Privacy Policy

Who this covers

This policy applies to the Thriv3 web app, the Thriv3 mobile apps, and any child profile, session note, goal, or message you create within them.

Information we collect

• Account details — your name, email address, and the sign-in method you choose (email, Google, or Apple).
• Child & care information— a child's first name, date of birth, therapy goals, session notes, and progress you or your care team record. This can include health-related information, which we treat as sensitive.
• Care-circle relationships — who is a guardian, caregiver, viewer, or therapist for a child, and the organisation (if any) a therapist belongs to.
• Technical data — basic device and log information needed to keep the service secure and working, and a push-token if you enable reminders.
• Usage statistics— which pages and screens are opened and which features are used, with no child or personal information attached. See “Cookies & usage analytics” below for the choices you have.

How we use it

• To provide the core service — recording and sharing a child's progress with the people you invite.
• To send reminders and notifications you have opted into.
• To secure accounts, prevent abuse, and support you.

We do notsell your personal information, and we do not use a child's health information for advertising.

Cookies & usage analytics

Some cookies are strictly necessary — they sign you in and keep your session secure. These are always on, because without them the service cannot work.

Separately, we measure how the product is used — which pages and screens get opened, and which features are used — so we know what to improve. This uses Google Analytics. It never includes a child's name or information, your name, your messages, session notes, goals or scores, and we never pass Google any identifier that maps back to a child or a person. We do not advertise, and advertising signals are switched off permanently.

• On the website, nothing is measured until you accept in the cookie banner. If you decline, no analytics is loaded at all. You can change your answer at any time in Settings.
• In the mobile apps, usage statistics are on by default and can be turned off at any time under Settings → “Send anonymous usage statistics”.

This is not the same as the “Improve Thriv3 with anonymised data” option, which is a separate, opt-in choice about contributing a child's progress to aggregate research.

Who can see a child's data

Only the people in that child's care circle. A guardian controls who is invited and can remove members or delete the child's data at any time. Therapists see only the children assigned to them. We access your data only where needed to operate, secure, or support the service.

Storage & security

Data is stored with our infrastructure provider (Supabase) using encryption in transit and at rest, protected by row-level access rules so each account sees only what it is entitled to. No system is perfectly secure, but we work to protect your information using industry-standard measures.

How long we keep your data

• While your account is active— we keep a child's profile, sessions, goals, notes, and progress for as long as the account or care circle they belong to stays active, so the care team keeps the history it needs.
• When you delete— when a guardian deletes a child, we permanently remove that child's identifiable records and remove the child from the de-identified dataset. When you request deletion of your account, your access ends straight away and your login and profile are deleted permanently 30 days later; until then a deletion made in error can be reversed. Care records you wrote for a child (for example a therapist's session reports) stay with that child and their organisation, shown as written by a former team member. We keep a private, staff-only record of who wrote them so a mistaken deletion can be reversed; the email in it is replaced by an unreadable code when your login is deleted. Records that belong to others (for example a child co-managed by another guardian) are retained by their owner.
• Backups & legal holds — residual copies may persist in encrypted backups for a short period before they are overwritten, and we may retain limited information for longer where the law requires it.
• Technical logs — basic security and device logs are kept only as long as needed to keep the service secure, then removed.

Your choices & rights

• Access, correct, or export a child's data from Settings (guardians).
• Delete a child from Settings, or request deletion of your account and its associated records.
• Turn reminders on or off at any time.
• Contact us to exercise any privacy right available to you under your local law.

Children

Thriv3 is designed to be used by adults (guardians and care professionals) on behalf of a child. Children do not create their own accounts. Guardians are responsible for the information they add about a child and for who they invite into the care circle.

Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected by the “last updated” date above and, where appropriate, communicated in the app.

Contact

Questions about your privacy? Email privacy@getthriv3.com.