Privacy Policy

1. Introduction

Riverd LLC, a Wyoming limited liability company ("we," "us," or "our"), operates the Riverd platform at www.riverd.app(the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

The Service is intended for users located in the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States. By using the Service, you consent to such transfer and processing. If you do not agree, you should not use the Service.

2. Information We Collect

Information You Provide

• Account Information: Name, email address, phone number, and professional credentials when you create an account.
• Profile Information: Professional bio, specializations, certifications, photos, and practice page details for service providers.
• Booking Information: Session details, scheduling preferences, and communication between providers and clients.
• Clinical Data: Patient books, session notes, and body map annotations that providers create within the platform. This data is considered sensitive personal information and is subject to enhanced protections described in Section 4.
• Intake Form Responses: when a Provider sends you an intake form, the health information you enter (such as health history, medications, pregnancy status, allergies, and areas of concern), together with your typed signature name, the date and time of signing, the IP address and browser information of the device used to sign, and the version of the consent text you agreed to. This information is collected on a secure link without an account, is processed on your Provider's behalf, and is subject to the protections in Section 4 and the Client Intake Forms section below. While you are filling a form, your in-progress answers are saved only on your own device until you submit.
• Payment Information: When a Provider you book with uses card payments, you enter your card into payment fields hosted by our payment processor. We do not receive or store your full card number. We store a secure payment token and your card's type, last four digits, and expiration date so the Provider can charge it under its stated policy and so you can manage your saved cards.
• Communications: Messages sent through contact forms, support requests, or waitlist signups.

Information Collected Automatically

• Usage Data: Pages visited, features used, session duration, and interaction patterns.
• Device Information: Browser type, operating system, IP address, and device identifiers.
• Cookies and Tracking: We use essential cookies for authentication and session management. We also use Google Tag Manager (GTM) for analytics purposes and PostHog (hosted in the EU) for product analytics — both may set cookies. PostHog records aggregated product events and a user identifier so we can understand how users navigate Riverd; we do not send health, clinical, or other PHI data to PostHog. Essential cookies are required to use the Service. You can block or delete non-essential analytics cookies (Google Tag Manager and PostHog) through your browser settings.

3. How We Use Your Information and Legal Basis

We process your personal information for the following purposes, each with a corresponding legal basis:

• To provide the Service (contract performance): Operating your account, processing bookings, and facilitating connections between providers and clients.
• To connect clients with their providers (contract performance): When a provider adds a client to their practice, we check the email address or phone number the provider entered against existing Riverd accounts solely to offer that client the option to connect their account to the provider's records. A connection is only created when the account holder confirms it from their own logged-in account using a contact detail they have verified as their own. We do not reveal to the provider whether the person they entered has a Riverd account; the provider only ever sees whether a connection is pending or completed, never the underlying account status.
• To send transactional communications (contract performance): Booking confirmations, reminders, and account updates.
• To improve the Service (legitimate interest): Analyzing usage patterns, performance monitoring, and feature development.
• To ensure security (legitimate interest): Detecting fraud, preventing abuse, and maintaining platform integrity.
• To send service and relationship messages (contract performance and legitimate interest): messages about your own account, your practice, or your existing relationship with a practitioner on Riverd. This includes setup and activation guidance from Reed, our AI assistant, which is on by default for new provider accounts, and a one-time message offering a practitioner's client access to their visits with that practice after they complete a form for it. Every such message tells you how to stop further messages, and you can turn them off at any time.
• To send marketing communications (consent): promotional emails that are not about your own account or an existing relationship are sent only with your opt-in consent, which you may withdraw at any time.
• To comply with legal obligations (legal obligation): Tax records, regulatory requirements, and responding to lawful requests.

4. Clinical Data Protection

Clinical and health-related data, including patient books, session notes, body map annotations, and treatment records, is classified as sensitive personal information under applicable privacy laws. We process this data on the basis of your explicit consent, which you provide when creating clinical records within the platform.

This data receives the highest level of protection:

• Clinical data is encrypted in transit and at rest.
• Only the creating provider can access their clinical records through role-based access controls.
• We do not sell, share, or use clinical data for advertising or marketing purposes.
• Clinical data is permanently deleted when a provider deletes their account.
• You may withdraw your consent to clinical data processing at any time by deleting the relevant records or your account.

Client Intake Forms

Providers can send their clients an intake form to complete and sign electronically. For this feature, Riverd acts as a service provider processing the information on the Provider's behalf; the Provider is the custodian of the records.

• Your responses are visible only to the practice that sent you the form. They are never sold, never shared for advertising, and never used to train AI models.
• Your answers are never sent to any AI model. The AI assistance in this feature helps Providers structure their form questions; it has no access to what clients submit.
• Signed forms cannot be edited after submission. You can download a copy of your signed form once, on the screen shown right after you sign; we do not email it to you.
• The form will not accept a date of birth indicating the person completing it is under 18.
• Deletion. You can ask your practitioner to delete your intake information at any time, or contact us directly. Deletion removes your intake responses and signature record; we keep a minimal deletion record that does not identify you, so that the fact a deletion happened is preserved. Your practitioner may be required by their own professional rules to keep copies of client records; that duty is theirs, and they are prompted to export copies before deletion.
• Retention. We keep intake data for as long as the Provider maintains it in their practice records on Riverd, or until you or the Provider delete it, whichever comes first. Deleting a Provider account deletes the intake data it holds. Providers can also clear the AI editing chat history for a form at any time; that history contains the Provider's editing conversation, never client answers.

5. Artificial Intelligence

Riverd uses AI-powered features to assist with practice management, including practice page generation, service suggestions, and administrative automation. Regarding AI and your data:

• AI processes are used to assist and suggest, they do not make automated decisions that produce legal or similarly significant effects on you.
• AI does not access clinical patient data unless you explicitly invoke an AI feature on that data.
• You always have the right to human review of any AI-assisted output.
• AI-generated content (such as suggested bios or service descriptions) is always presented for your approval before publishing.
• Our in-product assistant may proactively send you email to help you set up and run your practice. Every such message identifies itself as AI and includes a way to stop the emails.
• The intake form editor is AI-assisted for form structure only. Client intake answers are never processed by any AI feature.

Connecting Clients and Providers

Providers may invite the clients in their own records to connect a Riverd account so the client can see and manage their sessions. To make this offer, Riverd matches the email address or phone number a provider enters against existing accounts. This matching is used only to present a connection offer to the matched account holder, who must affirmatively accept it from within their own account using a verified contact detail. It is never used to tell a provider, or anyone else, whether a given email address or phone number belongs to a Riverd member. If the matched person declines or does not respond, the provider receives no information about why, and no account data is disclosed. Health and clinical information (patient books, session notes, and body-map annotations) is never shared with a client through this feature and remains governed by Section 4.

After a client completes and signs an intake form, the completion screen may offer to email them a sign-in link so they can see their visits with that practice. The email address shown on that screen is masked and is the address the practice already holds for that client; the sign-in email goes only to that address, only if the client asks for it. If the client does not act on that offer, we may send one follow-up email, once ever per client and practice, inviting them to create an account to see their visits with that practice. That follow-up contains no health information and repeats nothing from the form. Clients who are already connected, or who previously declined connection, do not receive these offers. The same rule as above applies: matching is used only to make the offer, never to reveal account status to anyone.

6. Information Sharing

We do not sell or share your personal information as defined by the California Consumer Privacy Act (CCPA). We may share information with:

• Service Providers (Sub-processors): Third-party services that help us operate the platform, including:
  • Supabase, database hosting and authentication
  • Vercel, application hosting and deployment
  • Google (GTM/Analytics), usage analytics
  • PostHog Inc. (EU), product analytics — we use PostHog to understand how users navigate the product and improve UX. PostHog stores aggregated event data and user identifiers; no health/PHI data is sent.
  • Sentry, application error monitoring
  • Resend (with Brevo as a backup provider), transactional and notification emails
  • Telnyx, SMS delivery for phone verification and notifications
  • Square, card payment processing and card-on-file storage for Providers who enable card payments. Square hosts the card-entry fields and stores card data; Riverd never receives your full card number.
  • OpenAI, AI features (practice page generation, service suggestions, clinical note drafting only when you explicitly invoke an AI feature, and the intake form editor chat that helps Providers structure their forms). Client intake responses are never sent to OpenAI or any other AI model.
  • Anthropic, AI model processing for our in-product assistant and practice-management AI features. Where this assistant is used, we send operational account information about your practice (such as counts, dates, and status indicators) to Anthropic's models to generate guidance and replies. We do not send your clients' clinical notes or other free-text patient records to this assistant.
  • Vercel AI Gateway, the routing layer that forwards AI requests to model providers (such as Anthropic) and helps us manage usage and reliability. This is provided by Vercel, also our application hosting provider listed above.
  Each sub-processor is contractually bound to process data only for the purposes we specify.
• Legal Requirements: When required by law, subpoena, or to protect our rights and safety.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with prior notice to affected users.

7. Google Calendar Integration

Riverd offers an optional two-way integration with Google Calendar so providers can prevent double-booking and have Riverd sessions appear alongside their other commitments. Connecting your Google Calendar is entirely optional, and the integration only activates after you complete the Google OAuth consent flow inside Riverd.

OAuth Scopes We Request

When you connect your Google Calendar, Riverd requests the narrowest set of scopes that supports the feature. We do not request, and cannot use, broader calendar access:

• https://www.googleapis.com/auth/calendar.events.owned, used to write Riverd bookings into the calendar you choose as the write target. This is the narrowest write scope Google offers and only permits Riverd to insert, update, or delete events that Riverd itself created. Events created outside Riverd cannot be modified or deleted by Riverd under this scope.
• https://www.googleapis.com/auth/calendar.events.readonly, used to read events from the calendars you select so Riverd can mark those times as "busy" and prevent double-booking. This scope is also required for Google's push notification channels (events.watch), which is how Riverd stays in sync without constantly polling. Google does not expose a free/busy-only OAuth scope, so events.readonly is the closest available option. At ingest, Riverd projects every event down to four fields, start time, end time, source calendar id, and source event id, and never stores titles, descriptions, attendees, locations, conference links, or attachments.
• https://www.googleapis.com/auth/calendar.calendarlist.readonly, used once at connect time so we can show you a list of your calendars and let you pick which ones to read as busy and which single calendar to write Riverd bookings to. This scope is not used after the initial setup.

What We Do With Google User Data

• Read events from the calendars you select so Riverd can mark those times as busy and prevent double-booking on the platform.
• Write Riverd bookings into the single target calendar you select, so they appear alongside your other commitments.
• Riverd never reads, stores, or displays event titles, descriptions, attendees, locations, or conference links from your Google Calendar. Only generic "Busy" blocks are surfaced inside Riverd.

What We Never Do With Google User Data

• We do not sell Google user data.
• We do not transfer Google user data to third parties, other than Supabase as our infrastructure provider, who is bound by the same restrictions described in this policy.
• We do not use Google user data to train AI or machine learning models.
• We do not use Google user data for advertising of any kind.

How Google Data Is Stored

• Refresh tokensare stored in Supabase Vault, an encrypted secret store. They are never returned to the browser and can only be decrypted server-side through a service-role-gated view used by Riverd's sync workers.
• Busy-block records contain only four fields per event: start time, end time, source calendar id, and source event id. No titles, descriptions, attendees, locations, or links are persisted.

Data Retention for Google Calendar Data

We retain busy-block data only as long as your Google Calendar is connected to Riverd. When you disconnect, all imported busy-block records are deleted and our stored tokens are revoked within 24 hours.

How to Revoke Access

You can disconnect Riverd from your Google Calendar at any time:

• Inside Riverd:open your integrations settings page and click "Disconnect Google Calendar." When you disconnect, Riverd revokes the stored refresh token with Google, closes all active webhook channels (events.watch) so Google stops sending us notifications, deletes the refresh token secret from Supabase Vault, and purges all imported busy-block records. This is completed within 24 hours.
• From your Google account: visit https://myaccount.google.com/permissions and remove Riverd from the list of apps with access to your Google account. This invalidates our tokens immediately on Google's side; the corresponding cleanup on Riverd's side runs on next sync attempt.

Limited Use Compliance

Riverd's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete your personal data without undue delay, typically within 30 days, except where retention is required by law or for legitimate business records (e.g., tax, accounting, and transaction history such as bookings and invoices, which are retained as part of our financial audit trail).

Directory notice records. If your practice was listed in the Riverd directory, we keep a minimal record of the fact that we told you what a listing publishes, and of whether you chose to be listed or to turn your listing off. We keep this so that we can establish or defend a legal claim about whether you were told and whether your choice was honoured.

When you delete your account, this record is stripped down. We keep the date, the type of event, which version of the notice you were shown, which versions of these Terms and this Policy were in force, how and where it happened, and whether you took an action. We do not keep your name, your account identifier, your IP address, your device information, or the description of what you did. Your email address is replaced by a one-way keyed code, so the record cannot be read back to identify you, but can still be matched if you later contact us about it. We keep this stripped-down record for six yearsfrom the date your account is deleted, after which it is permanently deleted.

9. Your Rights

You have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate personal information.
• Deletion: Request deletion of your personal information.
• Data Portability: Receive your data in a structured, machine-readable format (JSON).
• Object/Restrict: Object to or restrict certain processing of your data.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Non-Discrimination: We will not discriminate against you for exercising any of these rights.

To exercise these rights, contact us at our contact page. We will respond without undue delay, typically within 30 days.

10. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users and relevant authorities within 72 hours of discovering the breach, or as otherwise required by applicable law. Notification will include the nature of the breach, the data affected, and steps we are taking to address it.

11. Security

We implement industry-standard security measures including encryption in transit and at rest, role-based access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure.

12. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. Intake forms refuse a date of birth indicating the person completing them is under 18.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. For significant changes, we will provide notice through the Service or via email.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us.

Riverd LLC, www.riverd.app