside iThriive and only if you unlocked it; it never adds, changes or deletes events in your Google, Outlook or device calendars.

6.7 Safety checks

Thriive is instructed to recognise possible emergencies and risks of self-harm or disordered eating, to show crisis helplines for your country, never to diagnose conditions or change medication, and to refuse unsafe advice. To support this, the Service screens messages using a list of risk phrases (in English, French, Spanish and Hinglish) and OpenAI's moderation service, and checks replies against safety rules. If the moderation service cannot be reached, the phrase list is used alone. These checks produce codes (for example, a risk level) that are stored in our pseudonymous usage records. They do not lead to any decision about you other than how Thriive responds and whether an AI briefing is written, and we do not contact emergency services or anyone else on your behalf.

6.8 Memories

On plans that include memory, Thriive can remember short facts you ask it to remember. You can see and delete each memory, or all of them, at any time. A memory expires 180 days after you last asked Thriive to remember it, or on the end date you give it (at most 365 days ahead), and expired memories are deleted 30 days later.

6.9 Feedback, reports and human review

Our team reviews the quality and safety of Thriive's replies, generally once a week. The review queue contains replies you rated thumbs-down or reported, replies our automated checks flagged, replies our safety checks flagged, and a 1% sample of replies from people who have shared at least one reply. Reviewers see the text of a reply only if you chose to share it with us using the feedback sheet ("Share this conversation with the iThriive team to improve Thriive") or reported it; for everything else in the queue, including sampled replies you did not share, they see only codes and ratings. Our team may read a conversation you have not shared only where necessary for security purposes, such as investigating abuse or a security incident, or to comply with the law; access is limited to authorised personnel and recorded. If you share or report a reply, we may keep a copy with identifying details removed as a test case for checking Thriive's quality and safety; it is never used to train AI models and we delete it if you ask. Review records are deleted after 90 days.

6.10 Automated processing and profiling

The Service uses automated processing to personalise your schedule, targets and Thriive's advice to you, and to evaluate aspects of your health and behaviour: the readiness score, patterns in your data, experiment results, training load and the safety classifications described above. For example, it may suggest a lighter workout when your readiness is low. This happens because you use these features, and it does not produce legal effects or similarly significant effects for you: we do not make decisions about you regarding credit, insurance, employment, housing, education or access to essential services. The deletion of an unpaid account (section 10) follows from whether a plan has been paid for, not from any evaluation of you. Readiness and patterns are calculated only from data you choose to sync or log; you can stop them by disconnecting your health sources and not logging check-ins or trackers, dismiss any pattern, and delete the related data.

7Connected services

You choose whether to connect each service, and you can disconnect it at any time in the app. iThriive only reads from these services. It never adds, changes or deletes data in Apple Health, Health Connect, Strava or any calendar.

7.1 Apple Health

With your permission, the app reads the Apple Health data types listed in section 3.2 on your iPhone and sends daily summaries, sleep sessions and workouts to our servers so that your history, trends, readiness and, with your AI consent, Thriive's advice can use them. Data from Apple Health is used only to provide health and fitness features to you. It is not used for advertising, marketing or data mining, it is not sold, and it is not shared with any third party except our service providers (including OpenAI, only with your AI consent, as described in section 6) to provide the Service to you. You can change which data iThriive can read in the Health app at any time.

7.2 Health Connect

With your permission, the app reads the Health Connect data types listed in section 3.2, including historical data, and handles them in the same way as Apple Health data. iThriive's use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements. You can change iThriive's permissions in Health Connect at any time.

7.3 Google Calendar

If you connect Google Calendar, you authorise iThriive through Google's consent screen to see the list of calendars in your Google account and to view their events (the read-only permissions calendar.calendarlist.readonly and calendar.events.readonly). iThriive cannot create, change or delete anything in your Google Calendar. It imports copies of events from your main calendar, and from any other calendar in that account that you switch on in the app; the others stay listed, by name, so you can choose. iThriive reads their titles, times and descriptions so it can show them in your schedule, plan around them, and, with your AI consent, give Thriive the titles and times it needs to help you. Google also tells us the email address of the account you connect, which we use only to show you which account is which; you can connect more than one Google account. iThriive refreshes the copies about every 15 minutes. We store the access tokens Google issues in encrypted form. When you switch a calendar off, we delete the events imported from it. When you disconnect a Google account or delete your account, we delete that account's imported events, your iThriive changes to them, its list of calendars and its tokens, and ask Google to revoke iThriive's access. If Google cannot be reached at that moment, the tokens are still deleted on our side, and you can also remove iThriive's access at any time at myaccount.google.com/permissions.

During testing before the public release, some test versions of the app asked for permission to edit events you had organised and could change them when you edited them in iThriive. That ability has been removed. Test accounts that granted it are asked to reconnect with read-only access, and we revoke the older permission.

7.4 Microsoft Outlook

If you connect Outlook, you authorise iThriive through Microsoft's consent screen to read your Outlook calendars (the read-only permission Calendars.Read, with offline_access so that the connection keeps working): their names, and the events (titles, times and descriptions) in your default calendar and in any other calendar you switch on in the app. iThriive cannot create, change or delete events in Outlook. When you sign in, Microsoft also tells us the email address of the account, which we use only to show you which account is which; you can connect more than one Microsoft account. iThriive does not otherwise read your Microsoft profile. We store Microsoft's tokens in encrypted form and delete them, with the imported events, your iThriive changes to them and the list of calendars, when you disconnect that account or delete your account; switching a calendar off deletes the events imported from it. Microsoft does not provide a way for apps to withdraw their own access, so to remove iThriive from your Microsoft account entirely, you can also do so at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work or school accounts).

7.5 Device calendars

With your permission, the app reads events from your device's calendars, from 14 days in the past to 60 days ahead, while the app is open, and sends the details listed in section 3.2 to our servers. The app asks only for permission to read your calendars and never writes to them. You can withdraw the permission in your device settings at any time; to delete events already imported, disconnect the device calendar in iThriive.

7.6 Strava

Where Strava is available in the app, you can connect it through Strava's consent screen (the permission activity:read_all, which includes private activities). iThriive imports the activity details listed in section 3.2 and stores Strava's tokens in encrypted form. Strava data is shown only to you, inside iThriive, as part of your workout history and progress. It is not sent to OpenAI, not used by Thriive, briefings or any other AI feature, not included in the figures we send to OpenAI (such as readiness or training load), and not shared with anyone else except our hosting provider, which stores it for us. When you disconnect Strava or delete your account, we delete the imported activities and the tokens, and ask Strava to withdraw iThriive's access. If Strava cannot be reached at that moment, the tokens are still deleted on our side, and you can also remove iThriive in Strava's settings under My Apps; if you do, the imported activities stay in iThriive until you disconnect Strava there.

7.7 Sign in with Google or Apple

If you sign in with Google or Apple, that company tells us your name and email address (or Apple's private relay address) and, for Google, your profile photo URL. We do not receive your Google or Apple password. If you signed in with Apple, we keep the token Apple issues so that, when you delete your account, we can ask Apple to remove iThriive from your Apple Account.

7.8 Food databases

When you scan a barcode or choose to search for a food online, your phone asks Open Food Facts directly; if it has no match for a barcode, our server asks the United States Department of Agriculture's FoodData Central, sending only the barcode. Searches in the app's built-in food list stay on your device.

Each connected service is operated by its provider under its own terms and privacy policy, which govern what that provider does with your information.

8How we share information

We share personal information only in these situations:

8.1 Service providers

We use the following service providers (also called processors or sub-processors) to run the Service. Each may use your information only to provide its services to us, under a contract that requires it to protect the information.

8.2 App stores and payments

Apple (App Store) and Google (Google Play) sell our plans and process your payments as independent businesses under their own terms and privacy policies. We exchange with them the information needed to verify and manage your purchase (see section 3.3). They do not receive your health information from us.

8.3 Public food databases

Open Food Facts (a non-profit association in France) and USDA FoodData Central (a United States government database) are public databases rather than providers working for us under contract. Open Food Facts receives, from your phone, the barcode or search text, your IP address and a generic app identifier, with no account information; what you look up can say something about what you eat. USDA receives only the barcode, from our server, with nothing that identifies you.

8.4 Services you connect

When you connect Google, Microsoft, Apple Health, Health Connect or Strava, we exchange with them the information needed to make the connection work (for example, the authorisation code and tokens, and the requests for your events or activities). Each of those companies already holds the data we read from it. We do not send them your iThriive data.

8.5 Legal requirements and protection

We may disclose information if we believe in good faith that it is required by law, a court order or a valid request from a public authority, or that it is necessary to protect someone's life, health or safety in an emergency, to investigate or prevent fraud, security incidents or serious violations of our Terms, or to establish, exercise or defend legal claims. Where the law allows, we will tell you before disclosing your information in response to a legal request, and we will challenge requests we believe are invalid or overly broad. Requests for health information are subject to the additional limits of the laws described in this policy.

8.6 Business transfers

If we are involved in a merger, acquisition, financing, reorganisation, bankruptcy or sale of all or part of our business, personal information may be disclosed to the parties involved and transferred as part of the transaction, subject to confidentiality obligations and to this policy. We will notify you before your information becomes subject to a different privacy policy, and we will ask for your consent where the law requires it, including before transferring data received from Google APIs or consumer health data.

8.7 With your direction

We share information with others when you ask us to. For example, when you export your data, the app gives you a file that you can save or send wherever you choose.

We may share aggregated or de-identified information that cannot reasonably be linked to you, for example overall usage statistics. We take reasonable measures to ensure such information cannot be re-identified, and we commit not to try to re-identify it.

9Where information is stored and transferred

We are based in Canada. The Service's servers and database are hosted by Amazon Web Services in the United States, and our other service providers listed in section 8.1 are located mainly in the United States. This means your personal information is transferred to, stored in and processed in the United States, and may be accessed from Canada, regardless of where you live. Food lookups you make online go to Open Food Facts in France.

Before transferring information outside your province or country, we assess whether it will receive protection appropriate to its sensitivity, and we use contractual and technical safeguards to protect it, including encryption in transit and at rest and contracts that limit our providers' use of the information. However, information held in another country is subject to that country's laws and may be accessible to its courts, law-enforcement and national-security authorities.

For people in India: transfers to the countries above are permitted under section 16 of the DPDP Act, and we will not transfer personal data to any country the Government of India restricts.

For people in Québec: before communicating personal information outside Québec, we assess the privacy-related factors required by law, and we transfer it only where that assessment shows the information will receive adequate protection.

10How long we keep information

We keep personal information only as long as needed for the purposes in this policy, then delete it or irreversibly anonymise it. Specific periods:

When your account is deleted

You can delete your account in the app (Profile, then Delete account) or, if you cannot use the app, by following the steps at www.ithriive.com/delete-account. An account is also deleted automatically if no plan has been chosen by the date we gave you after the free trial or after a paid plan ended (see section 11 of the Terms of Service: at the earliest 28 days after sign-up, with at least 14 days' notice in the app and by push notification, and 90 days after a paid plan ends). Either way, deletion immediately and permanently deletes your account and all associated data from our active database, deletes your sign-in account at Firebase, deletes your usage and review records, deletes the tokens for all your connected services and asks Google, Strava and Apple (if you signed in with Apple) to revoke iThriive's access (see section 7). Copies in backups are removed within 30 days, as described above, copies of usage records in our server logs expire with those logs, and information already sent to OpenAI is deleted by OpenAI within 30 days.

What we keep: to stop one email address from starting repeated free trials, we keep a keyed one-way hash (HMAC-SHA-256 with a secret key) of the deleted account's email address, with the date of deletion, for 24 months. It cannot be turned back into the address without the key, is not linked to any other data, and is used only to check whether a new account's email address has already had a free trial. We may also retain information for longer where the law requires it (for example, security logs that Indian law requires us to keep for 180 days, and, from May 2027, processing logs that India's DPDP Rules require us to keep for one year) or to establish, exercise or defend a legal claim, and then only the minimum necessary, after which it is deleted.

Deleting your account does not cancel a store subscription. Cancel it in your App Store or Google Play account as well, or you may keep being charged.

11How we protect information

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:

• encryption in transit with TLS (HTTPS) for all communication between the app and our servers;
• encryption at rest of our database and backups;
• an additional layer of application-level encryption (AES-256-GCM) for the tokens that connect your calendars and health sources and for your saved health details, each under a separate key held in a managed secrets service;
• a database in a private network that cannot be reached directly from the internet, accessible only to our servers;
• passwords handled only by our authentication provider in hashed form, and strong-password rules;
• access restricted to authorised personnel who need it for their role and are bound by confidentiality;
• pseudonymisation of usage records, and of the email addresses of deleted accounts, with keyed one-way hashes; and
• removal of request bodies, headers and health fields from error reports.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Keep your device and password secure, and tell us immediately if you believe your account has been compromised. A file you export from the app contains your data, including health details, in readable form; keep it safe.

If a security breach affects your personal information, we will investigate, take steps to contain it, keep a record of it, and notify you and the competent authorities as required by applicable law, including the Office of the Privacy Commissioner of Canada and the Commission d'accès à l'information du Québec where there is a real risk of significant harm or a risk of serious injury, the Indian Computer Emergency Response Team (CERT-In) within six hours of noticing a reportable incident, the Data Protection Board of India and affected people in India without delay as the DPDP Rules require, and United States regulators and affected people as state law and the Federal Trade Commission's Health Breach Notification Rule require.

12Your controls in the app

• Profile and preferences: view and edit them at any time.
• Thriive and AI features: turn the optional AI consent on or off in Profile. Off, nothing is sent to OpenAI.
• Export my data: in Profile, get a copy of your data as a file.
• Clear chat history: in Profile, delete all your conversations with Thriive and the records attached to them. This does not delete memories, briefings or what you have logged, and does not give back messages you have used.
• Connected sources: disconnect a calendar account, Apple Health, Health Connect or Strava at any time, or switch off an individual calendar; the data imported from that source is deleted (see section 10 for figures already quoted elsewhere). You can also withdraw permissions in your device settings, the Health app or Health Connect.
• Imported events: choose for each calendar account, or for a single event, whether imported events are locked or unlocked in iThriive.
• Health details: edit or delete them, or withdraw your consent to them, from the Health details screen.
• Trackers, check-ins, experiments and patterns: delete a tracker and all its entries, or a single entry (your check-ins are stored as entries of your mood, energy, stress and journal trackers); delete an experiment; dismiss or snooze a pattern.
• Memories: view and delete individual memories or all of them.
• Thriive's actions: undo recent actions and decline proposals.
• Notifications: turn them off in the app or in your device settings. We send reminders about upcoming schedule items, tasks due, trackers and check-ins, morning briefings and evening reviews, alerts when your recovery is low, reminders about pending proposals, notices when an experiment ends, alerts when a health source has not synced for some days, and notices about your trial, your plan and the deletion of an unpaid account. Notifications can appear on your lock screen; you can hide their content in your device settings.
• Plan: see your plan and how it works in Profile, and manage or cancel your subscription in your App Store or Google Play account.
• Delete your account: from your Profile settings, choose Delete account, or see www.ithriive.com/delete-account. See section 10.
• Read these documents and get help: in the Legal and Help sections of your Profile settings, at any time.

We do not send marketing emails or text messages. Apart from password-reset emails you request, we email you only to respond to you or about important changes to the Service, our Terms or this policy.

13Your privacy rights

Depending on where you live, you have some or all of the following rights, subject to exceptions set out in law:

• Access: to know whether we process your personal information, to get a copy of it and to receive information about how we use and share it, including the names of the third parties we share it with.
• Correction: to correct or complete inaccurate or incomplete information.
• Deletion: to have your information deleted.
• Portability: to receive your information in a structured, commonly used, machine-readable format and have it sent to another organisation. Export my data in Profile gives you a file in JSON format; it leaves out secrets such as connection tokens.
• Withdrawal of consent: to withdraw consent at any time, without affecting processing that took place before. You can withdraw your consent to AI sharing in Profile and your consent to saved health details in the Health details screen. Because the Service cannot operate without processing health information, withdrawing the required consent described in section 4 means deleting your account.
• Objection and limitation: to object to or limit certain uses of your information.
• Information about automated processing: to know how automated processing affects you (see section 6.10).
• Non-discrimination: not to be treated differently for exercising your rights.
• Complaint: to complain to us and to a regulator (see section 21).

How to make a request

Many requests can be handled in the app (see section 12). For anything else, including access requests and deletion when you cannot use the app, email aisolutions@metricsnumero.com from the email address on your account with the subject line "Privacy request" and tell us what you would like. You can also write to us at the postal address in section 2.

To protect you, we verify your identity before acting on a request, usually by confirming control of the email address on your account; we may ask for more information if needed, but only what is needed for verification, and we use it only for that purpose. You may use an authorised agent where the law allows; we may ask for proof of the agent's authority and to confirm your identity directly.

We respond within 30 days of receiving a request, or within a shorter or longer period where the law requires or allows (for example, 45 days under the CCPA, extendable once by 45 days when reasonably necessary). If we need more time, we will tell you why. Requests are free of charge unless they are manifestly unfounded or excessive. If we refuse a request, we will explain why and tell you how to challenge our decision.

14Canada and Québec

Under PIPEDA and substantially similar provincial laws, you can access the personal information we hold about you, challenge its accuracy and have it amended, withdraw your consent subject to legal or contractual restrictions and reasonable notice, and complain to us and to the Office of the Privacy Commissioner of Canada.

If you live in Québec, you also have the right to be informed of the technologies we use that can identify, locate or profile you and how to deactivate them. The Service does not locate you. It profiles you only through the readiness score, patterns, experiment results and safety classifications described in sections 3.5 and 6.10, which use only data you choose to sync or log; section 6.10 explains how to stop them. You also have the right to have your information communicated to you or to another organisation in a structured, commonly used technological format, to ask us to stop disseminating your information or to de-index any hyperlink attached to your name where the conditions in law are met, and to file a complaint with the Commission d'accès à l'information du Québec. Our person in charge of the protection of personal information is the Privacy Officer named in section 2. We ask for your consent separately for each purpose that needs it. The Service's privacy settings are set to the highest level of confidentiality by default: no source is connected, nothing is sent to our AI provider until you give the optional AI consent, no health details are saved, and our team cannot see your conversation text unless you share or report it, except as described in section 6.9.

This policy, our Terms of Service and the wording you agree to in the app are available in French, and if you live in Québec they are presented to you in French first. La présente politique est offerte en français : Politique de confidentialité.

15India

If you are in India, this section supplements the rest of this policy and serves as our notice under section 5 of the DPDP Act and the DPDP Rules, and Rules 4 and 5(3) of the SPDI Rules.

• What we collect and why: an itemised description of the personal data we process is in section 3, and the specific purposes, with the data used for each, are in section 5 and section 6. Your health information is sensitive personal data or information under the SPDI Rules, and we collect it only with your written consent, given electronically in the app.
• Separate consents: your consent to use the Service, your optional consent to share information with our AI provider, and your consent to saving health details are asked for separately. You can withdraw the second and third in the app as easily as you gave them (Profile; Health details), and withdraw the first by deleting your account.
• Who receives it: the service providers listed in section 8.1, located in the countries listed in section 9. The organisation collecting and retaining your information is Metricsnumero Technology Solutions Ltd., at the address in section 2.
• Your rights: to obtain a summary of the personal data we process and the processing activities, and the identities of the parties we have shared it with and what we shared; to correct, complete, update and erase your personal data; to withdraw consent as easily as you gave it; to have your grievances redressed; and to nominate another person to exercise your rights if you die or become incapable. You may choose not to provide information or withdraw consent, in which case we may be unable to provide the Service or a feature of it.
• How to exercise them: in the app as described in section 12, or by emailing our Grievance Officer as described in section 13.
• Grievances: contact our Grievance Officer, named in section 2. We will acknowledge your grievance promptly and resolve it within the period required by law, and in any case within one month.
• Complaints to the regulator: if you are not satisfied with our response, you may complain to the Data Protection Board of India through its online complaint process.
• Age: you must be at least 18 to use the Service in India (see section 17).
• Language: where the law requires, you may ask us for this notice in English or any language listed in the Eighth Schedule to the Constitution of India.

16United States

This section supplements the rest of this policy for residents of the United States and gives the disclosures required by the CCPA and other state privacy laws, to the extent those laws apply to us. Residents of Washington, Nevada and Connecticut should also read our Consumer Health Data Privacy Policy.

16.1 Categories of personal information (last 12 months)

Sources, purposes and retention are described in sections 3, 5 and 10. We have not sold or shared (for cross-context behavioural advertising) any personal information in the last 12 months, including of consumers under 16, and we do not sell or share personal information. We use sensitive personal information only for purposes permitted by law (including providing the Service you request), so there is no need for a "Limit the use of my sensitive personal information" choice. We do not collect, use or sell personal data to train large language models.

16.2 Your rights

Subject to the applicable law, you can request to know, access, correct, delete and receive a portable copy of your personal information, to opt out of sale, sharing, targeted advertising and profiling with legal or similarly significant effects (we do none of these), and not to be discriminated against for exercising your rights. Submit requests as described in section 13. If we deny your request, you may appeal by replying to our decision with the subject line "Privacy appeal"; we will respond within the period required by your state's law and, if we deny the appeal, tell you how to contact your state's attorney general.

16.3 Global Privacy Control and Do Not Track

Because we do not sell or share personal information or engage in targeted advertising, there is nothing for a Global Privacy Control or "Do Not Track" signal to opt you out of; the Service already treats every user as opted out.

16.4 California "Shine the Light"

We do not disclose personal information to third parties for their own direct-marketing purposes.

17Age limits and children

The Service is not directed to children. You must be at least 16 years old to use it, or at least 18 years old if you live in India, and you must confirm this when you start using the Service. Where you provide a date of birth, the app will not accept one below the minimum age. We do not knowingly collect personal information from anyone under these ages. If we become aware that an account belongs to someone under the minimum age, we will delete the account and its data. If you believe a child has given us information, please contact us at the address in section 2.

Users aged 16 or 17 receive more conservative guidance; for example, Thriive does not set calorie targets for anyone under 18.

18Where iThriive is offered

The Service is offered only in the United States, Canada and India, and the app is distributed only in those countries. It is not offered in any other country, including the European Economic Area, the United Kingdom and Switzerland. If we begin offering it elsewhere, we will update this policy, including with the information required by the laws of those places, before doing so.

19Cookies, tracking and advertising

The app does not use cookies, advertising identifiers, third-party analytics, advertising or tracking tools. It stores your sign-in session and preferences on your device so that you stay signed in and your settings are remembered.

These legal pages set no cookies and run no scripts.

Our website at www.ithriive.com is served by our own servers on Amazon Web Services. It sets no cookies and uses no analytics, advertising or tracking tools. It remembers whether you chose the light or dark theme in your browser's local storage, which never leaves your device.

20Changes to this policy

We may update this policy as the Service or the law changes. The "Last updated" date and version at the top show when it last changed, and earlier versions are available on request. If we make a material change, such as using information in a new way, sharing it with a new kind of recipient or changing how we use data from Google, we will tell you in the app and by email at least 30 days before it takes effect, showing what is changing, and, where the law requires, ask for your consent again; the app will ask you to review and accept the new version before you continue. If you do not agree to a change, you can delete your account. If you accept this policy for the first time before its effective date, for example because you create your account then, it applies to you from the moment you accept it.

21Contact and complaints

For questions, requests or complaints about this policy or our handling of personal information, contact our Privacy Officer and Grievance Officer at aisolutions@metricsnumero.com or by post at the address in section 2. For help with the app, see www.ithriive.com/support. We will try to resolve your concern. You also have the right to complain to a regulator, including:

• Canada: the Office of the Privacy Commissioner of Canada, priv.gc.ca, or your provincial privacy commissioner.
• Québec: the Commission d'accès à l'information du Québec, cai.gouv.qc.ca.
• India: the Data Protection Board of India.
• United States: the attorney general of your state; in California, the California Privacy Protection Agency, cppa.ca.gov; and the Federal Trade Commission, reportfraud.ftc.gov.