Privacy Policy
The Resilient Engine, made by Thrive Wellness and Performance, LLC.
Effective 13 August 2026
This policy explains what The Resilient Engine collects, why, who else can see it, and how to get rid of it. It is written to be read, not to be survived.
If you are a client of Thrive Wellness and Performance, what you record in this app is also protected health information. It is handled under the practice's obligations as a health care provider and under the Notice of Privacy Practices you received when you became a client. Where that notice gives you more protection than this policy does, that notice governs.
What we collect
Your account. Your name, your email address, and a password that is stored only as a salted hash. We never hold the password itself and cannot recover it, which is why a reset sends you a link rather than your old one.
Your readings. When you take a morning reading, a spot check, a breathing session or a resonance frequency test, we store the time between your heartbeats and the measurements calculated from it, including RMSSD, SDNN and the power in the low and high frequency bands. We also store when the reading was taken, how long it lasted, whether it came from the phone camera or a chest strap, and a quality assessment of the recording.
Your daily check-in. A single number from one to five.
Your Dr. Jay AI conversations. Everything you type, and everything the program replies.
Your agreements. Which version of each agreement you accepted, and the exact date and time you accepted it. This record is kept for as long as the practice is required to keep it, and it survives account deletion, because a record of consent is worthless if the person consenting can erase it.
About the camera
The app measures your pulse by watching the color of your fingertip change as blood moves through it. The camera is on while a reading runs.
No video is recorded and no image is ever saved or transmitted. The app reads the brightness of each frame, turns it into a single number, and discards the frame. What leaves your phone is a list of intervals between heartbeats, in milliseconds. Nothing else from the camera exists, on your phone or anywhere.
What we do not collect
No location. No contacts. No photos. No microphone. No advertising identifier. No browsing or app usage outside this app.
The app contains no analytics, no advertising and no third party tracking software of any kind. Nobody is paying us for your data, because we do not sell it and there is nothing to sell.
Who else sees it
Three companies, each of which has signed a Business Associate Agreement with Thrive Wellness and Performance or, in the case of email, receives no health information at all:
Amazon Web Services hosts the service. Your information sits on a server we rent from them, on an encrypted disk, in the United States.
Anthropic provides the language model behind Dr. Jay AI. When you send a message, that message, your recent conversation, your first name and a summary of your recent readings are sent to Anthropic to generate the reply. Your email address, your full name and your account credentials are not. Anthropic does not use this to train its models.
Brevo delivers email, which means invite codes and password reset links. Brevo receives your email address and the text of that message. No readings and no conversations are ever sent by email.
We do not share your information with anyone else. Not with employers, not with insurers, not with advertisers, and not with other clients. If a court orders disclosure we will comply, and we will tell you unless we are prohibited from doing so.
Your clinician
If you joined using an invite code from a clinician at Thrive Wellness and Performance, that clinician can see your readings, your sessions, your reports and your Dr. Jay AI conversations. That is the point of the app, and it is worth knowing before you type something into Dr. Jay AI that you would not say out loud in session.
No other clinician can see anything of yours. The system checks who you belong to on every request, and a clinician asking for a client who is not theirs gets the same answer as one asking for a client who does not exist.
How long we keep it
Until you delete it.
You can delete your account from inside the app, under your account settings. This removes your readings, your sessions, your conversations and your account. It cannot be undone and we cannot restore it for you.
Two things survive deletion, and both are deliberate. The record that consent was given, described above. And a dated note that an account was deleted, with no name, email or health information in it, which exists so that the deletion itself is auditable.
Deleted information can persist in encrypted backups for up to fourteen days before those backups age out.
How it is protected
Everything between the app and the server travels over TLS. Everything stored on the server sits on an encrypted disk, and the backups inherit that encryption and are held on separate hardware. Readings and messages are never written to server logs. Access to the production system is limited to Thrive Wellness and Performance.
No system is perfect and anyone who tells you otherwise is selling something. If we ever discover a breach affecting your information, we will notify you and any regulator we are required to notify.
Your choices
You can see everything the app holds about you from inside the app. You can correct your name and email in your account settings. You can delete any individual reading or session. You can delete the whole account.
If you want a copy of your information in a portable form, or you want something corrected that you cannot correct yourself, email us and we will do it.
Depending on where you live you may have additional rights over your information, including the right to know what is held, to have it corrected or deleted, and not to be discriminated against for exercising those rights. We extend all of these to everyone regardless of where they live, so there is nothing extra you need to invoke.
If you are under 18
The app can be used by someone under 18, but not on their own. A parent or legal guardian has to read and agree to the terms first, and the account belongs to them. We do not knowingly collect information from anyone under 13.
Changes
If this policy changes in a way that affects what we collect or who sees it, we will tell you in the app before the change takes effect. The effective date at the top always reflects the current version.
Contact
Thrive Wellness and Performance, LLC, at info@thrive-wellness.com.
If you have a concern about how your health information has been handled, you can also complain to the U.S. Department of Health and Human Services, Office for Civil Rights, and we will not retaliate for it.