Your privacy, in plain words

• Mobile number. Required: your account is your verified number, in the app and on joovik.com. We send a one-time sign-in code to it by SMS, or by WhatsApp if you choose WhatsApp on the code screen (SMS is used if WhatsApp fails). We keep that choice for one day.
• Your name, which the app asks for when you sign up. If a family member invited you, the name they typed is used until you change it.
• Optional settings: a profile photo, your bedtime and wake time, a time for a daily check-in call, the companion's name and tone, and your alert sound.
• Your agreement: which version of our health-data notice you agreed to, and when. The app cannot be used without it.

• About you: your gender and age (required in the app), then height, weight, waist, a target weight and date, diet and eating patterns, conditions a doctor has diagnosed, family history, PCOS, pregnancy or breastfeeding, hair changes, activity, sleep, stress, what you have tried before (including GLP-1 medicines) and what brings you here. The onboarding questions after age can be skipped. Programme assessments and plan check-ins are stored the same way.
• What you log: weight and body composition, blood pressure, glucose, heart rate and heart rate variability, breathing rate, steps, exercise, sleep, water, mood, mindful minutes, meals and their nutrition, medicines and whether each dose was taken, periods and symptoms if you track them, GLP-1 side-effect check-ins, and routines. An entry can come from you, from something you told Joovik in a chat, a call or a WhatsApp reply, from a lab report, from a family member you allow to record readings, or from Apple Health or Health Connect.
• Why: to show you your own record and trends, to run your reminders and plans, to let Joovik answer with your history in front of it, to share with the family members you choose, and to give a doctor you book context before your consultation.

Only if you connect them on Profile › Devices and sources and allow each type in your phone's own permission screen. We only read. Nothing is ever written back.

• iPhone, Apple Health: weight, sleep, steps, exercise minutes, active energy, resting heart rate, heart rate variability and breathing rate.
• Android, Health Connect: weight, sleep, steps, exercise and active calories burned.
• The phone's own step counter, with your motion permission: steps and distance.

What comes in is stored with your other logs and used in the same ways. It is not sold, not used for advertising or marketing, and not given to data brokers. We do not train AI models on it; the AI providers that receive it to answer you handle it under their own terms. The readings themselves leave our database only to provide the service: to the AI provider when Joovik uses your figures to answer you, to answer a family member you share with, or to write their family brief; to you through Meta's WhatsApp service, when Joovik's replies there mention them; to family members in the categories you share with them, in the app and in the weekly summary they can ask for on WhatsApp; and, if you join a group challenge, to the other people in it as the days you met the target (see "Challenges"). Our crash reports can name a type of data a sync touched, never a value. Our analytics provider never receives the values either. It does receive a few yes-or-no labels we work out each night, such as whether you log every day or whether your weight has moved less than one percent across at least three of the last six weeks. We never work them out from the steps your phone counts or from data imported from Apple Health or Health Connect (see "Analytics and crash reports in the app").

To stop, turn Joovik off in iPhone Settings › Health › Data Access & Devices, or in Health Connect. What has already come in stays in your record until you delete your account.

Meal photos and meal descriptions you type or say; photos of medicine labels, routines and lab reports; documents you add to your care record; and a face photo if you use Future You. An AI model reads them (after a speech-to-text provider, for anything spoken) and gives you a draft. Nothing goes into your record until you confirm it.

In the app, we do not store meal photos, lab report photos or the Future You face photo. WhatsApp is different: a photo sent there with no food in it, or captioned as a document, is kept as a care document (see "WhatsApp, email and notifications"). Care documents, and the two illustrated portraits Future You draws, are kept until you delete your account. Camera, photos and microphone are permissions you give in your phone's settings.

• Talking or typing in the app. If you speak, your voice goes to a speech-to-text provider. Your words then go to an AI model with the context it needs to answer you: your first name, gender, age, height, weight, BMI, diet, conditions, PCOS and pregnancy status, activity, sleep, stress, goals, today's logs and recent trends, your medicines, what Joovik remembers about you, your last consultation, lab results and cycle. Your phone number is not sent. A spoken reply is made by a text-to-speech provider. We keep the conversation as text, and a recording of your voice so we can check the speech recognition heard you correctly.
• When a family member asks about you. The answer draws only on what you share with them, and their conversation is not stored, in text or audio.
• Calls. Joovik can call you for a daily check-in at a time you set, or you can start a call. Every call is recorded: both voices, a full transcript, notes, a short summary, and things you said (a dose taken, a reading) that become suggested entries for you to confirm. There is no setting that turns recording off; you can always choose not to take a call. The live audio travels directly between your phone and OpenAI. On some calls the replies are spoken by a separate speech engine (IndicF5), and the reply text is also sent to Sarvam AI to be written in the right script. After the call, the transcript goes to an AI model to write the summary and pick out those entries. You see the summary first. It reaches family members with access once you have checked it, or after three hours, and anything urgent reaches them at once. Recordings cannot be played back in the app. Our support staff can open a call's transcript and recording in our support console, and every opening is logged.
• Chat. The chat with Joovik works the same way, with the same context, and can include documents and photos you attach.
• What Joovik remembers. From your conversations and calls, Joovik keeps short notes about your life, with the words they came from, so it does not have to ask again. Each note's text is sent to OpenAI to build a search index of your notes. In chat, Joovik is shown your most recent notes, whatever their age. On calls and on WhatsApp, it is shown your most recent notes and also searches all your notes, whatever their age, for ones related to what you just said; to do that, each line you say on a call and each WhatsApp message you send (other than very short ones) is also sent to OpenAI. On the Talk screen of the simpler layout for parents, notes older than 90 days are left out. Notes are kept until you delete your account. Joovik also writes a daily brief for you and, where you share it, for your family.
• What Joovik said. We keep a record of what Joovik said to you and the information it was looking at, so we can answer if someone asks why it said something. A thumbs up or down you give a reply is counted on that conversation and noted in this record.
• Replies you report. If you are signed in and report a reply in the chat, we keep the reply as it was shown to you (up to 2,000 characters), the reason you picked (unsafe, wrong, offensive or other), any note you write (up to 500 characters) and which conversation it came from. We use it to find and fix replies that were unsafe, wrong or offensive. Our support staff can read it in our support console, and opening it is logged. It is deleted one year after you report it, or earlier if you delete your account. Joovik itself never reads it back.
• What it could not understand. If Joovik cannot make sense of something you said or typed, the words are kept so our team can review them.
• Our staff. People on our team who run consultations or support can read stored conversations with Joovik. In the support console, every conversation and every call opened is logged.

• Invitations. You send an invitation from your own WhatsApp or SMS. We store the invitee's phone number, name, relation and languages. An invitation stops working after 7 days.
• What family can see and do. For each person, sharing is set per category (medicines, food, activity and sleep, vitals, symptoms, conditions, lab results, appointments and AI summaries), each at none, alerts only, summary or detailed. Separately, it sets what they may do: send reminders, add documents, record readings, manage medicines and emergency contacts, book labs and appointments, and order refills.
• The defaults. When you accept an invitation from someone who will look after you, they get every category in detail and every action, until you change it. When the person who set up a circle invites another carer, that carer also gets detailed access, and our records show the person who set up the circle as the one who gave it. The person being looked after can change any of this, pause someone, or stop sharing, from their own phone. Once they have, only they can turn it back on.
• Notifications to family. Push notifications and WhatsApp messages to family members name you and carry short lines, such as that you missed today's call, or the summary line of a call. Each Monday a family member can also ask for your week on WhatsApp: calls answered, doses taken, blood pressure, glucose, steps, sleep and meals, each only if their access covers it. Nothing you said in a conversation is forwarded to family on WhatsApp.
• Emergency contacts: the name, relation and phone number of people to contact.
• Family messages and listening. Voice notes and text messages between family members are stored as the messages. When listening is on, Joovik transcribes the voice messages in the circle, in both directions, and suggests entries for the record of the person being looked after. A person has to confirm each one, and only carers with the matching access see them. Listening is on for every circle unless the person being looked after turns it off ("Listen to my messages", on their own phone); nobody else can. Turning it off deletes the transcripts and suggestions. The voice notes stay, because they are the messages.
• Your own voice. In the standard layout, anyone can stop their voice notes being transcribed with "Don't transcribe my voice notes" on Profile › Privacy. The simpler layout for parents does not have that switch; there, the person being looked after uses "Listen to my messages", which stops transcription for the whole circle. Both switches cover family voice notes only. Neither covers talking to Joovik, WhatsApp voice notes or calls.
• A record of every change to sharing and listening is kept, and is never edited.

• Joining is sharing. If you join a group challenge, the other people in it see your name and which days you met the target. Those days are worked out from your logs, including ones imported from Apple Health or Health Connect. They never see the readings themselves. If you do not join, you are not shown. Once you have joined, people who can still join (those invited, including a friend invited by phone number, and the members of a family circle it was offered to) see on the invitation the first names of up to six people already in, which can include yours, but never anyone's progress. If you started the challenge, they also see your name as the person who started it.
• Inviting a friend. You can invite someone who is not in your family circle by their phone number. The invitation goes from your own WhatsApp. We store the number with the challenge so we can recognise them when they sign in with it. It is deleted with the challenge, which goes when the person who started it deletes their account.

• When you book, in the app or on joovik.com: your name, phone, email, age, height, weight, BMI, conditions and notes, your goal, your assessment answers, a screening result, the slot, the amount and the payment reference. Our care team may also record screening answers, warning signs, consents and urgency.
• The doctor assigned to your consultation sees your name and clinical details, your earlier consultations with us, and reports and documents you share. Our care team sees the booking in order to arrange it.
• The video call. We create a Google Calendar event with a Google Meet link. Its title includes your full name, and your and the doctor's email addresses are added to it as guests. Google does not send its own invitation; our confirmation email carries the link.
• Messages about it. Confirmation and reminder emails, with a calendar file and the Meet link, go through Resend, and updates by WhatsApp. Our team gets a Slack message with your name, phone number, slot and amount when a booking is started, paid, rescheduled, coming up or left unpaid.
• Prescriptions are written by the doctor in our doctor console and stored with a PDF. We email the PDF to you as an attachment through Resend. A metabolic report PDF can be emailed to you the same way. No pharmacy receives your prescription from us; where you take it is up to you.

• When you order tests, in the app or on joovik.com: the tests (which can say something about your health), the name, age, sex and mobile number of each person being tested, the collection address and PIN code, an email for the report, the slot and payment.
• C3 Wellness, the lab booking service we use, receives those names, mobile number, age, sex, address, PIN code, slot and tests, and passes the booking to the partner lab that collects the sample. We look up the town for your PIN code with a public PIN-code lookup service (postalpincode.in). Our server sends it the PIN only.
• Results. The lab's report comes back to us as a PDF, and an AI model reads the results from it.

• Razorpay takes payment for consultations, care plans and lab tests. You type card or UPI details into Razorpay's own checkout, not ours. Razorpay receives the amount, our order reference and a short description of what you are buying, such as "Doctor consultation", "Lab tests" or "GLP-1 care plan". We store Razorpay's order and payment IDs and the status.
• Subscriptions in the app are bought through the App Store or Google Play. RevenueCat manages them for us and receives your Joovik account ID (a random code, not your name or number) and your purchase history. We store each purchase and renewal.

• WhatsApp from Joovik is switched on when you verify your phone number. It carries reminders, check-ins, replies, meal drafts, consultation and lab updates, and family updates, through Meta's WhatsApp service. Turn it off with Profile › Settings › WhatsApp updates, or by replying STOP. Messages you send back are handled as in the app: voice notes go to speech-to-text, and text and photos to the AI model. We fetch photos and voice notes from WhatsApp to read them. Voice notes and meal photos are not stored. A photo whose caption says it is a document, or one with no food in it (such as a prescription, a report or a medicine strip), is saved to your care documents, the same as a document you add in the app, and kept until you delete your account. Our system refuses to send marketing messages on WhatsApp.
• WhatsApp support. If you message our support number, we keep your number, WhatsApp name and the conversation. An AI assistant (OpenAI) answers first, and a person can take over. These messages go through WATI or directly through Meta.
• Email. Resend sends our emails: confirmations, reminders, prescriptions, reports and assessment results. We keep a copy of each email we send, with the address, subject and body.
• Push notifications. If you allow them, your phone's notification token is stored and notifications go through Expo's push service to Apple or Google. A check-in call rings through Apple's call notification service carrying only a call reference and the words "JOOVIK · Daily check-in". Medicine reminders in the app are scheduled on your phone and show the medicine's name there. If WhatsApp from Joovik is on, our servers also send dose reminders on WhatsApp, one message per dose time, naming the medicines due.

• The health assessment. Your answers are saved as you go, under a random ID kept in your browser, and with your name, email and phone if you reach the contact step. We work out a health score and BMI and email you your result. Our team gets a Slack message with your name, phone number, score and BMI so someone can follow up. If you do not book, we may send up to two follow-up emails, about two and seven days later.
• Dr Jo on the website. Your messages go to the AI provider and are stored under a random ID kept in your browser, or under your account if you are signed in.
• Advertising and analytics tags. On our marketing pages (the home page, pricing, our experts, the blog, about, the GLP-1, comparison, cost and guide articles, the calculators, programmes, and this page) we load Google Tag Manager and Google Analytics, Microsoft Clarity, which records how the page is used, and the Meta Pixel, which measures our advertising. These tags can see which of those pages you visit. They are not loaded on the assessment, the Dr Jo page, or any booking, payment, portal or prescription page.
• PostHog receives page views and booking-funnel events from every page, which can include a booking or order ID; record IDs and access tokens are removed from page addresses before they are sent. Some events also carry your screening result, your health-score band, the lab tests you view or add (with their prices), the goal you pick when booking, and the amount you pay. On marketing pages only, it also records clicks and the session, with every field you type into and the Dr Jo chat masked.
• No cookie banner. The site does not show a cookie consent banner at present. You can block these tags with your browser's settings or a content blocker.
• Fonts and errors. Every page loads its fonts from Google Fonts, so Google receives your IP address and browser details. Errors on the site are reported to Sentry without your identity.

• Usage analytics (PostHog). The app records events such as opening the app, the screens you view, the sign-in and onboarding steps, paywall views, purchases started or failed, buttons tapped and errors. Each event carries your device type and system version, the app version and build, which layout of the app you use, whether you have a subscription, and how long since you installed the app; opening the app also sends your time zone. PostHog, like any web service, also sees the IP address the events are sent from. Before you sign in these are tied to a random ID, and after it to your account ID. Property names that suggest health, contact details or message content are dropped before anything is sent. For each AI reply, our server sends the model used, the tokens it cost, how long it took and the names of the tools it used, never your words or its reply. Each night it also sends the yes-or-no labels mentioned above: whether you log daily, whether you have logged nothing for three days, whether you logged anything after your first three days, whether your weight has held steady, your streak and medicine adherence in broad bands, the size of your family circle in bands, and whether you acted on a suggestion in the last week. There is no switch in the app to turn analytics off at present.
• Crash reports (Sentry). When the app crashes or hits an error, Sentry receives the error, where in the code it happened, and a trail of recent app events with console lines removed, query strings stripped from addresses and sensitive fields dropped, together with your account ID. No screenshots are sent.

To open quickly and work offline, the app keeps on your phone a copy of your Home screen's data (your profile, answers, plans, today's readings, medicines and your circle's day), your sign-in session, logs waiting to be sent, and the email address for lab reports. These are encrypted with a key that our server creates once and does not keep, held only in your phone's iOS Keychain or Android Keystore. Until the app has that key (for example, on a first launch without a connection), the copy of Home is not stored at all and the other items are stored unencrypted, then encrypted once the key arrives. The copy of Home is used for at most 24 hours, and it is cleared whenever a different person signs in, and when you delete the app.

Some other things are kept on the phone without that encryption, in the app's private storage, which is left out of phone backups. Among them: your current plan, notes on what you have told Joovik about yourself, a queue of analytics events waiting to be sent, and a queue of what Joovik said to you with a snapshot of your day (your figures, medicines and circle), held until it is sent, usually within a minute.

The iPhone widget shows dose times, not medicine names. A family member's iPhone widget shows the name they call you by, a time and a colour, and, if they switch it on, a one-word status ("Stable", "Check-in" or "No data").

• Your IP address, to limit repeated attempts at signing in, chatting, the assessment and our staff consoles.
• Server logs. If an SMS cannot be sent, the log records the mobile number (never the code).
• A log of privileged changes made by our staff and by doctors.
• When you delete your account, a record of the request, including your phone number, so we can show it was honoured.