Legal
Joriva is a metabolic health platform built for diabetes patients managing serious illness and the family members who support them. We take the privacy of your health information seriously. This Privacy Policy explains what information we collect, how we use it, with whom we share it, and what rights you have over it.
Please read this policy carefully before using the Joriva app. By creating an account and using Joriva, you agree to the practices described here.
Joriva is operated by Our Goose Community LLC, a South Carolina limited liability company doing business as Joriva. We are a direct-to-consumer health technology company — not a healthcare provider, health insurance plan, or healthcare clearinghouse.
Joriva is not covered by HIPAA. We say this not to disclaim responsibility for your health data, but to be transparent about the legal framework that applies to us.
HIPAA applies to healthcare providers, health insurance plans, healthcare clearinghouses, and their business associates. Joriva is none of these things. You enter your own health data into Joriva voluntarily, using your own device, for your own personal management and caregiving purposes. This is confirmed by HHS guidance.
What law does apply to us: The FTC Health Breach Notification Rule (as amended July 29, 2024) explicitly covers health apps like Joriva. We are also subject to the FTC Act and applicable state privacy laws.
We have voluntarily adopted data security practices — encrypted transit, access controls, secure credential storage — consistent with responsible health data stewardship.
This is the core of what Joriva stores. You enter this data voluntarily or it is read from your device's health platform with your explicit permission:
When you search for foods in the meal log, your search terms are sent to the USDA FoodData Central API and/or the Open Food Facts API. No personal health information is sent to these services — only the food name you search for.
We use your health and account information for the following purposes, and no others:
We do not sell your health data. We do not share it with advertisers. We do not share it with data brokers.
We share information only in the following limited circumstances:
| Recipient | What They Receive | Why |
|---|---|---|
| Your linked caregiver | Your glucose readings, logs, and alerts | You explicitly authorized this by accepting the caregiver link |
| Render | Your encrypted data stored on PostgreSQL servers in the United States | Our database host |
| RevenueCat | Subscription status and a pseudonymous user identifier | Subscription management; no health data shared |
| Apple / Google | In-app purchase transaction records | Required for App Store and Google Play billing |
| Expo | Your device push token and notification content (glucose value and alert type) | Delivery of glucose alerts to your device |
| USDA FoodData Central | Food search terms only | Retrieving nutritional data for meal logging |
| Open Food Facts | Food search terms only | Retrieving nutritional data for meal logging |
We may also disclose information if required by law or court order, but we will notify you before doing so unless legally prohibited.
If you link a caregiver to your account, that caregiver can view your real-time and historical glucose readings, logged medications, insulin, meals, exercise, symptoms, blood pressure, weight, and treatment events, as well as your glucose alerts.
You control this relationship. You initiated it by accepting a caregiver invite, and you can terminate it at any time from the Settings screen. Termination immediately revokes your caregiver's access to your data.
Caregivers do not have the ability to enter data on your behalf through the standard interface.
Your health data is stored in a PostgreSQL database hosted by Render in the United States. We use the following security practices:
No system is perfectly secure. We encourage you to use a strong, unique password and to notify us at founder@joriva.health if you suspect unauthorized access.
We retain your health data as long as your account is active. If you delete your account, we will delete your health records, log entries, caregiver links, and device registrations within 30 days. Account deletion can be requested by emailing founder@joriva.health.
Server logs (which do not contain health data) are retained for up to 90 days for debugging purposes.
Joriva is not intended for use by children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us at founder@joriva.health and we will delete the account.
If you are a California resident, the California Consumer Privacy Act (CCPA) gives you additional rights:
To exercise these rights, email founder@joriva.health with the subject line "CCPA Request."
We may update this Privacy Policy as the app evolves or as laws change. If we make material changes, we will notify you by email or through a prominent notice in the app at least 14 days before the change takes effect. Continued use of Joriva after the effective date constitutes your acceptance of the updated policy.
Questions about this policy or your data:
Our Goose Community LLC (Joriva)
founder@joriva.health
joriva.health
We will respond to privacy inquiries within 10 business days.