Tovkin Privacy Policy

Draft — requires attorney review. Not legal advice. Do not publish until an attorney has reviewed it and the app builder has confirmed every statement marked [CONFIRM] against the built app (see docs/legal/APP-CONSISTENCY-CHECKLIST.md).

Replaces the waitlist-only notice at src/privacy.html. The company is not yet formed; every "[Tovkin, Inc.]" below is a placeholder for the legal entity.

Last updated: [date]. Version: 0.1 (draft 2026-10-16).

This policy explains what [Tovkin, Inc.] ("Tovkin", "we", "us") collects when you join or use Tovkin, why, who sees it, and the choices you have. The short version:

• Your health information is yours. We use it to run Tovkin for you. We do not sell it, rent it, or use it for advertising.
• No ad or analytics trackers. We do not run advertising or tracking scripts in Tovkin.
• Nobody sees your results unless you say so. Not your friend who invited you. Not your plus-one. They see only what you turn on, item by item, and you can turn it off.
• You can export or delete your data from inside the app or by emailing hello@tovkin.com.
• Tovkin uses AI. Your questions and uploads are processed by an AI service to produce answers. That is disclosed in detail below and in our AI Disclosure.
• Tovkin gives health information, not medical advice. In an emergency, call 911.

Washington, Nevada and other states give extra rights over "consumer health data". Our Consumer Health Data Privacy Policy covers those. California residents: see section 11.

1. Who we are

[Tovkin, Inc.], a [Delaware] corporation, [address]. Contact: hello@tovkin.com. Privacy requests: hello@tovkin.com (subject "Privacy").

Tovkin is for adults (18 and over) who live in the United States. For now we don't offer Tovkin outside the US, and we don't collect information from people who live elsewhere on purpose. At sign-up we check that you are in the US using your connection's country, and we keep only the yes/no result, not your country or IP address. If we learn that a member lives outside the US, we will email them, offer a copy of their data, and delete the account after 30 days.

We do not knowingly collect information from children. If you think a child has given us information, tell us and we will delete it.

2. What we collect

Information you give us

Information we collect automatically

• Basic technical data your browser sends (IP address, device type, pages requested, time). Our hosting provider keeps server logs for security and reliability [CONFIRM log retention].
• If you use the website forms: a one-way hash of your IP address kept up to 24 hours to stop abuse.
• Cookies: only what is needed to keep you signed in (a session cookie). We do not set advertising or analytics cookies. [CONFIRM no analytics; app builder to list every cookie / local storage key].

Information from others

• If someone sends you a Tovkin: they give us your email address (and maybe a first name) so we can deliver the invite. We email you once with the invite and no more than [one reminder] unless you join.
• If you are someone's plus-one: we receive what that member chooses to share with you.
• Health providers (future): when you ask us to request records, we receive them from the provider. Lab, wearable and record connections are coming soon and are not live. We will update this policy before they are.

We do not buy data about you from data brokers.

Do Not Track and cross-site tracking

Tovkin doesn't track you across other websites or apps, so there is nothing for a browser's Do Not Track signal to turn off. We treat every visitor as if Do Not Track were on. No third party collects information about members' activity across sites or apps through Tovkin. [CONFIRM: no third-party scripts, pixels or SDKs in the app]

3. How we use it

1. To provide Tovkin: sign you in, show your card and checks, answer your questions, explain uploads, track requests.
2. To carry out what you ask: for example, request your records or book an appointment, after you approve it.
3. To keep Tovkin safe and working: prevent abuse, fix bugs, secure the service, and meet our legal duties (including notifying you of a data breach).
4. To improve Tovkin using only de-identified or aggregated information, such as how many Tovkins are sent or how many people finish a check. We do not use your identifiable health information to train AI models, and we do not allow our AI providers to [CONFIRM provider terms and gateway settings].
5. To contact you about your account and the things you asked for (invite, request status, security). We do not send marketing unless you opt in.

We do not: sell or rent your information; share health information with advertisers; use health information for advertising or profiling for ads; or make decisions about you with legal or similar effect (for example about insurance, employment or credit).

4. AI processing

Tovkin's companion is an AI. When you ask a question or upload a file, we send what is needed (your message, relevant earlier conversation, the text or image of the file, and relevant parts of your profile) to an AI model operated by a service provider, through an AI gateway, to produce an answer. Details:

• Providers: [Anthropic] (the model) via [Vercel AI Gateway] (routing). [CONFIRM current providers, regions, and that zero-data-retention / no-training settings are on].
• The provider is allowed to process your content only to give us the answer. It is not allowed to use it to train its models [CONFIRM contract / settings].
• AI answers can be wrong. They are information, not medical advice. We apply safety rules (for example, emergencies always get a "call 911 / 988" response), but no system is perfect. See the AI Disclosure.
• A person at Tovkin can review conversations when you report a problem, to investigate a safety issue, or to carry out a request you made. Access is limited and logged [CONFIRM admin access logging].

5. Who we share information with

Service providers are bound by contracts that limit them to our instructions and require security. A current list is in section 14 [CONFIRM and keep updated].

We do not sell personal information and we do not "share" it for cross-context behavioral advertising as those terms are defined in California law.

6. Invites ("Send a Tovkin")

• You choose who to invite. Only invite people who would want it. You must have their permission to give us their email address.
• The invite email says who it is from. It contains a link to start. If the person does nothing, we keep their email only as long as needed to avoid emailing them again [CONFIRM: suppression list kept as hashed email], and we delete other invite details after [90 days].
• We tell you who has started so you can see the loop. You never see anyone else's health information, and they never see yours.
• If someone tells us they do not want invites, we stop and will not send further invites to that address.

7. Plus-one

A plus-one is one person you invite to ride along.

• Sharing is off by default. You switch on each item (for example appointments, progress and streaks, workouts, lab results) individually.
• The plus-one must accept by email before they see anything.
• They can send you a cheer. They cannot change your data.
• You can change or stop sharing at any time, and removing a plus-one ends their access immediately. Anything they already saw or screenshotted is outside our control.
• We keep a log of what was shared with whom and when. You can see it. [CONFIRM log is user-visible]
• When you delete your account, your plus-one loses access immediately.

8. Your choices and rights

In the app (or by emailing hello@tovkin.com) you can:

• Access and export your data (a downloadable copy in a common format). [CONFIRM: export works]
• Correct information you entered.
• Delete your account and data. Deletion removes your profile, conversations, uploads, health entries and plus-one links from our live systems promptly, and from backups within [30 days] (and in no event more than six months) [CONFIRM]. We may keep a minimal record that you deleted your account, and any records we are legally required to keep.
• Withdraw consent for any optional use at any time (for example sharing with a plus-one, or any request Tovkin is carrying out for you).
• Appeal a decision on a request by replying to our response; if you are still unhappy, you can contact your state attorney general.

We respond to requests within 45 days. Extensions are rare and we will tell you why.

We will not treat you worse for using these rights.

9. How we protect it

• Encryption in transit (HTTPS) and at rest.
• Database access controls (row-level security) so a member can read only their own data and what has been shared with them.
• Uploaded files are stored in private storage and are never public links.
• Staff access is restricted to what is needed for support, safety and requests you made, and is logged. [CONFIRM]
• No advertising or analytics trackers.
• Security reviews and testing before launch. No system is perfectly secure.

10. If something goes wrong (data breach)

If there is a breach of security affecting your health information, we will tell you without unreasonable delay and no later than 60 days after we discover it, as the FTC Health Breach Notification Rule requires, and in line with state laws. If a breach affects 500 or more people we also notify the FTC at the same time, and may notify the media. A "breach" for this purpose includes sharing health information without your permission, not only hacking. See 16 CFR Part 318 (https://www.law.cornell.edu/cfr/text/16/part-318).

11. California, Nevada, Washington and other states

Tovkin is not a HIPAA-covered entity; this policy and the state health-data laws govern your information. You have the rights in section 8 regardless of where you live.

Washington and Nevada: see the Consumer Health Data Privacy Policy.

California: In the last 12 months we collected the categories in section 2 (identifiers; health information, which California treats as sensitive personal information; internet activity needed to run the service; and the content you provide). We use sensitive personal information only to provide the service you asked for, to keep it secure, and as allowed by law, and we do not use it to infer characteristics for advertising. We do not sell or share personal information. You can ask us to tell you what we hold, delete it, correct it, and limit the use of sensitive information. California's Confidentiality of Medical Information Act also applies to businesses offering software or hardware to help people manage their health information. [ATTORNEY: confirm CCPA/CPRA thresholds and CMIA §56.06 applicability; confirm whether we should still honor requests below thresholds, which is recommended.]

12. Retention

We keep your information while your account is active. If you delete your account we delete as described in section 8. If you are inactive for [24 months] we will email you before we delete the account. Waitlist emails are kept until you ask us to remove them or the product launches to you. [CONFIRM retention periods and automation]

13. Changes

If we make a material change, especially to how we use health information, we will tell you in the app and by email before it takes effect, and ask for your consent where the law requires.

14. Our providers (subprocessors)

[CONFIRM before publishing; keep in sync with the build]

Anything you email to hello@tovkin.com is read by the founder and may sit in a personal mailbox for now. Do not email us health information; use the app. [CONFIRM / move to a company mailbox after formation]

15. Contact

hello@tovkin.com · [mailing address]. For the Washington consumer health data appeals and the other state processes, the same address works.