Consumer Health Data Privacy Policy

1. Scope of This Policy

This policy describes how Our Goose Community LLC, doing business as Joriva ("we," "us"), collects, uses, and shares consumer health data as defined by the Washington My Health My Data Act (MHMDA). It applies to Washington residents and to any person whose consumer health data is collected in Washington.

This policy supplements our Privacy Policy, which describes our practices in full. Capitalized terms not defined here have the meanings given there. Where this policy and the Privacy Policy overlap, the protections that are stronger for you apply.

2. Categories of Consumer Health Data We Collect

Joriva is a health app: nearly everything you choose to enter is consumer health data. The categories we collect are:

• Glucose data — continuous glucose monitor (CGM) readings, manually entered finger-prick readings, and historical readings you import from files
• Medication and insulin information — your regimens, doses, logged medications and insulin, and skip/hold records including any reasons you write
• Food and nutrition logs — meals, foods, and macros you record
• Other health logs — symptoms, blood pressure, weight, mood, and treatment events you record
• Sleep and activity data — only if you turn on the optional Sleep & Activity feature (sleep sessions, heart rate variability, resting heart rate, respiratory rate, workouts)
• Clinical profile information — conditions and care context you choose to provide
• Derived health information — patterns, trends, and insights the app computes from your data (for example, glucose pattern summaries in your reports)

We do not collect your location, and we do not use geofencing of any kind.

3. Sources of Consumer Health Data

• You — data you enter in the app
• Your linked caregiver — entries a caregiver you have approved logs on your behalf (each entry records who logged it)
• Apple HealthKit — glucose readings (and optional sleep/activity data) synced only with your explicit device-level permission
• Files you import — for example, a Dexcom Clarity CSV export

4. Why We Collect It

We collect and use consumer health data only to provide the Joriva service you request: displaying your data to you and to the caregivers you link, sending the alerts and reminders you configure, generating the doctor reports you create, and computing the in-app insights the product provides.

We obtain your consent to collect this data separately from any consent to share it. We do not use consumer health data for advertising, and we never send health data to advertising or marketing technologies.

5. How We Share It

• Caregivers you link — sharing you control by accepting or ending the caregiver link
• Service providers (processors) — vendors that host and operate the service on our behalf under contract, as listed in Section 6 of our Privacy Policy (for example, our cloud hosting provider and our push-notification delivery service). Food-database lookups send only the search term, never your identity or health records
• Legal requirements — if required by law, as described in the Privacy Policy

We do not sell consumer health data. No third party receives your health data for advertising or marketing purposes. We have no affiliates.

6. Your Rights and How to Exercise Them

Under MHMDA you have the right to:

• Confirm whether we collect, share, or sell your consumer health data, and access that data, including a list of the third parties with whom we have shared it
• Withdraw consent to our collection and sharing of your consumer health data
• Delete your consumer health data — including data held by our processors and data the app has derived from it

To exercise any of these rights, email privacy@joriva.health with the subject line "Washington Health Data Request." We may need to verify that the request comes from you (or your authorized agent) before acting on it.

Timing: we will respond to verified requests within 45 days, extendable once by a further 45 days where reasonably necessary (we will tell you if so). If you delete your account, our standard deletion commitment in Section 9 of the Privacy Policy — deletion of your health records within 30 days — also applies.

7. Appeals and Contact

If we decline all or part of your request, we will tell you why in writing. You may appeal by replying to our response (or emailing privacy@joriva.health with the subject line "Appeal — Washington Health Data Request"). We will respond to your appeal in writing with an explanation of our decision. If your appeal is unsuccessful, you may contact the Washington State Attorney General at www.atg.wa.gov.

Our Goose Community LLC (Joriva)
privacy@joriva.health
Charleston, South Carolina