Trust and security

The platform holds your account and sign-in details, the wearable connections you authorise, the daily wellness metrics read from them (heart-rate variability, resting heart rate, sleep, respiration, temperature and activity), the readiness scores derived from those metrics, the consents you gave or withdrew, the sharing decisions you made, your goals and streaks, the messages sent to you, your sign-in sessions, and your employer or programme membership where you have one.

Wearable providers are sources you connect yourself, not parties this platform sends your data to. The platform reads the metrics you authorised it to read and sends nothing back.

The same catalogue is what an access request is answered from, so what is listed here is what is actually held rather than a shorter summary of it.

The application and its single database run in Germany, in the European Union. There is one datastore and no secondary copy of member data in another region.

Health data is special personal information under POPIA, so processing it outside South Africa is a cross-border transfer that needs a lawful basis. Where a member is in South Africa, that basis is their explicit consent, recorded at sign-up and withdrawable.

Production residency is an open decision and is not settled by the current deployment. Moving processing to South Africa is a required decision before onboarding members with real health data, and this page will state the outcome when it is taken.

Each category of data has its own period, listed below with the reason it is kept that long. Nothing is kept indefinitely by default.

You can request deletion of your account from your own settings at any time. The erasure is performed within 30 days, and the records that survive it are the ones a law requires to be kept: the consent history, which is the proof of what you agreed to, and the enrolment record of an employer programme you were part of.

You can also take a machine-readable copy of your data with you before you delete it.

The register below lists every third party that processes member data on Thriverence's behalf, what it is used for, and the region it runs in. It is maintained as a record with its own change history, so an entry added or removed is dated rather than silently swapped.

Wearable providers are not on this register. You authorise them directly and the platform reads from them; they are named in the data map above instead.

If the register below is empty for a section it means no such party is engaged, not that the question was skipped.

An employer never sees an individual reading. Every figure an employer is shown is an anonymised aggregate over a group, and a group smaller than the minimum below renders as nothing at all rather than as a number that could be narrowed down to one person.

That minimum is enforced on the server, on every read, and not by hiding a screen. Asking the same question a different way, through a different filter or a different report, resolves against the same check.

An employer cannot raise their own visibility by lowering the minimum below the platform floor, and no employer surface reads an individual metric or readiness score.

Physiological data and readiness are private by default. Every form of sharing is opt-in: with people you follow, with a private accountability pod, or with an employer team. Nothing is shared because you did not turn it off.

Peers see a band and progress, never the figures behind them. There is no public leaderboard of a health value, and raw readiness rank is not published.

You can withdraw any sharing decision, disconnect a wearable, export your data or delete your account from your own settings, without asking anyone.

Report a suspected vulnerability at /security/report. The form asks where it is, what you did, what you saw and how to reproduce it. An address to reply to is optional: an anonymous report is recorded and queued exactly like any other. The same route is published in machine-readable form at /.well-known/security.txt.

The report is written down the moment it is accepted and you are shown a reference for it immediately. That acknowledgement is issued by the platform itself rather than by a person, so it does not wait for anybody to be at a desk. Reports go to the platform security queue, which is read only by the platform administration role. It is a separate queue from the sales enquiry one, and a security report is never routed into sales.

Every accepted report is stamped at intake with a review target of 5 days for a first human response, and the queue lists anything past its target first, so an overdue report is visible to the people who own the queue rather than only to the person waiting. That target is the intake's own undertaking. This page does not offer a bug bounty, a legal safe harbour or a fix by a date, because no record behind it establishes one.