Privacy Policy

Effective date: 7 September 2026

Thrivo is not a medical app and does not provide medical advice, diagnosis or treatment. If you have a physical or mental health concern, please speak to a qualified healthcare professional.

1. Who we are

Thrivo is a trading name of Cora Evie Ltd, a company registered in England and Wales (company number 11580761). Our registered office is 71–75 Shelton Street, London, WC2H 9JQ. We are the data controller for the personal data described in this policy.

The quickest way to contact us about your data is by email: support@thrivo.co.

ICO registration number: ZC241353

This policy applies to the Thrivo app and to our website, thrivo.co, for users in the United Kingdom. It is written to comply with the UK GDPR and the Data Protection Act 2018.

2. Our approach

We collect only what we need to run the app. We don't ask for your date of birth, home address or full legal name, and even a display name is optional. We don't sell your data, we don't use it to show you adverts, and we don't use it to train AI models.

3. What we collect

Account details. Your email address, an encrypted password, and optionally a display name.

Habit and wellbeing data. Habits you track, check-in responses, optional mood, energy and sleep scores, reading progress and any notes you add. Some of this may be health-related. We process it only with your explicit consent, which you give when you first use these features and can withdraw at any time by deleting the data or contacting us.

Workout preferences. If you use the workout plan generator: your experience level, how often you want to train, session length and goals. We don't ask for health, medical or injury information.

Journal entries. See section 8 — where your journal is stored depends on a setting you control.

Usage data. Which features are used and how often, recorded against a random identifier that is not linked to your account. No habit content, scores, journal text or wellbeing information is ever included.

Device and technical data. Device model, operating system and app version, crash reports, and approximate location (country or city level) derived from your IP address for technical purposes only. We don't store your IP address against your account.

Subscription status. Whether your subscription or trial is active, cancelled or expired. Payments are handled entirely by Apple — we never see your card details.

Support messages. What you send us when you contact support.

Website waitlist. Before launch, you can leave your email address to be told when Thrivo is available in your region. We record your email and the country you choose (suggested from your connection's approximate location, which you can change). We don't store your IP address. We send one email when we launch in your region, then delete your details. If we haven't launched in your region within 12 months, we delete them anyway.

Business enquiries. If you use the form on our For Business page, we record your name, company, work email address, company size, country and message, and email them to our team so we can reply. We don't store your IP address. We keep enquiries for 12 months, then delete them.

What we don't collect: medical records or diagnoses, precise location, your contacts, your photo library, payment card details, biometric data (Face ID stays on your device), social media accounts, or data about what you do in other apps.

4. Why we use your data and our legal basis

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Who we share your data with

We don't sell your data. We share it only in these situations:

Service providers who work for us. Like most apps, we rely on specialist companies to run parts of the service: cloud hosting and databases, website hosting, subscription management, product analytics, crash reporting and email delivery. They can use your data only to provide their service to us, are bound by contract to keep it confidential and secure, and can't use it for their own purposes.

Apple. Subscriptions are bought through the App Store. Apple handles payment, billing, cancellation and refunds under its own terms and privacy policy, and tells us only whether your subscription is active.

Anthropic. When you generate a workout plan, your workout preferences (experience level, training frequency, session length, goals) are sent to Anthropic's Claude AI to create the plan. No health or personal identifying information is included. Anthropic acts as our processor, is prohibited from using your data to train its models, and deletes it within 30 days.

Professional advisers, regulators and courts. Where we need advice, or where the law requires it, or to protect the rights and safety of Thrivo, our users or others.

A future owner of the business. If Thrivo is sold, merged or reorganised (including a transfer to a successor company), your data may be transferred as part of that. We'll tell you before it happens if it changes how your data is used.

6. Where your data is stored

Your account and habit data is hosted in Switzerland, which the UK recognises as providing adequate protection. Some of our service providers, including Anthropic, are based in the United States. Where your data leaves the UK, we use safeguards approved under UK data protection law — the UK International Data Transfer Addendum, UK adequacy regulations, or the UK–US Data Bridge. Email support@thrivo.co if you'd like more detail on a specific transfer.

7. How long we keep it

If your free trial ends and you don't subscribe, we keep your account and data for 12 months so you can come back, then delete them. You can delete your account yourself at any time in You → Your account → Delete account.

8. Your journal

The journal has two storage modes and you choose which applies.

Local only (the default). Entries stay on your device. They are never sent to us, we can't read them, and we hold no copy. This means we can't recover them if you delete the app or lose your phone, and they won't move to a new device. Any backup your phone makes (for example to iCloud) is Apple's, not ours. For local-only entries we are not a data controller and this policy doesn't apply to them.

Cloud sync (optional). If you turn on sync in Settings, entries are stored on our servers so they can appear on all your devices. Because journal entries are free text, they may contain health or other sensitive information even though we never ask for it — so we rely on your explicit consent, given when you turn sync on. We don't read, analyse or use your entries for anything other than storing and syncing them. They are never included in analytics.

Turning sync off deletes your entries from our live database as soon as your device next goes online. Copies may remain in automated backups for up to 7 days before being overwritten, and are not used during that time.

9. Your rights

You have the right to:

• access the personal data we hold about you
• correct anything inaccurate
• delete your data (use You → Your account → Delete account, or contact us)
• restrict how we use it in certain circumstances
• receive a copy of your data in a portable format — until the in-app export feature is available, email us and we'll provide it
• object to processing based on our legitimate interests
• withdraw consent at any time, without affecting what was done before

Two honest limitations. Local-only journal entries aren't held by us, so there's nothing for us to access or delete. And because analytics events are tied to a random identifier rather than your account, we can't find, export or delete analytics data for a specific person — that's a deliberate privacy choice, and it means nobody can use that data to identify you.

To exercise any right, email support@thrivo.co. We don't charge a fee and aim to respond within one month. You can also complain to the Information Commissioner's Office at any time at ico.org.uk or on 0303 123 1113 or complete an online form via the ICO website (www.ico.org.uk).

10. Minimum age

Thrivo is for people aged 18 and over. We don't knowingly collect data from anyone under 18, and you confirm your age when creating an account. If we learn that a user is under 18, we'll delete their account. Parents or guardians can contact us at support@thrivo.co.

11. Security

Your data is encrypted in transit and at rest. Database access controls ensure you can only ever see your own data. Access to our systems is restricted and logged, and we take regular backups. No system is completely secure, so if you think someone has accessed your account, contact us immediately and change your password. If a data breach puts your rights at risk, we'll notify the ICO within 72 hours and, where the risk to you is high, tell you directly.

Local-only journal entries are protected by your device's own security — its passcode, Face ID and encryption — so keeping your phone secure protects them.

12. Cookies

Neither the app nor our website uses cookies or similar tracking technologies. If that changes, we'll update this policy and ask for consent where the law requires it.

13. Changes to this policy

We may update this policy as the app or the law changes. If a change materially affects how we use your data or your rights, we'll tell you in the app or by email before it takes effect. The version number and date at the top show when it was last updated.

14. Contact

Cora Evie Ltd (trading as Thrivo)
Company number 11580761 (England and Wales)
Registered office: 71–75 Shelton Street, London, WC2H 9JQ
Email: support@thrivo.co