Privacy Policy
At Thrive360AI, we are committed to protecting your privacy and ensuring the security of your personal information.
1 · Introduction
Welcome to Cora. Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you use our mobile application, provider dashboard, website, and related services.
Cora is designed to provide provider-configured support tools, check-ins, reminders, structured exercises, and general information about mental health. It is not a human therapist, licensed healthcare provider, crisis service, or substitute for professional medical advice, diagnosis, therapy, treatment, medication advice, suicide-risk assessment, or professional clinical judgment. Your licensed provider remains responsible for your care.
Cora is not monitored for emergencies. If you may hurt yourself or someone else, feel unsafe, or need urgent help, call or text 988, call 911, contact your provider directly, or go to the nearest emergency department immediately.
2 · Information we collect
We collect the following types of information:
Personal information: Name, email address, phone number, provider or clinic information, account information, health, wellness, care-related information, and other details you provide when registering or using our services.
Usage Data: Information about how you interact with the app, including chat interactions, check-ins, structured exercises, reminders, session duration, preferences, progress information, and provider-assigned activities.
Device and Technical Data: IP address, device type, operating system, and other technical identifiers.
We do not use user data, either anonymized or pseudonymized, to re-train our AI models.
3 · How we use your information
We use your information to provide and improve our provider-configured support services, personalize your experience and support provider-assigned activities, make information available to your provider or clinic where applicable, ensure security, detect fraud, comply with legal obligations, and conduct research and analytics to enhance our platform in accordance with this Privacy Policy and applicable law.
4 · Sharing your information
We do not sell your personal information. However, we may share personal information with your provider or clinic where applicable, service providers (third parties that help us operate, secure, and improve our app), authorities when required by law or to protect our rights, and in case of mergers, acquisitions, or business restructuring. We do not use or disclose personal information for cross-context behavioral advertising.
5 · Data security
We implement administrative, technical, and organizational security measures designed to protect your data. Data processed by the AI component is stored in secure cloud servers (AWS / Azure) located in the United States. Data is protected using AES-256 encryption at rest and TLS in transit. Our security program is designed to align with applicable NIST and OWASP secure storage standards.
Our security program includes regular penetration testing and vulnerability assessments. Where applicable, our services are designed to support obligations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH Act), including applicable breach notification requirements, and applicable federal and state privacy, security, and healthcare AI requirements when configured and used as intended. If you submit a request to delete your information, we will respond within legally required timeframes and, where feasible, address that request in accordance with applicable law and our retention practices.
6 · AI capabilities, risks & limitations
Our AI component provides provider-configured support tools, structured exercises, check-ins, reminders, and informational resources only. It cannot diagnose, treat, provide therapy, provide medication advice, conduct suicide-risk assessment, respond to emergencies, or replace professional clinical intervention.
We conduct risk assessments and robustness testing for our AI features. The AI component includes technical and procedural filters designed to reduce the risk of harmful or inappropriate content.
7 · Your rights & choices
Depending on your jurisdiction, you may have rights to access, correct, delete, or receive a copy of your personal information, opt out of marketing communications, and restrict or object to certain data processing activities. You may also contact your provider or clinic for requests involving records maintained by them.
8 · Data retention and deletion
We retain your personal information for as long as reasonably necessary to provide our services, support provider or clinic workflows, maintain security and audit records, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods may vary based on the type of information, the provider or clinic relationship, legal requirements, and operational needs. When information is no longer needed, we delete, de-identify, or aggregate it in accordance with our retention practices and applicable law.
9 · Children's privacy
Our app is intended for users aged 13 years and above only where use has been authorized by a provider or clinic and any required parent or guardian consent has been obtained. Users under 18 may be subject to additional consent, access, and safety requirements. We do not knowingly collect data from children under 13 without required consent.
10 · Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be posted within the app or otherwise made available through our services. Material changes will take effect as described in the notice provided, subject to applicable law.