Privacy Policy

1. Introduction

Joy CareBot ("the App"), developed by Spiritify.ai ("we", "us", "our"), is an AI-powered wellness companion that helps users monitor their health, converse with AI agents, manage calendars, and journal their emotions. This Privacy Policy describes how we collect, use, store, and share your information when you use the App.

By using the App, you agree to the collection and use of information as described in this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Password (encrypted, never stored in plaintext)
• Name (first and last, optional)
• Date of birth (optional)
• Gender (optional)

If you sign in using Google or Apple, we receive an authentication token from the provider containing your name and email address. We do not receive or store your Google or Apple password.

2.2 Health and Fitness Data

With your explicit permission, the App reads the following data from Apple HealthKit:

• Heart rate (current, minimum, maximum)
• Heart rate variability (HRV)
• Blood oxygen saturation (SpO2)
• Body temperature
• Step count
• Calories burned
• Walking/running distance
• Active exercise minutes
• Sleep duration and stages (deep, light, REM)

This data is synced to our servers periodically (approximately every 5 minutes while the App is open, and approximately every 15 minutes in the background) to provide personalized wellness insights. Health data is never used for advertising or shared with third parties.

2.3 Voice and Conversation Data

When you use the voice chat feature:

• Microphone audio is captured and streamed in real-time to our servers for speech-to-text processing
• Your spoken words are processed by our AI language model to generate responses
• Conversation transcripts (text only, not audio recordings) are stored in your chat history
• You can view your chat history within the App

2.4 Calendar Data

If you choose to link your calendar, we access event titles, descriptions, dates, and times from Google Calendar, Microsoft Calendar, or Apple Calendar. We use this data to provide reminders and schedule wellness activities. Calendar access requires separate authorization through the respective provider (Google or Microsoft OAuth).

2.5 Device Information

We collect a unique device identifier (generated and stored locally on your device), device platform (iOS or Android), and app version.

2.6 Spiritify Hardware Device

If you use a Spiritify companion device (sold separately), the App displays device status information such as battery level and connectivity status. This data comes from the Spiritify hardware device, not from your personal phone or tablet.

2.7 Caregiver Data

If you add a caregiver, we collect their name, email address, and relationship to you. Caregivers may view your health summaries and activity data.

2.8 Avatar Images

If you upload a custom avatar for your AI agent, the image is stored on our servers.

3. Information We Do NOT Collect

• GPS location or precise coordinates (we only use your device timezone for scheduling)
• Contacts or address book
• Browsing history
• SMS or call logs
• Biometric data (Face ID and fingerprint data remain on your device and are never transmitted to our servers)
• We do not use any third-party analytics, advertising, or tracking services

4. How We Use Your Information

We use your information to:

• Provide and maintain the App's functionality
• Deliver personalized AI wellness conversations
• Display health insights and trends based on your HealthKit data
• Send local notification reminders for upcoming calendar events
• Enable caregiver access to your health summaries (if you choose to link a caregiver)
• Authenticate your identity and secure your account
• Improve and develop our services

5. Data Storage and Security

5.1 Local Storage

Authentication tokens and biometric preferences are stored in your device's secure enclave (iOS Keychain / Android Keystore) using industry-standard encryption. No health data is stored locally in a database; it is read from HealthKit and transmitted to our servers.

5.2 Server Storage

Your account data, health snapshots, conversation history, and calendar events are stored on our servers. All data transmitted between the App and our servers is encrypted using HTTPS (TLS/SSL). Real-time voice communication uses encrypted WebSocket connections (WSS).

5.3 Authentication Security

Passwords are encrypted and never stored in plaintext. Access tokens expire after a limited period; refresh tokens are valid for 30 days. You may enable biometric authentication (Face ID or fingerprint) for additional security.

6. Data Sharing

We do not sell, rent, or trade your personal information. We share data only in the following circumstances:

• Caregivers: If you link a caregiver, they may view your health summaries, activity data, and alerts
• Service Providers: We use secure cloud infrastructure to host our servers; these providers process data on our behalf under strict confidentiality agreements
• Authentication Providers: When you sign in with Google or Apple, those providers receive confirmation of your authentication but do not receive your health or conversation data
• Calendar Providers: When you link Google or Microsoft Calendar, those providers facilitate calendar data access per their own privacy policies
• Legal Requirements: We may disclose information if required by law, regulation, or legal process

7. HealthKit Data

In compliance with Apple's HealthKit guidelines:

• Health data accessed through HealthKit is not used for advertising or marketing purposes
• Health data is not sold to third parties, including data brokers or information resellers
• Health data is not shared with third parties for their marketing or advertising purposes
• Health data is used solely to provide the App's health and wellness features to you
• Background health sync runs periodically to keep your wellness insights up to date

8. Children's Privacy

The App is intended for users aged 18 and above. We do not knowingly collect personal information from individuals under 18. If you believe someone under 18 has provided us with personal information, please contact us and we will promptly delete it.

9. Your Rights

You have the right to:

• Access your personal data stored in the App
• Correct inaccurate personal information through the App's profile settings
• Delete your account and associated data by contacting us
• Withdraw consent for HealthKit access at any time through your device's Settings
• Revoke calendar access through your Google or Microsoft account settings
• Disable biometric authentication through the App's settings

10. Data Retention

• Account data is retained as long as your account is active
• Conversation history is retained as long as your account is active
• Health data snapshots are retained as long as your account is active
• Upon account deletion, we will delete your personal data within 30 days, except where retention is required by law

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the App. Your continued use of the App after such changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us: