Privacy Policy

Thryval, Inc., a Delaware corporation ("Company," "we," "us," or "our"), operates the Thryval mobile application, the website at thryval.io, and related services (collectively, the "Platform"). This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal information when you use the Platform. This Privacy Policy applies to all users of the Platform, regardless of how you access it.

Your privacy is critically important to us. Because the Platform deals with health and wellness information, we hold ourselves to the highest standards of data stewardship. Please read this Privacy Policy carefully. By using the Platform, you consent to the data practices described herein.

1. INFORMATION WE COLLECT

We collect the following categories of information:

1.1 Information You Provide Directly

• Account Information: When you register, we collect your name, email address, and password (stored in hashed form). If you use social login, we receive your name and email from the identity provider.
• Profile Information: Any additional information you voluntarily add to your profile, such as age, gender, dietary preferences, or health goals.
• Saved Content: Herbs, medicines, remedies, and other items you save, bookmark, or add to favorites.
• Search Queries: Terms and phrases you enter into the Platform's search functionality, including symptom descriptions, disease names, herb names, and medication names.
• Communications: Messages you send to us through customer support channels, feedback forms, or other communication tools.

1.2 Information Collected Automatically

• Device Information: Device type, operating system, unique device identifiers, browser type, and screen resolution.
• Usage Data: Pages viewed, features used, time spent on the Platform, click patterns, navigation paths, and interaction frequency.
• Location Data: With your consent, we collect approximate geographic location data derived from your IP address or device GPS. You may disable location services in your device settings at any time.
• Log Data: IP address, access timestamps, referring URLs, error logs, and other standard server log information.
• Cookies and Similar Technologies: We use cookies, local storage, and similar tracking technologies as described in Section 1.4 below.

1.3 Health-Related Information

Special Note on Health Data. The Platform collects health-related information through your interactions, including symptoms you search for, diseases you browse, herbal remedies you explore, and pharmaceutical equivalents you view. While this data is sensitive in nature, we want to be transparent: this information is collected to provide and improve the Platform's functionality, not to make medical determinations about you. We treat all health-related data with heightened security and access controls as described in Section 5, and — for residents of Washington State — we honor the additional rights described in Section 8.3.

1.4 Cookies and Similar Technologies

We use the following categories of cookies and similar technologies:

On our website, the Meta Pixel loads only after you click Accept in our cookie banner, wherever you are. Until then, and if you decline, nothing is sent to Meta. You can change your choice at any time with the "Cookie settings" link in the footer of every page. We treat a Global Privacy Control or Do Not Track signal from your browser as a decline. We remember your choice in a first-party cookie and local storage entry named thryval_consent for up to 12 months. You can also manage cookies through your browser settings. Disabling certain cookies may affect Platform functionality.

2. HOW WE USE YOUR INFORMATION

We use your information for the following purposes:

3. AI DATA PROCESSING

This section provides specific detail on how your data is handled in connection with the Platform's AI features.

3.1 How AI Processing Works

When you submit a query using the Platform's AI-powered search or recommendation features, the following occurs:

• Your query is received by our backend systems.
• Our system retrieves relevant records from our proprietary health database (herbs, medicines, symptoms, diseases) based on your query.
• Your query and the retrieved database records are transmitted to a third-party AI language model provider for natural language processing and response generation.
• The AI provider generates a response, which is returned to you through the Platform.

3.2 What Data Is Sent to AI Providers

• The text of your specific query.
• Relevant snippets from our proprietary database (not your personal data, browsing history, or account information).
• A session identifier (rotated per session and not linked to your persistent account identifier) to maintain conversational context within a single session.

3.3 What Data Is NOT Sent to AI Providers

• Your name, email address, or account credentials.
• Your full search history or saved items.
• Your location data.
• Your device information or general usage analytics.

3.4 AI Provider Data Handling

We contractually require our AI service providers to: (a) not retain your query data beyond the time necessary to generate a response; (b) not use your query data to train, fine-tune, or improve their models; and (c) maintain industry-standard security practices. We maintain a Zero Data Retention or equivalent commitment with our primary AI provider where commercially available. You acknowledge that we cannot guarantee the practices of third-party providers and encourage you to review their privacy policies. A list of our AI subprocessors is maintained in Section 4.1(a).

3.5 Human Review

From time to time, authorized Thryval personnel may review AI query logs for quality assurance, abuse prevention, safety review, and improvement purposes. Reviews are conducted under strict confidentiality and access-control policies. We do not associate the content of reviewed queries with your identifiable account information for marketing purposes, and reviewed query content is not shared with third parties except as required for safety, security, or compliance reasons.

4. HOW WE SHARE YOUR INFORMATION

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Service Providers

We share data with third-party service providers who perform services on our behalf, including cloud hosting, payment processing, analytics, customer support, and AI processing. These providers are contractually obligated to use your data only for the purposes specified by us and in accordance with this Privacy Policy.

4.1(a) Current Subprocessors

We maintain the following subprocessor relationships. We will update this list and notify users if material changes occur.

A current and authoritative subprocessor list is published at thryval.io/subprocessors.

4.2 Advertising

We do not display third-party advertising in the Platform, and we do not share your specific Health Information (symptoms searched, conditions viewed, saved remedies) with any advertising partner or ad network. Our analytics provider (Firebase) receives non-health usage information about app interactions but is not provided with health-context labels.

Website ad measurement (Meta Pixel). Only if you click Accept in our cookie banner, our website loads the Meta Pixel from Meta Platforms, Inc. to measure whether our ads on Meta's services lead people to visit our website. When it loads, Meta receives the address of each page you visit on our website and the page that referred you; device and browser information (such as browser type, operating system and screen size); your IP address; and identifiers stored in cookies such as _fbp (and _fbc if you arrived from a Meta ad), together with any Meta cookies already in your browser if you use Meta's services. We do not send Meta your name, email address, search terms, account or app data, or what you click. The pixel never loads in our app or on in-app pages. Meta processes this information under its own terms and privacy policy and may use it to measure and improve ads. You can withdraw consent at any time through "Cookie settings" in the website footer. We then stop loading the pixel and delete the _fbp and _fbc cookies our site can access. Information Meta already received is governed by Meta's policy.

If we introduce any other advertising use of your information, we will provide thirty (30) days' advance notice, update this Privacy Policy, and offer a clear opt-out before any such use begins.

4.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, or to investigate fraud or respond to a government request. Where legally permitted, we will provide notice to you before disclosing information in response to a legal request.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Platform before your information becomes subject to a different privacy policy, where required by applicable law.

4.5 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing.

5. DATA SECURITY

5.1 Security Measures

We implement industry-standard technical and organizational measures to protect your data, including:

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption at rest within our cloud infrastructure using AES-256. Note that information stored on your device is protected by your device's operating-system security controls; we encourage you to use device-level encryption, screen locks, and to keep your operating system up to date.
• Hashed and salted storage of passwords.
• Role-based access controls limiting employee access to personal data on a need-to-know basis.
• Regular security audits and vulnerability assessments.
• Segregation of health-related data with additional access controls.
• Monitoring for unauthorized access attempts and anomalous activity.

5.2 Health Data Protections

Health-related data receives heightened protection, including logical separation from non-health data, restricted access permissions, and enhanced audit logging. While the Platform is not subject to HIPAA (as we are not a covered entity or business associate), we voluntarily adopt security practices consistent with industry best practices for health-related data, and we honor the specific rights of Washington State residents under the My Health My Data Act as described in Section 8.3.

5.3 No Guarantee

Despite our efforts, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your data. You use the Platform at your own risk and are responsible for maintaining the security of your account credentials.

5.4 Data Breach Notification

If we become aware of a security incident that affects the confidentiality, integrity, or availability of your personal information, we will:

• Investigate the incident promptly and contain its impact.
• Notify affected users without undue delay — generally within seventy-two (72) hours of confirming the incident — by email and by in-app notice, including a description of the incident, the categories of information affected, the steps we have taken, and recommended actions for users.
• Notify relevant regulators and, in certain jurisdictions, credit bureaus, as required by applicable law.

6. DATA RETENTION

6.1 Retention Periods

• Account Data: Retained for the duration of your account and for up to thirty (30) days following account deletion to allow for account recovery.
• Health-Related Search Data: Retained in identifiable form for up to twenty-four (24) months, after which it is aggregated and de-identified for analytics purposes.
• Saved Content: Retained for the duration of your account.
• Usage and Analytics Data: Retained in identifiable form for up to thirty-six (36) months.
• Payment Records: Retained as required by applicable tax and accounting laws (generally seven (7) years in the United States).
• AI Query Logs: Retained for up to ninety (90) days for safety and quality assurance, after which the content is de-identified or deleted.

6.2 Deletion

Upon account deletion, we will delete or de-identify your personal data within thirty (30) days, except where retention is required by law or for legitimate business purposes (such as resolving disputes or enforcing agreements). Backup copies may persist for up to ninety (90) days before being purged.

7. YOUR RIGHTS AND CHOICES

7.1 Access and Portability

You have the right to request a copy of the personal information we hold about you in a structured, commonly used, machine-readable format. To make a request, contact us at the email address in Section 12. We will respond within the timeframe required by applicable law (generally thirty (30) days, extendable to forty-five (45) days where permitted).

7.2 Correction

You may update or correct your account information at any time through the Platform's settings. For other data corrections, contact us using the information in Section 12.

7.3 Deletion

You may request deletion of your personal data, subject to certain exceptions (legal obligations, dispute resolution, fraud prevention). To request deletion, use the deletion option in the Platform's account settings or contact us at the email address in Section 12. We will process verified deletion requests within thirty (30) days.

7.4 Opt-Out of Marketing

We do not currently send marketing communications. If we begin sending marketing communications in the future, every such communication will include a clear opt-out mechanism (unsubscribe link or equivalent), and you may opt out at any time. You will still receive transactional and service-related communications necessary to operate your account.

7.5 Location Data

You may disable location data collection by adjusting your device's location permissions. Note that disabling location services may limit certain features of the Platform, such as practitioner search by proximity.

7.6 Cookie Management

The first time you visit our website, a cookie banner lets you accept or decline the Meta Pixel described in Section 4.2. Both choices are equally easy, and declining doesn't change how the website works. You can change your choice at any time with the "Cookie settings" link in the footer of every page. If you withdraw consent, the pixel stops loading and we delete the _fbp and _fbc cookies our site can access. You may also manage or disable cookies through your browser settings. Disabling cookies may affect Platform functionality.

7.7 Do Not Track and Global Privacy Control

Our website honors Global Privacy Control (GPC) and Do Not Track signals. If your browser sends either one, we treat it as a decline: the Meta Pixel does not load and we don't ask you to choose. Under California law, we treat a GPC signal as a valid request to opt out of sale or sharing.

8. STATE-SPECIFIC PRIVACY RIGHTS

8.1 California Residents (CCPA / CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt Out of Sale or Sharing: We do not sell personal information. Our website's Meta Pixel, which loads only with your consent, may be considered "sharing" for cross-context behavioral advertising under California law. You can decline it, or withdraw consent at any time, through "Cookie settings" in the website footer. We also treat a Global Privacy Control signal as a valid request to opt out of sharing.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Information: You may direct us to limit the use of sensitive personal information (including health data) to purposes necessary to provide the Platform.

Authorized agents may submit requests on your behalf with proof of authorization. We will verify your identity before processing any rights request.

8.2 Virginia, Colorado, Connecticut, Texas, Oregon, and Other State Privacy Laws

Residents of states with comprehensive privacy legislation may have similar rights to access, correct, delete, opt out of certain processing, and obtain a portable copy of their data. To exercise these rights, contact us using the information in Section 12. We will verify your identity before processing any rights request and will respond within the timeframe required by your state's law (generally thirty (30) to forty-five (45) days).

8.3 Washington Residents (My Health My Data Act)

If you are a Washington State resident, you have the following additional rights under the Washington My Health My Data Act ("MHMDA") with respect to "consumer health data" as defined in the statute:

• Right to confirm whether we collect, share, or sell your consumer health data.
• Right to access the specific pieces of consumer health data we have collected about you.
• Right to withdraw consent to our collection or sharing of your consumer health data.
• Right to deletion of your consumer health data.
• Right to a list of third parties with whom we have shared your consumer health data.

We do not sell consumer health data. We do not share consumer health data with third parties for cross-context behavioral advertising. We obtain affirmative consent before collecting consumer health data beyond what is strictly necessary to provide a service you have requested, and we do not geofence health-related locations.

To exercise these rights, email support@thryval.io with the subject line "MHMDA Request." We will respond within forty-five (45) days. The MHMDA provides a private right of action; nothing in this Privacy Policy waives that right.

8.4 Nevada Residents

Nevada residents have the right to direct us not to sell certain personal information. We do not sell personal information. To submit a request to opt out of any future sale, email support@thryval.io.

9. INTERNATIONAL USERS

The Platform is operated from the United States. If you access the Platform from outside the United States, you acknowledge that your data will be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your jurisdiction.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we implement appropriate safeguards for international transfers, including Standard Contractual Clauses approved by the European Commission. You have the following additional rights under the General Data Protection Regulation (GDPR), UK GDPR, or equivalent local law:

• Right of access, rectification, erasure, restriction of processing, data portability, and objection.
• Right to withdraw consent at any time where processing is based on consent.
• Right to lodge a complaint with your local supervisory authority.

The legal bases on which we process your personal data are: (a) performance of a contract; (b) your consent; (c) our legitimate interests in operating and improving the Platform; and (d) compliance with legal obligations.

To exercise GDPR rights or contact our data-protection inquiry function, email support@thryval.io.

10. CHILDREN'S PRIVACY

The Platform is not intended for use by individuals under the age of eighteen (18). We do not knowingly collect personal information from children under 18. We comply with the Children's Online Privacy Protection Act (COPPA) as applicable. If we become aware that we have inadvertently collected such information, we will take immediate steps to delete it. If you believe a child under 18 has provided us with personal information, please contact us immediately at support@thryval.io.

11. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. We will notify you of material changes by email, in-app notification, or by prominently posting a notice on the Platform at least thirty (30) days before the changes take effect. The "Effective Date" at the top of this Policy indicates when it was last revised. Your continued use of the Platform after the effective date of any update constitutes acceptance of the revised Privacy Policy.

12. CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Thryval, Inc.

8027 Bethelen Woods Ln

Springfield, VA 22153

United States

• All inquiries (general support, privacy, GDPR / international, MHMDA): support@thryval.io
• Washington MHMDA requests: include the subject line "MHMDA Request"
• GDPR / international data-protection inquiries: include the subject line "GDPR Request"

For rights requests, please include sufficient information for us to verify your identity and specify the right(s) you wish to exercise. We will respond to verified requests within thirty (30) days, or as required by applicable law.

By using the Platform, you acknowledge that you have read, understood, and agree to the data practices described in this Privacy Policy.

© 2026 Thryval, Inc. All rights reserved.

See also Terms & Conditions