Privacy Policy

1. Introduction

Riverd LLC, a Wyoming limited liability company ("we," "us," or "our"), operates the Riverd platform at www.riverd.app (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

Riverd is based in the United States and is used by practitioners, and their clients, in several countries. We and our service providers may process information in the United States and other countries. Where the law requires protection for these transfers, we use recognized safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. For client information we process for a practitioner, those safeguards are part of our Terms of Service (Appendix A).

2. Information We Collect

Information You Provide

• Account Information: Name, email address, phone number, and professional credentials when you create an account.
• Profile Information: Professional bio, specializations, certifications, photos, and practice page details for service providers.
• Booking Information: Session details, scheduling preferences, and communication between providers and clients.
• Client Records: if a practitioner adds you as a client, the name, email address, phone number and appointment details they enter. You may not have a Riverd account. We process this information on the practitioner's behalf; see "If a Practitioner Uses Riverd to Contact You" below.
• Clinical Data: Patient books, session notes, and body map annotations that providers create within the platform. This data is considered sensitive personal information and is subject to enhanced protections described in Section 4.
• Intake Form Responses: when a Provider sends you an intake form, the health information you enter (such as health history, medications, pregnancy status, allergies, and areas of concern), together with your typed signature name, the date and time of signing, the IP address and browser information of the device used to sign, and the version of the consent text you agreed to. This information is collected on a secure link without an account, is processed on your Provider's behalf, and is subject to the protections in Section 4 and the Client Intake Forms section below. While you are filling a form, your in-progress answers are saved only on your own device until you submit.
• Payment Information: When a Provider you book with uses card payments, you enter your card into payment fields hosted by our payment processor. We do not receive or store your full card number. We store a secure payment token and your card's type, last four digits, and expiration date so the Provider can charge it under its stated policy and so you can manage your saved cards.
• Communications: Messages sent through contact forms, support requests, or waitlist signups.
• Email Delivery and Replies: whether an email we sent was delivered, bounced, or reported as spam, which our email provider tells us; and any reply you send to an appointment email that invites you to reply, which we pass on to the practice.

Information Collected Automatically

• Usage Data: Pages visited, features used, session duration, and interaction patterns.
• Device Information: Browser type, operating system, IP address, and device identifiers.
• Cookies and Tracking: We use essential cookies for authentication and session management. We also use Google Tag Manager (GTM) for analytics purposes and PostHog (hosted in the EU) for product analytics. These tools may set cookies. PostHog records aggregated product events and a user identifier so we can understand how users navigate Riverd; we do not send health, clinical, or other PHI data to PostHog. Essential cookies are required to use the Service. You can block or delete non-essential analytics cookies (Google Tag Manager, Microsoft Clarity and PostHog) through your browser settings.
• Session Recordings (Microsoft Clarity): Google Tag Manager also runs Microsoft Clarity, which records how people use our web pages, such as clicks, scrolling, mouse movement and the pages they visit, as session recordings and heatmaps. Clarity runs on our public pages, including practitioners' practice and booking pages, and in the signed-in Riverd app. It does not run on intake form links, invoice links, or the pages for removing or claiming a directory listing. We set Clarity to hide the text on the page and anything typed into forms. In the signed-in app we also mark the app's pages so their text is hidden, which keeps session notes, client names and intake answers out of recordings.

3. How We Use Your Information and Legal Basis

We process your personal information for the following purposes, each with a corresponding legal basis:

• To provide the Service (contract performance): Operating your account, processing bookings, and facilitating connections between providers and clients.
• To connect clients with their providers (legitimate interest): When a provider adds a client to their practice, we check the email address or phone number the provider entered against existing Riverd accounts solely to offer that client the option to connect their account to the provider's records. A connection is only created when the account holder confirms it from their own logged-in account using a contact detail they have verified as their own. We do not reveal to the provider whether the person they entered has a Riverd account; the provider only ever sees whether a connection is pending or completed, never the underlying account status.
• To send transactional communications to account holders (contract performance): booking confirmations, reminders, and account updates for your own Riverd account.
• To send appointment emails for a practitioner (on the practitioner's behalf): when a practitioner uses Riverd to email their clients, including clients without a Riverd account, we send those emails as the practitioner's service provider. The practitioner decides to send them and is responsible for having a legal basis to do so.
• To keep email working and honor stop requests (legitimate interest and legal obligation): we record bounces, spam reports and requests to stop, so we stop emailing addresses that cannot receive our emails or do not want them.
• To improve the Service (legitimate interest): Analyzing usage patterns, performance monitoring, and feature development.
• To ensure security (legitimate interest): Detecting fraud, preventing abuse, and maintaining platform integrity.
• To send service and relationship messages (contract performance and legitimate interest): messages about your own account, your practice, or your existing relationship with a practitioner on Riverd. This includes setup and activation emails signed by Reed, the name we give Riverd's AI, and a one-time message offering a practitioner's client access to their visits with that practice after they complete a form for it. Every such message tells you how to stop further messages, and you can turn them off at any time.
• To send marketing communications (consent): promotional emails that are not about your own account or an existing relationship are sent only with your opt-in consent, which you may withdraw at any time.
• To comply with legal obligations (legal obligation): Tax records, regulatory requirements, and responding to lawful requests.

4. Clinical Data Protection

Clinical and health-related data, including patient books, session notes, body map annotations, and treatment records, is classified as sensitive personal information under applicable privacy laws. We process this data on the basis of your explicit consent, which you provide when creating clinical records within the platform.

This data receives the highest level of protection:

• Clinical data is encrypted in transit and at rest.
• Role-based access controls keep each practice's clinical records apart from other practices and from clients.
• We do not sell, share, or use clinical data for advertising or marketing purposes.
• Clinical data is permanently deleted when a provider deletes their account.
• You may withdraw your consent to clinical data processing at any time by deleting the relevant records or your account.

Client Intake Forms

Providers can send their clients an intake form to complete and sign electronically. For this feature, Riverd acts as a service provider processing the information on the Provider's behalf; the Provider is the custodian of the records.

• Your responses belong to the practice that sent you the form. They are never sold and never shared for advertising.
• Riverd's AI reads your answers only when your practitioner starts an AI feature that uses them, and only for that task. This includes answers you gave before September 25, 2026. The AI that helps your practitioner build the form never sees your answers. Riverd never uses your answers to train AI.
• Your practitioner can connect Riverd to other software they choose and copy your answers there. Riverd does not control those copies, and that software's own terms decide whether it keeps them or uses them to train AI. For questions about them, contact your practitioner.
• Signed forms cannot be edited after submission. You can download a copy of your signed form once, on the screen shown right after you sign; we do not email it to you.
• The form will not accept a date of birth indicating the person completing it is under 18.
• Deletion. You can ask your practitioner to delete your intake information at any time, or contact us directly. Deletion removes your intake responses and signature record; we keep a minimal deletion record that does not identify you, so that the fact a deletion happened is preserved. Your practitioner may be required by their own professional rules to keep copies of client records; that duty is theirs, and they are prompted to export copies before deletion.
• Retention. We keep intake data for as long as the Provider maintains it in their practice records on Riverd, or until you or the Provider delete it, whichever comes first. Deleting a Provider account deletes the intake data it holds. Providers can also clear the AI editing chat history for a form at any time; that history contains the Provider's editing conversation, never client answers.

5. Artificial Intelligence

Riverd uses AI features to help with practice management, such as drafting SOAP notes, building intake forms, and writing your practice page and list of services. These features run on AI models from OpenAI and/or Anthropic, as described in Section 6. Regarding AI and your data:

• AI processes are used to assist and suggest, they do not make automated decisions that produce legal or similarly significant effects on you.
• Riverd's AI reads session notes and intake answers only when you start a feature that uses them, and only for that task. You can start one in Riverd, or through a personal access token you have allowed to do so. An AI assistant you connected can start only one of them, a SOAP note draft from one session's notes, and only if you allowed it. Riverd never starts these features on its own.
• You always have the right to human review of any AI-assisted output.
• AI-generated content (such as suggested bios or service descriptions) is always presented for your approval before publishing.
• Some of our emails to you are signed by Reed, the name we give Riverd's AI. Every one of them says Reed is an AI and has a way to stop them.
• The AI in the intake form editor works on your questions and layout. It never sees your clients' answers.

Personal Access Tokens (API Keys)

You can create a personal access token, called an API key in Riverd, to connect Riverd to other software you choose. A token can read, or read and change, everything in your Riverd account, including session notes and intake answers. A change made through a token applies right away, and Riverd emails you the first time each token makes one. For a limited time afterwards, the change can be undone in Riverd, in Settings under API keys or Assistants, or with a token or connected assistant that can make changes, as long as nothing has changed it since. Emails and texts to your clients that the change causes wait until that time is over, or until the session they are about starts if that is sooner, and are not sent if the change is undone before then.

If you turn it on for a token, that token can also start Riverd's AI features, including ones that read session notes and intake answers, and Riverd shows you a list of the AI runs it starts. Anything a token copies out of Riverd is in your hands from then on. Riverd cannot see, change or delete those copies, and our deletion promises do not reach them. Keep a token as private as your password. You can turn a token off in Riverd at any time, and it stops working right away.

For one year we keep a record of each request a token or a connected assistant makes that reads or changes your data: which token or assistant, the kind of request, the result, the IP address and software it came from, and the time. The record never includes the data it received.

AI Assistants You Connect

You can connect an AI assistant made by another company, such as Claude or ChatGPT, to your Riverd account. You approve each connection in Riverd and choose whether the assistant can only read, or read and make changes. Either way, it can read your practice data, including your clients' details, bookings and session notes. It cannot read your clients' intake answers. Its changes work like a token's: they apply right away, can be undone for a limited time, hold the emails and texts they cause to your clients until then, and Riverd emails you the first time each assistant makes one.

If you turn it on when you connect, the assistant can also ask Reed to draft a SOAP note from a session's notes. Reed reads that session's notes, as described in Section 6, and the draft goes to the assistant. Riverd does not save the draft.

The assistant is not one of our sub-processors. When you connect it, you tell us to give it what it asks for within what you allowed, and its maker handles that information under its own terms and privacy policy and the settings you choose with them. Those may let the maker keep the information or use it to improve its AI. Our promises about Riverd's own AI, such as zero data retention and no training, do not cover an assistant you connect. This is true for Claude too: Anthropic provides AI for Riverd's own features under the terms in Section 6, but when you connect Claude, Anthropic handles what Claude receives under your own agreement with Anthropic.

We keep a record of each connection: the assistant's web address, what you allowed, the version of our Terms you accepted, and when it was connected, last used and disconnected. We store the codes and tokens that connect it only as one-way hashes, and we keep a record of each call it makes, as described above. You can disconnect an assistant in Riverd at any time, and it stops working on its next request. An assistant unused for 90 days is disconnected. Riverd cannot see, change or delete what an assistant already received, and our deletion promises do not reach it.

Connecting Clients and Providers

Providers may invite the clients in their own records to connect a Riverd account so the client can see and manage their sessions. To make this offer, Riverd matches the email address or phone number a provider enters against existing accounts. This matching is used only to present a connection offer to the matched account holder, who must affirmatively accept it from within their own account using a verified contact detail. It is never used to tell a provider, or anyone else, whether a given email address or phone number belongs to a Riverd member. If the matched person declines or does not respond, the provider receives no information about why, and no account data is disclosed. Health and clinical information (patient books, session notes, and body-map annotations) is never shared with a client through this feature and remains governed by Section 4.

After a client completes and signs an intake form, the completion screen may offer to email them a sign-in link so they can see their visits with that practice. The email address shown on that screen is masked and is the address the practice already holds for that client; the sign-in email goes only to that address, only if the client asks for it. If the client does not act on that offer, we may send one follow-up email, once ever per client and practice, inviting them to create an account to see their visits with that practice. That follow-up contains no health information and repeats nothing from the form. Clients who are already connected, or who previously declined connection, do not receive these offers. The same rule as above applies: matching is used only to make the offer, never to reveal account status to anyone.

If a Practitioner Uses Riverd to Contact You

Practitioners use Riverd to manage their appointments. If one of them added you as a client, we hold the details they entered and we may email or text you about your appointments on their behalf. You do not need a Riverd account for this.

• Who is responsible. The practitioner is responsible for your information, and we process it for them. For questions about your information, contact the practitioner first. You can also contact us.
• Software your practitioner connects. Your practitioner can connect software or an AI assistant they choose to Riverd. It can receive information the practitioner keeps about you in Riverd, under its maker's own terms. For questions about it, contact the practitioner.
• What the emails say. Our emails show the practice's name "via Riverd". Appointment reminders give the practice, the date and time, and how to reach the practice. They do not include health details, session notes, intake answers, or the name of the service you booked. Other booking emails, such as confirmations, changes and cancellations, name the service you booked.
• Replies. When an appointment email invites you to reply, your reply goes to a Riverd address and we forward it to the practice. We do not keep the text of your reply, its subject, or the address you sent it from. For 13 months we keep a short record of each forwarded reply: which of our emails it answered, the practice, the result and the time, with a one-way code of the Riverd address you replied to. The practice's activity log for that appointment also notes that a reply was forwarded, but never what it said. The same log notes when a reminder was sent to you or could not be sent, when you stopped emails from that practice, and when an email to you bounced. These notes stay for as long as the practice keeps the appointment. If your reply asks us to stop, we record that as a stop request, which we keep as described in Section 8. Our email provider, Resend, keeps its own copies of emails under its own retention rules.
• How to stop. Every appointment reminder, and every other booking email we send you for a practice, such as a confirmation, change or cancellation, has a link to stop them. You can stop emails from that practice or all emails sent through Riverd. A stop takes effect before the next email is sent, and it applies even if the practitioner's settings say to send. The practitioner can also turn these emails off.
• Not your appointment? Use the same link to tell us. We will stop emailing that address about that practice's appointments.
• Texts. If the practice is on a River or Fjord plan, we may also text you about your appointments with them. Texts come from a number Riverd uses for all practices. Reply STOP to stop all texts from that number, START to get them again, or HELP for help. Message and data rates may apply. We do not sell or share your mobile number or your consent to receive texts with third parties or affiliates for their marketing or promotional purposes. We share them only with the service providers listed in Section 6 that help us run Riverd, such as Telnyx, which delivers our texts.
• No tracking. These emails do not contain tracking pixels or tracked links. Open and click tracking is turned off for the addresses we send them from.
• How long we keep it. We keep your details as long as the practitioner keeps them in Riverd. If the practitioner deletes them or closes their account, we delete them as described in Section 8. Records of stop requests are kept as described in Section 8.

6. Information Sharing

We do not sell or share your personal information as defined by the California Consumer Privacy Act (CCPA). We may share information with:

• Service Providers (Sub-processors): Third-party services that help us operate the platform, including:
  • Supabase, database hosting and authentication
  • Vercel, application hosting and deployment
  • Google (GTM/Analytics), usage analytics
  • Microsoft (Clarity), session recordings and heatmaps of how people use our web pages, as described in Section 2. Text on the page and anything typed into forms are hidden from recordings.
  • PostHog Inc. (EU), product analytics. We use PostHog to understand how users navigate the product and improve UX. PostHog stores aggregated event data and user identifiers; no health/PHI data is sent.
  • Sentry, application error monitoring
  • Resend (with Brevo as a backup provider), transactional and notification emails, including delivery, bounce and spam-report information
  • Telnyx, SMS delivery for phone verification and notifications
  • Square, card payment processing and card-on-file storage for Providers who enable card payments. Square hosts the card-entry fields and stores card data; Riverd never receives your full card number.
  • Stripe, billing for Providers' Riverd plans and extra AI credit packs. Stripe hosts the payment page and stores card data; Riverd never receives your full card number.
  • OpenAI, AI model processing for Riverd's AI features that do not read session notes or intake answers. Each of these features runs on models from OpenAI and/or Anthropic, and we may move a feature from one to the other. They include the AI in the intake form editor, which works on your questions and layout and never sees your clients' answers, and writing your practice page, your list of services and your practice setup. Riverd's own AI features never send session notes or intake answers to OpenAI. If you connect ChatGPT as your assistant, OpenAI receives what you allow under your own terms with OpenAI; see "AI Assistants You Connect". OpenAI does not use our requests to train its models. Our OpenAI requests are not set to zero data retention, so OpenAI may keep them for a limited time under its own terms.
  • Anthropic, PBC (accessed directly or via Vercel AI Gateway infrastructure), AI model processing for Riverd's AI features. Features that do not read session notes or intake answers run on models from OpenAI and/or Anthropic, as described above. SOAP note drafting, and every feature that reads session notes or intake answers, runs only on Anthropic's models. This includes drafting a SOAP note from session notes, when you start it in Riverd, through a personal access token you have allowed to start Riverd's AI, or through an AI assistant you connected and allowed to do so, and the free SOAP note tool on our website. For each feature, we send Anthropic only what the feature you started needs, which can include session notes and intake answers. Our requests are set so that they go only to Anthropic, Anthropic does not keep them after it answers, and they are not used to train AI. These promises cover Riverd's own requests only, not what Claude receives when you connect it as your assistant.
  • Vercel AI Gateway, which carries our AI requests to Anthropic, and only to Anthropic, and helps us track usage. Vercel also hosts Riverd.
  Each sub-processor is contractually bound to process data only for the purposes we specify. We tell practitioners before we add or replace a sub-processor that handles their clients' information, and they can object, as set out in Appendix A of our Terms of Service.
• Software and assistants a practitioner connects: when a practitioner uses a personal access token or connects an AI assistant, we give that software or assistant the information the practitioner allowed, on the practitioner's instructions. They are not our sub-processors, and their makers' own terms apply to what they receive.
• Legal Requirements: When required by law, subpoena, or to protect our rights and safety.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with prior notice to affected users.

7. Google Calendar Integration

Riverd offers an optional two-way integration with Google Calendar so providers can prevent double-booking and have Riverd sessions appear alongside their other commitments. Connecting your Google Calendar is entirely optional, and the integration only activates after you complete the Google OAuth consent flow inside Riverd.

OAuth Scopes We Request

When you connect your Google Calendar, Riverd requests the narrowest set of scopes that supports the feature. We do not request, and cannot use, broader calendar access:

• https://www.googleapis.com/auth/calendar.events.owned, used to write Riverd bookings into the calendar you choose as the write target. This is the narrowest write scope Google offers and only permits Riverd to insert, update, or delete events that Riverd itself created. Events created outside Riverd cannot be modified or deleted by Riverd under this scope.
• https://www.googleapis.com/auth/calendar.events.readonly, used to read events from the calendars you select so Riverd can mark those times as "busy" and prevent double-booking. This scope is also required for Google's push notification channels (events.watch), which is how Riverd stays in sync without constantly polling. Google does not expose a free/busy-only OAuth scope, so events.readonly is the closest available option. At ingest, Riverd projects every event down to four fields, start time, end time, source calendar id, and source event id, and never stores titles, descriptions, attendees, locations, conference links, or attachments.
• https://www.googleapis.com/auth/calendar.calendarlist.readonly, used once at connect time so we can show you a list of your calendars and let you pick which ones to read as busy and which single calendar to write Riverd bookings to. This scope is not used after the initial setup.

What We Do With Google User Data

• Read events from the calendars you select so Riverd can mark those times as busy and prevent double-booking on the platform.
• Write Riverd bookings into the single target calendar you select, so they appear alongside your other commitments.
• Riverd never reads, stores, or displays event titles, descriptions, attendees, locations, or conference links from your Google Calendar. Only generic "Busy" blocks are surfaced inside Riverd.

What We Never Do With Google User Data

• We do not sell Google user data.
• We do not transfer Google user data to third parties, with these exceptions. Our infrastructure providers, Supabase and Vercel, store and process it for us and are bound by the same restrictions described in this policy. Your booking page shows clients the times you are free, which leave out your busy times. If you connect software with an API key, or an AI assistant such as Claude or ChatGPT, it can receive the times you are free and, when a time it tries to book clashes with your calendar, the start and end of that busy time. It never receives event titles or any other event details, and its maker's own terms apply to what it receives.
• We do not use Google user data to train AI or machine learning models.
• We do not use Google user data for advertising of any kind.

How Google Data Is Stored

• Refresh tokens are stored in Supabase Vault, an encrypted secret store. They are never returned to the browser and can only be decrypted server-side through a service-role-gated view used by Riverd's sync workers.
• Busy-block records contain only four fields per event: start time, end time, source calendar id, and source event id. No titles, descriptions, attendees, locations, or links are persisted.

Data Retention for Google Calendar Data

We retain busy-block data only as long as your Google Calendar is connected to Riverd. When you disconnect, all imported busy-block records are deleted and our stored tokens are revoked within 24 hours.

How to Revoke Access

You can disconnect Riverd from your Google Calendar at any time:

• Inside Riverd: open your integrations settings page and click "Disconnect Google Calendar." When you disconnect, Riverd revokes the stored refresh token with Google, closes all active webhook channels (events.watch) so Google stops sending us notifications, deletes the refresh token secret from Supabase Vault, and purges all imported busy-block records. This is completed within 24 hours.
• From your Google account: visit https://myaccount.google.com/permissions and remove Riverd from the list of apps with access to your Google account. This invalidates our tokens immediately on Google's side; the corresponding cleanup on Riverd's side runs on next sync attempt.

Limited Use Compliance

Riverd's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete your personal data without undue delay, typically within 30 days, except where retention is required by law or for legitimate business records (e.g., tax, accounting, and transaction history such as bookings and invoices, which are retained as part of our financial audit trail).

Patient books. Patient books, including body-map drawings, are part of the practice's account. When a practice's account is deleted, its patient books are deleted with it, as described above.

Directory notice records. If your practice was listed in the Riverd directory, we keep a minimal record of the fact that we told you what a listing publishes, and of whether you chose to be listed or to turn your listing off. We keep this so that we can establish or defend a legal claim about whether you were told and whether your choice was honoured.

When you delete your account, this record is stripped down. We keep the date, the type of event, which version of the notice you were shown, which versions of these Terms and this Policy were in force, how and where it happened, and whether you took an action. We do not keep your name, your account identifier, your IP address, your device information, or the description of what you did. Your email address is replaced by a one-way keyed code, so the record cannot be read back to identify you, but can still be matched if you later contact us about it. We keep this stripped-down record for six yearsfrom the date your account is deleted, after which it is permanently deleted.

Stop and delivery records. If you ask us to stop emails, or an email to your address bounces or is reported as spam, we keep a record so we do not email that address again. We keep it after the related account or client record is deleted, because deleting it would start the emails again. We do not store the email address itself. We store a one-way keyed code made from it (HMAC-SHA256), together with the practice it applies to (or all practices), the reason and the date. The code cannot be read back to reveal your address, but it lets us recognize the address when an email is about to be sent to it. We keep this record for as long as Riverd sends email, so your request keeps being honored.

9. Your Rights

You have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate personal information.
• Deletion: Request deletion of your personal information.
• Data Portability: Receive your data in a structured, machine-readable format (JSON).
• Object/Restrict: Object to or restrict certain processing of your data.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Non-Discrimination: We will not discriminate against you for exercising any of these rights.

To exercise these rights, contact us at our contact page. We will respond without undue delay, typically within 30 days.

10. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users and relevant authorities within 72 hours of discovering the breach, or as otherwise required by applicable law. Notification will include the nature of the breach, the data affected, and steps we are taking to address it.

11. Security

We implement industry-standard security measures including encryption in transit and at rest, role-based access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure.

12. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. Intake forms refuse a date of birth indicating the person completing them is under 18.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. For significant changes, we will give notice through the Service or by email, and we may show you a short summary of the changes when you next sign in.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us.

Riverd LLC, www.riverd.app