Privacy Policy

1. Introduction

Town Doc, Inc. ("Company," "we," "us," or "our") operates the JOYN Health platform (www.joynhealth.com) and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, websites, and services (collectively, the "Services").

We are committed to protecting your privacy and complying with applicable laws, including the Health Insurance Portability and Accountability Act (HIPAA), the California Consumer Privacy Act (CCPA), and the Telephone Consumer Protection Act (TCPA).

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, password, and professional credentials
• Profile Information: Job title, department, employer affiliation, and preferences
• Health Information: Wellness program participation data, health screening results, and related health metrics (where applicable and with your consent)
• Communication Preferences: SMS opt-in status, email preferences, and notification settings
• Payment Information: Billing details processed through our secure payment providers

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, and interaction patterns
• Device Information: Browser type, operating system, and device identifiers
• Log Data: IP addresses, access times, and referring URLs
• Cookies: Session and preference cookies to improve your experience
• Analytics Cookies: On our public website we use Google Analytics to count visits and understand which pages are useful. These cookies are never set on pages you see after signing in. You can decline them in the cookie notice when you first visit, or withdraw later by clearing your browser cookies.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Services
• Manage your account and deliver personalized experiences
• Administer wellness programs, challenges, and health screenings
• Send transactional communications (account verification, appointment confirmations)
• Send SMS notifications for wellness events, reminders, and program updates (with your opt-in consent)
• Generate anonymized and aggregated analytics for employers and practices
• Comply with legal obligations and enforce our Terms of Service
• Detect, prevent, and address fraud or security issues

4. SMS/Text Message Privacy

If you opt in to receive SMS/text messages from JOYN Health:

• Your phone number is collected solely for the purpose of sending you the messages you have consented to receive
• We do not sell, rent, or share your phone number with third parties for their marketing purposes
• Your phone number is shared only with our SMS service provider (Twilio) for the purpose of message delivery
• SMS consent and phone numbers are not shared with or sold to third parties or affiliates for promotional purposes
• You may revoke SMS consent at any time by replying STOP to any message or by contacting us at support@joynhealth.com
• We maintain records of SMS consent including the date and method of opt-in for compliance purposes

5. Protected Health Information (PHI)

Where JOYN Health processes protected health information (PHI) as defined by HIPAA, we implement the following safeguards:

• Administrative Safeguards: Role-based access controls, workforce training, and privacy officer oversight
• Physical Safeguards: Secure cloud infrastructure with SOC 2 certified hosting providers
• Technical Safeguards: End-to-end encryption, audit logging, automatic session management, and multi-factor authentication
• Privacy Tiers: A 5-tier data classification system ensuring appropriate access controls based on data sensitivity

Business Associate Agreements (BAAs) are executed with all applicable covered entities and subcontractors.

6. Data Sharing and Disclosure

We may share your information in the following circumstances:

• With Your Employer: Aggregated and anonymized wellness program participation data (individual health data is never shared with employers without your explicit consent)
• Service Providers: Third-party vendors who assist in operating our Services (e.g., AWS for email, Twilio for SMS, Supabase for data hosting), bound by confidentiality obligations
• Healthcare Providers: With your consent, to facilitate care coordination and health screenings
• Legal Requirements: When required by law, regulation, legal process, or governmental request
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with continued protection of your data

7. Data Security

We implement industry-standard security measures to protect your information, including:

• TLS/SSL encryption for all data in transit
• AES-256 encryption for data at rest
• Row-level security (RLS) for multi-tenant data isolation
• Regular security audits and vulnerability assessments
• Comprehensive audit logging for all data access events
• Multi-factor authentication (MFA) for administrative accounts

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Services. We may retain certain information as required by law, for legitimate business purposes, or to comply with our legal obligations (including HIPAA record retention requirements). You may request deletion of your account data by contacting us.

9. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Portability: Request a copy of your data in a portable format
• Opt-Out: Opt out of marketing communications, SMS messages, or certain data processing activities

To exercise these rights, contact us at privacy@joynhealth.com. We will respond within 30 days.

10. California Privacy Rights (CCPA)

California residents have additional rights under the CCPA, including the right to know what personal information is collected, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To make a request, contact us at privacy@joynhealth.com.

11. Children's Privacy

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will take steps to delete that information promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. We encourage you to review this policy periodically.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: