Privacy Policy

Last updated: June 29, 2026

This Privacy Policy describes how Thrive Health Group Inc. (“SPAN,” “we,” “us,” or “our”) collects, uses, shares, and otherwise processes personal information when you use our platform located at span.joinfridays.com, our mobile applications, and other services delivered through them (collectively, the “Service”). The technology platform underlying the Service is provided by Medis Labs, Inc., a Delaware corporation. By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

Scope of this Privacy Policy. This Privacy Policy applies only to information we collect when you use the Service as defined above. It does not apply to information collected through any marketing website, blog, social media presence, or other web property operated by SPAN separately from the platform at span.joinfridays.com. Information collected through any such separate property is governed by the privacy policy (if any) posted on that property, not by this Privacy Policy. References in this Privacy Policy to “websites” or similar terms refer only to the Service unless expressly stated otherwise.

This Privacy Policy works alongside our Terms and Conditions, Consumer Health Data Privacy Policy, and other applicable agreements. The Consumer Health Data Privacy Policy supplements this Privacy Policy and applies to information that constitutes “consumer health data” under applicable U.S. state law (including the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Act, and the Connecticut Data Privacy Act, as applicable).

Your consent to consumer health data processing. By creating an account and using the Service, you consent to our collection, use, and sharing of consumer health data as described in this Privacy Policy and our Consumer Health Data Privacy Policy. Where applicable Consumer Health Data Laws require your separate affirmative consent for a specific collection or sharing of consumer health data, we will obtain that consent before the relevant activity. You may withdraw your consent at any time as described in Section 7 and in our Consumer Health Data Privacy Policy.

Our services are delivered using a technology platform operated by Medis Labs, Inc., which processes information on our behalf as our service provider and sub-processor.

We may also provide separate or supplemental privacy notices for specific products, services, partners, or features (“just-in-time disclosures”), including at the time we collect personal information for a specific purpose. For example, certain laboratory tests — such as the Galleri® Multi-Cancer Early Detection Test offered by GRAIL — are subject to test-specific patient information sheets and consents that you will be asked to review and acknowledge at the time of order. Where a just-in-time disclosure or test-specific consent applies, that document controls with respect to the personal information it covers.

The personal information we collect may differ depending on your relationship with us. For example, if you are a representative of a prospective enterprise customer or white-label partner, we will collect more limited personal information than if you are an individual who obtains testing and clinical services through the Service. Please consider your relationship with us in the context of reading this Privacy Policy.

ENTERPRISE AND WHITE-LABEL PARTNER DATA

This Privacy Policy does not apply to personal information that we receive from and process on behalf of our enterprise customers and white-label partners while providing services to them under a commercial agreement. For example, if you access the Service through your employer, an insurer, a clinic, or another sponsoring organization, our use of that personal information may be governed by our agreements (including, as applicable, a Business Associate Agreement) with the relevant enterprise customer or white-label partner. If you have questions regarding personal information we process on behalf of an enterprise customer or white-label partner, please direct your questions to that customer or partner.

PROTECTED HEALTH INFORMATION (PHI) IS GOVERNED SEPARATELY

While Thrive Health Group Inc. and its corporate affiliates may operate as a “business associate” as the Health Insurance Portability and Accountability Act (“HIPAA”) defines that term, HIPAA does not apply to all personal information that we process. Information used or disclosed for the provision of clinical services is “protected health information” (“PHI”) under HIPAA and is governed by the Notice of Privacy Practices of the Medical Groups providing your clinical care, including OpenLoop Healthcare Partners, PC and its affiliated professional entities. This Privacy Policy applies to all other personal information we collect, including information you provide when registering for the Service, navigating the Service, communicating with us, and connecting third-party services or devices through the Service. Regardless of whether HIPAA applies, we apply security and privacy protections to your personal information as described in this Privacy Policy and in accordance with our agreements with the Medical Groups.

Our Privacy Principles

Your privacy is fundamental to how we built the Service. We commit to the following:

We do not sell your personal information for money. In the ordinary course of our operations, we do not sell personal information to third parties for monetary consideration. Some sharing for advertising or analytics may be considered a “sale” or “sharing” under certain state laws — see Section 7 for your opt-out rights.
We do not use health-related or genetic information for interest-based advertising. We do not share information about your health, lab results, biomarkers, or genetic data with advertising partners for targeted advertising.
We limit what we collect and how long we keep it. We collect personal information to deliver the Service and retain it only for as long as needed for the purposes described in this Privacy Policy or as required by law.
We will not retroactively reduce your privacy rights. We will not amend this Privacy Policy in a way that retroactively reduces your privacy rights with respect to personal information we previously collected, except where required by law or with your affirmative consent.

1. Information We Collect

We collect personal information from a variety of sources: information you provide directly, information collected automatically, information from third-party sources, and information we infer or generate from other data.

1.1 Information you provide directly.

Identifiers and contact information — name, email address, mailing address, phone number, and date of birth.
Account credentials — username, password, and other authentication information.
Demographic information — age, gender or gender identity, sex assigned at birth, racial or ethnic identity, sexual orientation, and geographic location.
Government-issued identification data — where required for identity verification, fraud prevention, or compliance, we may collect government-issued identification numbers (such as a driver's license or state ID number) and an image of the relevant identification document.
Service-eligibility data — if your access to the Service is sponsored, subsidized, or provided through an employer, gym, health plan, or other Partner Organization, we may collect eligibility information such as the Partner Organization's name, your eligibility status, and a participant identifier.
Payment information — payment method, billing address, and transaction details (full payment card numbers are processed by our payment processor and not stored on our servers).
Health-related data — information you provide about your health history, conditions, symptoms, diagnoses, treatments, medications, supplements, lifestyle, fitness, biomarkers, lab samples and results, medical images, clinical notes, and goals.
Genetic data — if you access genetic testing through the Service, the resulting data may include information about inherited characteristics. Genetic data is treated as a sensitive category of personal information and is subject to additional protections under applicable law.
Audiovisual recording data — photos, videos, and audio recordings, including (where applicable and with appropriate notice from your Healthcare Provider or the Service) recordings of telehealth visits and customer support calls. During clinical visits, AI-enabled transcription and ambient documentation technology may process audio in real time to assist your Healthcare Provider with note-taking. Audio is not retained by these tools after a draft note is generated. The clinical use of this technology is governed by the consents you sign with the Medical Groups.
Relationship data — information about family members, emergency contacts, dependents, or other individuals whose information you provide to us in connection with your use of the Service.
User content — messages, files, photos, prior lab results, and other content you upload, send, or share through the Service.
Communications — the content of your communications with our customer support team, your Healthcare Providers (where applicable), and other communications through the Service.

1.2 Information collected automatically.

Device and technical information — IP address, device identifiers, device type, operating system, browser type and version, language settings, and similar technical information.
Usage information — pages or screens viewed, features used, time spent, navigation paths, click and scroll behavior, search queries, and similar information about your interactions with the Service.
Location information — approximate location derived from your IP address. With your permission, we may also collect precise location information from your mobile device for specific features.
Cookies and similar technologies — information collected through cookies, web beacons, pixels, mobile advertising identifiers, and similar technologies. See Section 5 (Cookies and Tracking Technologies) for details.

1.3 Information from connected devices and third-party services.

Wearable and connected device data — if you choose to connect a wearable device or third-party health app (such as Apple Health, Google Fit, Oura, Garmin, or others), we may receive biometric and activity data from those devices and apps.
Lab and clinical data — lab results, prescription information, and clinical notes flow into the Service from our lab partners, our clinical services partners, and our data orchestration partners as part of providing the Service to you. To the extent this information is “protected health information” under HIPAA, it is governed by the Notice of Privacy Practices of the Medical Groups, not by this Privacy Policy.
Single sign-on and social login — if you choose to register or log in using a third-party identity provider, we receive certain profile information from that provider in accordance with your privacy settings with that provider.
Marketing and analytics partners — we may receive information about you from our marketing partners and analytics providers to help us understand how you found the Service and to measure the effectiveness of our marketing.

1.4 Information we generate or infer.

We generate or infer information from the data described above, including health insights, recommendations, scores, and analytics. We may also de-identify, aggregate, or anonymize personal information for purposes consistent with this Privacy Policy and applicable law.

2. How We Use Information

We use personal information to operate and improve the Service, communicate with you, comply with our legal obligations, and protect our rights and the rights of others. Specifically, we use personal information to:

Provide, maintain, and improve the Service, including troubleshooting, personalization, and product development.
Coordinate with our clinical, laboratory, pharmacy, phlebotomy, imaging, and other partners to deliver the services you request.
Communicate with you, including by email, SMS, in-app notification, and push notification, about your account, lab results, appointments, prescriptions, and Service updates. We may send marketing emails to account holders, which you can opt out of at any time using the unsubscribe link in any marketing email. We send marketing communications by SMS only if you have separately opted in to marketing text messages; you can withdraw that consent at any time (see Section 7). Message frequency may vary, and message and data rates may apply.
Process payments and manage subscriptions and refunds.
Verify your identity, prevent fraud, and protect the security of the Service and our users.
Generate analytics, business intelligence, and aggregated insights to operate and improve the Service.
Conduct research and development, including using de-identified or aggregated information.
Personalize content, recommendations, and (where applicable) advertising.
Comply with applicable law, respond to legal process, and enforce our agreements.

3. How We Share Information

We share personal information only as described in this Privacy Policy or as you authorize. We do not sell personal information for monetary consideration. Some of our data sharing for advertising or analytics purposes may be considered a “sale” or “sharing” under certain state privacy laws — see Section 7 for your opt-out rights.

3.1 Categories of recipients.

Clinical services providers — the Medical Groups (including OpenLoop Healthcare Partners, PC and its affiliated professional entities) and their licensed Healthcare Providers, who use information to deliver clinical services and care coordination.
Laboratory partners — Quest Diagnostics, Labcorp, BioReference, US Specialty Labs, GRAIL (for the Galleri® Multi-Cancer Early Detection Test), and other laboratories that perform testing.
Phlebotomy and specimen collection partners — in-home and partner-facility phlebotomy providers.
At-home test kit manufacturing and fulfillment partners — vendors that manufacture and ship at-home test kits to you under our branding.
Imaging and functional testing partners — imaging centers and functional testing providers that perform DEXA body composition scans (scheduled through the Service via BodySpec, Inc.'s appointment management system and performed at BodySpec's physical scanning locations), MRI, CT, ultrasound, coronary artery calcium (CAC) scans, VO2 max testing, body composition analysis, and similar services where available.
Pharmacies — the Pharmacies that fulfill any prescriptions written by Healthcare Providers.
Lab data orchestration partners — service providers that route lab orders, results, and related clinical data among our laboratory, clinical, and platform partners.
Payment processors — third-party payment service providers that process payments on our behalf.
Communications service providers — vendors that help us send email, SMS, push notifications, and in-app messages.
Cloud infrastructure providers — vendors that host the Service and provide associated infrastructure (databases, storage, content delivery).
Analytics and product intelligence providers — vendors that help us understand how the Service is used and improve it.
Marketing and advertising partners — vendors that help us reach prospective members and measure the effectiveness of our marketing. We do not share Protected Health Information or genetic information with marketing or advertising partners for interest-based advertising. We also do not share your mobile phone number or your text-messaging consent with these partners, or with any other third party or affiliate, for marketing or promotional purposes.
Customer support and operations vendors — vendors that help us deliver customer support, fraud prevention, and other operational services.
Partner organizations (where applicable) — if your access to the Service is sponsored, subsidized, or provided through an employer, gym, health plan, or other Partner Organization, we share certain personal information with that organization to administer your eligibility and access, as described in Section 3.3.
Professional advisors — our lawyers, accountants, auditors, and similar professional advisors.
Affiliates — entities that share common ownership or control with us.
Corporate transactions — in connection with a financing, merger, acquisition, reorganization, sale of assets, bankruptcy, or similar transaction, we may share personal information with counterparties and their advisors.
Legal and law enforcement — we may share personal information when we believe disclosure is necessary to comply with applicable law, respond to valid legal process, or protect the rights, safety, or property of SPAN, our users, or others.

3.2 Service providers and sub-processors.

We work with a network of third-party service providers and sub-processors to deliver the Service. We require each of them to enter into contractual agreements that protect your personal information consistent with this Privacy Policy and applicable law, including (where appropriate) Business Associate Agreements under HIPAA and Data Processing Agreements under applicable state and international privacy laws. We maintain a current list of these service providers as part of our internal compliance documentation. For questions about a specific service provider, or for our current Sub-Processor List, please contact us at spansupport@joinfridays.com. Adding, removing, or changing sub-processors within an existing category does not constitute a material change to this Privacy Policy unless it expands the categories of recipients or changes how previously collected personal information is used. For material changes, see Section 12.

3.3 Partner organization data sharing.

Your access to the Service may be sponsored, subsidized, or provided through an organization you have a relationship with, such as an employer, gym, health plan, or other organization that resells, sponsors, or subsidizes your access (each, a “Partner Organization”). You access the Service under our brand and through our app; a Partner Organization does not operate the Service or provide your clinical care. If a Partner Organization sponsors, subsidizes, or provides your access, the following applies in addition to the rest of this Privacy Policy:

Data we share with the Partner Organization. We share with your Partner Organization only the personal information reasonably necessary to administer your eligibility and access, such as identifiers and contact information, enrollment and eligibility status, and aggregate or de-identified program-level participation metrics. We do not share your clinical records, lab results, or other individually identifiable health information with a Partner Organization unless you specifically authorize it.
How the Partner Organization uses the data. The Partner Organization uses this information for its own purposes, such as administering your eligibility and benefits, communicating with you about the benefit it sponsors or provides, and measuring program participation, in accordance with its own privacy practices. The Partner Organization is contractually obligated not to use any information we share for interest-based advertising involving your health-related information and not to sell your personal information.
The Partner Organization as independent controller. For its own use of your personal information, the Partner Organization is an independent data controller (or analogous role under applicable law) with its own legal obligations. The Partner Organization has its own privacy policy, which we encourage you to review. We do not control, and this Privacy Policy does not govern, the Partner Organization's own use of your information.
Your rights with the Partner Organization. You may exercise privacy rights directly with the Partner Organization under applicable law, using the contact information in the Partner Organization's privacy policy. If you would prefer that we forward your request to the Partner Organization on your behalf, contact us at spansupport@joinfridays.com.
Contractual protections. Where we share information with a Partner Organization, we require a written agreement that includes appropriate data-protection terms and, where the information involves Protected Health Information, a Business Associate Agreement under HIPAA. These agreements impose obligations regarding security, breach notification, restrictions on use, and cooperation in responding to your privacy rights requests.

4. Third-Party Services and Devices

4.1 General.

If you connect a third-party service, social media account, or wearable device to the Service, you authorize that third party to share information with us, and you authorize us to share information with that third party as needed to provide the connected feature. The third party's use of your information is governed by its own privacy policy, not this Privacy Policy.

4.2 Apple HealthKit.

If you use our iOS Mobile App and authorize it to read from or write to Apple HealthKit, the following provisions apply in addition to the general protections in this Privacy Policy:

Scope of access. We access only the specific HealthKit data types you authorize. You may grant or revoke authorization for each data type separately through your iOS device's Settings > Privacy & Security > Health.
No advertising use. We do not use HealthKit data for advertising, marketing, or other use-based data mining purposes.
No third-party sharing for advertising. We do not share HealthKit data with third parties for advertising or data mining purposes.
No sale. We do not sell HealthKit data to any party.
Purpose limitation. HealthKit data is processed solely to provide and improve the Service, including to inform clinical recommendations, surface insights to you, and support your Healthcare Providers' care of you, in accordance with this Privacy Policy and applicable law.
Revocation. You may revoke our access to HealthKit at any time through your iOS device's Settings > Privacy & Security > Health. Revoking access will not delete HealthKit data we have already received; to request deletion of that data, contact us as described in Section 7.

4.3 Google Health Connect.

If you use our Android Mobile App and authorize it to read from or write to Google Health Connect, the following provisions apply in addition to the general protections in this Privacy Policy:

Scope of access. We access only the specific Health Connect data types you authorize. You may grant or revoke authorization for each data type separately through your Android device's Settings > Apps > Health Connect.
No advertising use. We do not use Health Connect data for advertising, marketing, or other use-based data mining purposes.
No third-party sharing for advertising. We do not share Health Connect data with third parties for advertising or data mining purposes.
No sale. We do not sell Health Connect data to any party.
Purpose limitation. Health Connect data is processed solely to provide and improve the Service, including to inform clinical recommendations, surface insights to you, and support your Healthcare Providers' care of you, in accordance with this Privacy Policy and applicable law.
Revocation. You may revoke our access to Health Connect at any time through your Android device's Settings > Apps > Health Connect. Revoking access will not delete Health Connect data we have already received; to request deletion of that data, contact us as described in Section 7.

4.4 Other connected devices and apps.

If you connect other wearable devices or third-party health apps (such as Oura, Garmin, or others), we receive only the data types you authorize through each connection. Those services have their own privacy practices, and we are not responsible for how they collect or use information. Disconnecting a device or app stops further data flow but does not delete data already received.

5. Cookies and Tracking Technologies

We and our partners use cookies, web beacons, pixels, mobile advertising identifiers, software development kits (SDKs), and similar technologies (collectively, “Tracking Technologies”) to operate the Service, remember your preferences, analyze usage, secure the Service, and (where permitted) deliver advertising. This section describes the categories of Tracking Technologies we use and how you can manage them.

5.1 Categories of cookies and tracking technologies.

Strictly necessary — required for the Service to function, including authentication, session management, security, and load balancing. Cannot be disabled.
Functional — remember your preferences, language, and similar settings so the Service works the way you expect.
Analytics and performance — help us understand how the Service is used so we can improve it. Includes vendors such as Google Analytics and similar product intelligence providers.
Advertising and marketing — may be used (where permitted) to help us reach prospective members and measure the effectiveness of our marketing. We do not use these technologies to enable third parties to deliver interest-based advertising to you that is based on Protected Health Information or genetic information. We do not use Tracking Technologies for purposes that would constitute the sale of Consumer Health Data under applicable law.
Mobile identifiers and SDKs — in our mobile apps, we may use embedded SDKs from analytics, communications, and infrastructure providers for the purposes described above. We do not use third-party advertising or attribution SDKs that access mobile advertising identifiers (such as Apple's Identifier for Advertisers or Google's Advertising ID).

5.2 How to manage your preferences.

Cookie banner — when you first access the Service, you may be presented with a cookie banner allowing you to accept, reject, or customize non-essential cookies.
Browser settings — most browsers allow you to block or delete cookies through their settings.
Mobile device settings — iOS Settings > Privacy & Security > Tracking, and Android Settings > Privacy > Ads, allow you to manage device identifiers and limit ad tracking.
Global Privacy Control — we honor the Global Privacy Control (GPC) signal as a valid opt-out request under applicable U.S. state privacy laws.
Ad industry opt-out tools — the Network Advertising Initiative (NAI) opt-out at optout.networkadvertising.org, the Digital Advertising Alliance (DAA) opt-out at optout.aboutads.info, and (for EEA-based visitors) the European Interactive Digital Advertising Alliance opt-out at youronlinechoices.eu. These opt-outs apply per browser and per device.

5.3 Do Not Track.

Some browsers send a “Do Not Track” signal. There is currently no industry consensus on how to respond to this signal, so the Service does not respond to Do Not Track signals. We do honor the Global Privacy Control signal as described above.

5.4 App Tracking Transparency (Apple iOS).

Apple's App Tracking Transparency (“ATT”) framework requires apps to obtain user permission before accessing the Identifier for Advertisers (“IDFA”) for purposes of tracking user activity across other companies' apps and websites. We do not use third-party advertising or attribution software development kits (SDKs) in our Mobile App that access the IDFA. Any advertising-related measurement or attribution we may conduct is described in Section 7 (Interest-based advertising opt-out) and is subject to the limitations and your choices described there.

Health data carve-out. We do not use Protected Health Information, genetic information, Apple HealthKit data, or Google Health Connect data for cross-app tracking or interest-based advertising.

Health-related pages. On pages of the Service that display health-related information (including biomarker results, clinical recommendations, and personalized health insights), we do not run third-party advertising cookies or pixels that share content with advertising partners, and we do not use health-related information to target advertising.

5.5 Third-party tracking technologies.

Some Tracking Technologies are set by third parties whose services appear on the Service, including analytics providers, advertising partners (where applicable), and embedded content providers. These third parties may collect information about your interactions with the Service over time and across other websites and services. Their use of cookies and similar technologies is subject to their own privacy policies, not this one. We do not share Protected Health Information with these third parties through cookies or pixels.

If you would like a list of the specific cookies and Tracking Technologies we currently use, including their names, providers, purposes, and durations, please contact us at spansupport@joinfridays.com.

6. Data Retention

We retain personal information for as long as needed to provide the Service, comply with our legal and contractual obligations, resolve disputes, and enforce our agreements. Retention periods vary depending on the type of information, the context in which it was collected, our legal obligations, and your expectations. When personal information is no longer needed, we delete it or de-identify it. Information governed by HIPAA is retained in accordance with the Medical Groups' policies and applicable law.

Our clinical, laboratory, pharmacy, lab orchestration, and other partners may retain personal information they receive in connection with the Service in accordance with their own retention policies, applicable law, and any agreements you have with them. For example, the laboratories that perform your testing are required by law to retain certain records of testing for periods specified by federal and state laboratory regulations, independent of our retention practices.

7. Your Privacy Choices and Rights

7.1 General choices.

Marketing communications. We send marketing emails to account holders as part of your relationship with us; you can opt out of marketing emails at any time by following the unsubscribe link in any marketing email. We send marketing text messages only to those who have opted in to receive them; if you opted in, you can withdraw your consent at any time by replying STOP to any marketing message, or reply HELP for assistance. By opting in, you consent to receive recurring automated marketing text messages from SPAN at the mobile number you provide; message frequency may vary, and message and data rates may apply. We do not share your mobile number or your text-messaging consent with third parties or affiliates for marketing or promotional purposes. Opting out of marketing communications does not affect transactional and service-related messages (such as appointment reminders, lab result notifications, and billing notifications), which are part of providing the Service.
Marketing based on health-related information. We use your health-related information to personalize the marketing communications we send you only if you have accepted our Authorization for Use of Medical Information, which describes what information we use, the purposes of that use, and how to revoke it. You may withdraw that authorization at any time by contacting spansupport@joinfridays.com or through My account > Privacy & consent. Where we use health-related information for marketing, we do so to determine which of our own communications may be relevant to you; we do not share your consumer health data with advertising or marketing partners for targeted advertising.
Cookie preferences. You can manage cookies through your browser settings, our consent banner, and the controls described in Section 5 (Cookies and Tracking Technologies).
Connected services. You can disconnect any wearable, social, or third-party service from your account at any time through My account > Wearables.
Account. You can update your account information through the Service or by contacting spansupport@joinfridays.com.
Mobile location data. You can disable our access to your device's precise geolocation through your mobile device settings.

7.2 Interest-based advertising opt-out.

To the extent we engage in interest-based advertising for non-health-related products and services (we do not use health-related or genetic information for interest-based advertising), you may limit such advertising through the following mechanisms:

Browser settings — most browsers allow you to block third-party cookies.
Privacy browsers and ad-blocking plug-ins.
Ad industry opt-out tools — the Network Advertising Initiative (NAI) opt-out at optout.networkadvertising.org and the Digital Advertising Alliance (DAA) opt-out at optout.aboutads.info.
Mobile device settings — you can limit use of the advertising identifier associated with your mobile device through your device settings.

These opt-out tools must be applied separately on each device and browser from which you wish to limit interest-based advertising. We cannot guarantee that all our advertising partners participate in these programs.

7.3 U.S. state privacy rights.

Depending on your state of residence, you may have additional rights with respect to personal information we collect. These rights may include:

Right to know / access — to confirm whether we process personal information about you and to request a copy of that information.
Right to correction — to request that we correct inaccurate personal information.
Right to deletion — to request that we delete personal information, subject to applicable exceptions.
Right to data portability — to request a copy of your personal information in a portable format.
Right to opt out — to opt out of the “sale” or “sharing” of personal information for targeted advertising and certain profiling activities.
Right to limit use of sensitive personal information — to limit how we use and disclose sensitive personal information.
Right to non-discrimination — to exercise these rights free from discrimination.
Right to appeal — to appeal our decision regarding your request, where applicable law provides this right.

These rights apply to residents of the following states (subject to each state's specific scope and exceptions): California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and Washington, among others as applicable laws come into effect.

To exercise any of these rights, email us at spansupport@joinfridays.com. To verify your identity, we generally require requests to be submitted from the email address associated with your account. We will respond within the timeframes required by applicable law (generally 45 days, with a possible extension). For health information that the Medical Groups create or hold and for which we act as a business associate, HIPAA rights such as access, amendment, and an accounting of disclosures are exercised through the Medical Groups under their Notice of Privacy Practices, with our support.

7.4 Universal opt-out and Global Privacy Control.

We honor opt-out preference signals sent by recognized universal opt-out mechanisms, including the Global Privacy Control (GPC) signal, as a request to opt out of “sales” and “sharing” of personal information for targeted advertising, where required by applicable law and to the extent we are able to identify your browser's or device's signal. We do not currently respond to other “Do Not Track” signals.

7.5 Authorized agents.

Where applicable law permits, you may designate an authorized agent to submit a privacy request on your behalf. We will require proof of the agent's authorization and may require you to verify your identity directly with us before processing the request.

7.6 Right to limitation (California residents).

California residents have the right to request that we limit the use and disclosure of “sensitive personal information” to that which is necessary for the provision of the Service or as otherwise permitted by the California Consumer Privacy Act. To exercise this right, contact us at spansupport@joinfridays.com with the subject line “California Right to Limitation.”

8. Security and Incident Response

We use reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, and destruction, including encryption in transit and at rest, access controls, vendor due diligence, employee training, and incident response procedures. No method of transmission or storage is completely secure, and we cannot guarantee the security of personal information.

In the event of a security incident affecting personal information, we will: (a) promptly investigate the incident and remediate any vulnerabilities within our control; (b) comply with applicable breach-notification laws and regulations; (c) cooperate with affected users, enterprise customers, and white-label partners as required; (d) document our actions; and (e) conduct a post-incident review to prevent similar incidents. We will notify you of incidents affecting your personal information as required by, and in accordance with, applicable law.

You are responsible for safeguarding your account credentials and for promptly notifying us at spansupport@joinfridays.com of any suspected unauthorized access to your account.

9. Children's Privacy

The Service is not directed to children under 18, and we do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe we have collected personal information from a child under 18, please contact us at spansupport@joinfridays.com and we will take appropriate steps to delete the information.

10. Artificial Intelligence Features

The Service includes features powered by artificial intelligence (“AI”). Some AI features support delivery of clinical services and are required to use the Service; others are optional features you may choose to use. This Section 10 describes the AI features available, the AI service providers we use, the data sent to each provider, the protections in place, and your rights to consent to and revoke AI features.

Your use of any AI feature constitutes your acceptance of the terms in this Section 10. If anything in this Section 10 conflicts with another section of this Privacy Policy with respect to AI features, this Section 10 controls.

10.1 AI features and providers.

The Service includes the following AI features. For each feature, we identify the AI service provider that receives data, the categories of data sent, and the purpose.

Clinical AI features (required for clinical services). The following AI features support the delivery of clinical services by your healthcare providers. These features are foundational to the Service; if you do not consent to these features, the Service is not available to you. AI use during telehealth consultations is also governed by the Telehealth Consent Form of OpenLoop Healthcare Partners, PC, described in Section 10.5.

Medical Live Transcription. During telehealth consultations, audio from your consultation is transcribed in real time by Deepgram. The transcript is returned to your healthcare provider for documentation.
Clinical Assessment Generation. Your consultation transcript, intake responses, and clinical context are sent to OpenAI to generate a structured clinical assessment. The assessment is reviewed by your healthcare provider before it influences your care.
Treatment Plan Formulation. Your clinical context and assessment are sent to OpenAI to generate a proposed treatment plan. Your healthcare provider reviews and finalizes the plan.
Subjective and Objective Clinical Entry. Your consultation transcript and intake data are sent to OpenAI to structure subjective and objective sections of clinical notes for your provider's review.
SOAP Note Summary. Your clinical encounter data is sent to OpenAI to generate a structured SOAP (Subjective, Objective, Assessment, Plan) note format used in your clinical record, reviewed by your provider.
Clinician Recommendations. Your clinical context is sent to OpenAI to generate recommendations for your provider's consideration. The provider uses clinical judgment to accept, modify, or reject recommendations.
Comprehensive Clinician Note. Your full clinical encounter data is sent to OpenAI to generate a comprehensive clinical note for your provider's review and finalization.
Lab Result Interpretation. Your lab results and relevant clinical context are sent to OpenAI to generate interpretation and explanation. The interpretation is reviewed by your provider before it informs your care.
Patient Summary Email Generation. Clinical updates intended for you are drafted by OpenAI for your provider's review before being sent to you via email.
Insurance Card Recognition. If you submit an image of your insurance card, the image is sent to OpenAI Vision to extract card information (name, member ID, group number, payer information). This information is used for billing and care coordination.

Optional AI features. The following AI features are optional. You may opt in or out of these features at any time without affecting your access to clinical services.

AI Coach. The AI Coach is an in-app AI health chatbot. If you use it for general health information or questions, what you enter, along with relevant profile and health information, is sent to OpenAI to generate responses. The AI Coach is informational only and is not a substitute for medical care from your provider.
Chat Conversation Summaries and Routing. If you use the AI Coach, conversation summaries and intent classifications may be sent to OpenAI to provide context to your healthcare provider and to route urgent matters appropriately.
Nutrition Logging. If you use the in-app meal logging feature, food descriptions or food photos are sent to Passio (a third-party nutrition analysis service) for identification and nutrient analysis.

AI service providers. Across the AI features described above, your data may be sent to the following AI service providers:

OpenAI OpCo, LLC (“OpenAI”). We use OpenAI's GPT models for clinical structuring, lab interpretation, chatbot, patient communications, and insurance card recognition features. OpenAI processes Protected Health Information under a Business Associate Agreement with us, with a zero-retention configuration (no data is retained on OpenAI's systems after each response), and is prohibited from using your data to train OpenAI's models.
Deepgram, Inc. (“Deepgram”). We use Deepgram's speech-to-text models for live medical transcription during telehealth consultations. Deepgram processes Protected Health Information under a Business Associate Agreement with us and is prohibited from using your data to train Deepgram's models.
Passio, Inc. (“Passio”). We use Passio's nutrition analysis service for meal logging features. Passio uses additional AI providers in their backend, including OpenAI and Google. Nutrition data is treated as wellness data rather than Protected Health Information; see Section 10.2 for details.

10.2 Protections for your data.

Business Associate Agreements (BAAs). We have signed Business Associate Agreements with OpenAI and Deepgram that comply with the HIPAA Privacy and Security Rules. Under these agreements, the AI providers are obligated to protect your Protected Health Information using administrative, physical, and technical safeguards that provide the same or equal level of protection that we apply, and they cannot use your data for any purpose other than providing the services to us.

Zero retention for OpenAI. Our agreement with OpenAI is configured for zero retention. This means that data sent to OpenAI for processing is not retained on OpenAI's systems after the response is delivered to us. OpenAI does not store your data, log it, or use it to train models.

AI model training. Our policies on AI model training are as follows:

Third-party AI providers. Our agreements with OpenAI and Deepgram explicitly prohibit the use of your data to train the providers' AI models. Your data is used solely to deliver the AI feature you are using — it is not used to improve the providers' models or any models offered to other customers.

Medis Labs proprietary models. Medis Labs does not train proprietary AI models on identifiable Protected Health Information without your explicit consent. Medis Labs may, however, train, fine-tune, or develop AI models that support the Service using aggregated or de-identified data — that is, data that has been processed in accordance with HIPAA's Safe Harbor method (45 CFR § 164.514(b)(2)) or the Expert Determination method (45 CFR § 164.514(b)(1)) such that it can no longer reasonably be linked to you. Where we use aggregated or de-identified data for AI development, your individual records are not retrievable from those models, and you cannot be re-identified from them.

De-identification standard. Data we use for AI model development has the following identifiers removed in accordance with HIPAA Safe Harbor: names, geographic subdivisions smaller than a state, dates directly related to an individual (other than year), telephone numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate/license numbers, vehicle identifiers, device identifiers, web URLs, IP addresses, biometric identifiers, full-face photographs, and any other unique identifying number, characteristic, or code.

No PHI training without consent. If Medis Labs ever wishes to train proprietary AI models on identifiable PHI (rather than de-identified data), we will provide you with advance notice and obtain your explicit, separate consent before doing so. We will not use your identifiable PHI for AI training based on your acceptance of this Privacy Policy alone.

No sale or advertising use. We do not sell your data to AI providers or to any other third party. We do not use your data, or data derived from AI features, for targeted advertising. AI providers are contractually prohibited from doing so as well.

Nutrition data (Passio). Nutrition data sent to Passio (meal descriptions and food images) is treated as wellness data rather than Protected Health Information under our policy. We do not have a Business Associate Agreement with Passio because nutrition data does not constitute PHI in this context. If you prefer not to send food data to Passio, you can opt out of nutrition logging without affecting your clinical services.

10.3 Your consent and opt-in.

Initial consent at onboarding. When you create an account, you are presented with an in-app disclosure of Clinical AI Features. The disclosure identifies the third-party AI services that will receive your clinical data (OpenAI and Deepgram), lists the categories of data sent, and describes the protections in place. Your affirmative consent is required to use the Service. If you decline, you cannot use the Service and your account will not be activated.

Per-feature permission gates. For each optional AI feature (AI Coach, Nutrition Logging, Insurance Card Recognition), the Service presents an in-app permission gate the first time you attempt to use the feature. The gate identifies the specific AI service provider that will receive your data, the specific categories of data sent, and the protections that apply. You must affirmatively consent before any data is sent. If you decline a gate, you may continue using the rest of the Service — declining one optional AI feature does not affect the others or your access to clinical care.

Feature-specific reminders. Within each AI feature, we surface reminders about AI involvement at appropriate points (for example, a visible “AI” indicator during transcription, a disclaimer on AI-generated lab interpretations, and a notice on chatbot responses). These reminders supplement, but do not replace, the initial consent.

Consent applies for the duration of your use of the Service. Once you consent to an AI feature through an in-app permission gate, your consent remains in effect for as long as you continue to use the Service. The Service does not currently support per-feature revocation while you continue to use the Service — in other words, you cannot “turn off” a previously-consented optional AI feature within the app.

How to withdraw consent. If you no longer wish your data to be processed through any AI feature (clinical or optional) for which you have previously consented, you can close your account at any time from My account > Profile info > Delete account. Closing your account terminates your access to the Service and stops further data flow to all AI service providers. You can review your current consents at any time from My account > Privacy & consent. Existing clinical records created with the assistance of AI features remain part of your clinical record retained by your healthcare provider and the Medical Group in accordance with applicable retention requirements; see Data already sent below. Residents of states with Consumer Health Data Laws (including Washington, Nevada, and Connecticut) have additional statutory withdrawal rights described in our Consumer Health Data Privacy Policy.

Data already sent. Account closure does not retroactively delete data that has already been sent to AI providers and incorporated into your clinical record. To request deletion of clinical records, contact Thrive Health Group Inc. at spansupport@joinfridays.com, subject to applicable medical record retention requirements.

10.4 Important limitations.

AI is not your healthcare provider. AI features support, but do not replace, the clinical judgment of licensed healthcare providers. AI-generated content is reviewed by your provider before it influences your care. The AI Coach is informational only and is not a substitute for medical advice. If you have a medical concern, contact your provider directly. If you have an emergency, call 911 or go to the nearest emergency room.

AI can produce errors. AI models can produce inaccurate, incomplete, or misleading information (sometimes called “hallucinations”). We mitigate this through human review by clinical staff for clinical AI features and through reminders on the AI Coach. Despite these mitigations, you should not rely on AI-generated content as the sole basis for any medical decision.

AI Coach limitations. The AI Coach is not designed to handle medical emergencies, urgent symptoms, or mental health crises. If you describe symptoms that suggest an emergency or crisis, the AI Coach will direct you to call 911 or a crisis line, but the AI Coach cannot dispatch emergency services for you and cannot substitute for emergency medical care.

10.5 AI use within telehealth consultations.

AI use during telehealth consultations (including AI scribing, ambient documentation, transcription, and AI-assisted clinical decision support) is additionally governed by the Telehealth Consent Form of OpenLoop Healthcare Partners, PC, which you will be asked to review and accept at the time of your first telehealth visit. The current version is available at openloophealth.com/telehealth-consent.

11. International Users and Data Transfers

The Service is operated in the United States and is intended for use by individuals located in the United States. If you access the Service from outside the United States, you understand that your personal information will be transferred to and processed in the United States, where data protection laws may differ from those of your country of residence. We may also use service providers that operate in other countries; in such cases, we take steps designed to ensure that your personal information receives an adequate level of protection.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this Privacy Policy reflects when it was most recently updated. How we notify you of changes depends on whether the changes are material:

Routine updates — for clarifications, formatting changes, vendor swaps within existing categories, and similar non-material updates, we will update the “Last updated” date and post the revised Privacy Policy on the Service.
Material changes — for material changes (such as new categories of personal information collected, new uses of personal information, or new categories of recipients), we will provide notice through the Service user interface, by email, or by other reasonable means before the change takes effect.
Material changes affecting use of previously collected information — where required by law or where the change would expand the use of personal information that we previously collected (such as new sharing for targeted advertising or new use of personal information for AI training), we will obtain your affirmative consent before applying the change to that information.

As stated in our Privacy Principles, we will not retroactively reduce your privacy rights with respect to personal information we previously collected, except where required by law or with your affirmative consent. Your continued use of the Service after a routine or material change becomes effective constitutes your acceptance of the updated Privacy Policy. If you do not accept the updated Privacy Policy, you may stop using the Service and may exercise your privacy rights as set forth in Section 7.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Thrive Health Group Inc.

Attn: Privacy Officer

17322 Murphy Ave, Irvine, CA 92618

Email: spansupport@joinfridays.com