Bliv Privacy Policy

1. Who we are and what this Policy covers

This Privacy Policy explains how Metabody Services, LLC (“Bliv,” “we,” “us”) collects, uses, shares, and protects personal information when you use joinbliv.com and its subdomains, our mobile applications, our AI Assistant, and our related products and services (the “Services”), and when you communicate with us. It applies to residents of the United States; the Services are not offered elsewhere.
Three documents work together. (1) This Privacy Policy covers personal information that Metabody Services, LLC handles for its own purposes as the operator of the Services. (2) The Notice of Privacy Practices of Metabody Medical P.A. and its affiliated professional entities listed below (together, the “Medical Groups”) covers protected health information (“PHI”) that the Medical Groups create or receive in providing you clinical care; HIPAA governs that information, and Metabody Services, LLC handles it only as a business associate of the Medical Groups under written agreements. Where this Policy and the Notice of Privacy Practices both appear to apply to PHI, the Notice controls. (3) Our Consumer Health Data Privacy Policy describes our practices for “consumer health data” as defined by the Washington My Health My Data Act, Nevada law, and similar state laws, for information that is not PHI. Links to all three are in the footer of joinbliv.com and in the app.
The Medical Groups are:

2. Information we collect

Information you provide. Account details (name, email, phone number, date of birth, password, shipping and billing address); identity-verification information (such as a government ID image or a selfie, where required for clinical services); health information you enter — symptoms, conditions, medications, allergies, height, weight, goals, lifestyle information, and responses to questionnaires and intake forms; messages you send to us, to your care team, or to the AI Assistant; photos or documents you upload; payment card details, which are collected by our PCI-DSS compliant payment processor and not accessible or stored by us; and survey responses, reviews, and support requests.
Information from sources you connect. With your permission, data from wearables and health apps you link (for example Apple Health, Garmin, WHOOP, Oura, or continuous glucose monitors), which may include heart rate and heart-rate variability, sleep, activity and steps, workouts, blood glucose, body temperature, respiratory rate, oxygen saturation, weight, and menstrual-cycle data, depending on the device and the categories you choose to share; laboratory results from laboratories your clinician orders from or accounts you connect; and pharmacy and shipment status for prescriptions filled through the Services. The specific data types we request from Apple HealthKit or Google Health Connect are shown in the permission prompt, and you can change them at any time in your device settings.
Information collected automatically. Device and browser type, operating system, app version, IP address and approximate location derived from it, language settings, identifiers assigned to your device or account, pages and screens viewed, features used, links clicked, session length, crash and performance data, and the date and time of your activity. We collect this using cookies, software development kits, server logs, and similar technologies described in §9.
Information about your interactions with the AI Assistant. The questions and messages you send, the information from your profile the AI Assistant reads to respond, the responses it generates, and your feedback on those responses.
Information from third parties. Confirmation from our payment processor that a payment succeeded; identity-verification results from our verification provider; information from the Medical Groups, pharmacies, and laboratories about the status of your care, prescriptions, and orders, to the extent needed to operate the Services; and information from your employer or benefits provider confirming your eligibility, if you join Bliv through an employer program.
Precise location. We may ask for your state or ZIP code, or use your device location with your permission, to confirm that you are in a state where clinical services are available. We do not track your location in the background.

3. How we use information

We use personal information to: provide and operate the Services — create and manage your account, build and update your health profile, deliver insights and coaching content, process payments, and fulfil orders; support your care — transmit your information to and from the Medical Groups, pharmacies, and laboratories, deliver messages from your care team, and, as the Medical Groups’ business associate, host and process PHI on their behalf; power the AI Assistant as described in §5; communicate with you — service, account, and appointment messages, responses to your requests, and, if you opt in, coaching or marketing messages; personalize your experience — for example, tailoring content and program recommendations to your goals and data; protect the Services — verify identity, prevent fraud and abuse, and maintain security; improve and develop the Services — analyze usage, test features, fix problems, and, using de-identified data, develop and evaluate features and models; and comply with law — respond to lawful requests, enforce our Terms of Service, and meet record-keeping obligations.
Sensitive information. Health information, precise location, and government identifiers are “sensitive” under many state laws. We process them only for the purposes above, and we ask for your affirmative consent before collecting or processing your health information where the law requires it — you give that consent during onboarding and can withdraw it at any time in your settings or by contacting us (withdrawing consent will end features that depend on the data). We do not use sensitive information to infer characteristics about you for advertising, and we never use health information for targeted advertising.
De-identified data. We may de-identify personal information, including health information, in accordance with applicable law (including the HIPAA de-identification standard where PHI is involved) so that it can no longer reasonably be linked to you. We may use and share de-identified data for any lawful purpose, including research, benchmarking, and improving and training our software and models. We maintain de-identified data in that form, do not attempt to re-identify it, and contractually prohibit recipients from doing so.
Employer and benefits programs. If you join Bliv through an employer or benefits provider, we confirm your eligibility with them and report program participation and outcomes to them only in aggregated or de-identified form. We do not share your identifiable health information with your employer unless you separately authorize it in writing.

4. Legal bases and your consent

We collect and use personal information because it is necessary to provide the Services you request, because you have consented (for example, connecting a wearable, opting in to marketing texts, or consenting to processing of health information), because we have a legitimate business need that does not override your interests (such as security and improvement of the Services), or because the law requires it. Where our use depends on your consent, you may withdraw it at any time; withdrawal does not affect processing that already occurred.

5. Artificial intelligence

How we use AI. The AI Assistant and other features of the Services use generative artificial intelligence and machine-learning models to read your health profile, answer your questions, summarize information, flag items that may deserve your clinician’s attention, and draft materials for your care team. The AI Assistant provides information, not medical advice, and does not make clinical decisions; those are made by licensed clinicians. We do not use automated decision-making technology to make decisions that have legal or similarly significant effects on you, including decisions about your care or eligibility, without meaningful human review.
Third-party AI providers. To operate these features we use third-party artificial-intelligence service providers, including providers of large language models — currently Anthropic and OpenAI — and cloud infrastructure on which we run models. These providers act only on our instructions under written contracts — and under business associate agreements where PHI is involved — that require them to protect your information to the same standard we do, prohibit them from using your information to train or improve their own models, and require them to retain your information for no longer than needed to return a response (zero or minimal retention).
Training and improvement. We do not use your identifiable personal information, including your conversations with the AI Assistant or your health information, to train large language models or other AI models, and we do not sell personal information for that purpose. We may use de-identified data, as described in §3, to evaluate, fine-tune, and improve our own models and features. Clinicians and authorized staff may review AI Assistant conversations and outputs as part of your care and for quality and safety.
Retention of AI interactions. Your AI Assistant conversations are kept as part of your account for as long as your account is active, and, where they relate to your care, may become part of your medical record with the Medical Groups. You can delete conversations from your account; copies retained in the medical record are governed by medical-records law.

6. How we share information

We share personal information only as described here. With the Medical Groups and their clinicians, to provide your care; once received by them, your information is PHI governed by their Notice of Privacy Practices. With pharmacies and laboratories your clinician selects, to fill prescriptions, perform tests, and ship orders. With our affiliates — Metabody Services, LLC operates both the Metabody and Bliv brands and may share information between them and with the Medical Groups listed in §1, only for the purposes described in this Policy. With service providers that work on our behalf and are bound by contract to use your information only to provide services to us and to protect it at least as well as this Policy requires — cloud hosting and storage, AI and machine-learning providers (§5), payment processing, identity verification, communications (email, text, push, and in-app messaging), customer support, analytics, security, and shipping. For legal reasons — to comply with law, regulation, legal process, or governmental request; to enforce our Terms of Service; to protect the rights, safety, or property of you, us, or others; or to detect and prevent fraud or security issues. In a business transaction — if we are involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy or a policy that is at least as protective, and we will notify you of any change in the entity responsible for your information. With your direction or consent — for example, when you ask us to send records to another provider or connect a third-party app.
We do not sell sensitive personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We do not disclose health information to advertising platforms, data brokers, or social-media companies, and we do not use health information — including data from Apple HealthKit, Google Health Connect, or connected devices — for advertising or marketing or for use-based data mining by us or by third parties.

7. Your choices

Privacy choices. Use the “Your Privacy Choices” link in the footer of joinbliv.com and in the app, or email [email protected], to exercise the rights in §10 and to set your preferences. Although we do not currently sell or share sensitive personal information for targeted advertising, the page lets you record an opt-out so that it is honored if our practices ever change, and we treat a Global Privacy Control signal from your browser as an opt-out request.
Health-data consent. You can withdraw your consent to our processing of your health information in your account settings; doing so disables the features that depend on it. Connected sources. Disconnect any wearable, app, or account at any time in your settings; we stop importing new data when you do. AI Assistant. Withdraw your permission for third-party AI processing in your settings. Marketing email. Use the unsubscribe link in any marketing email; you will still receive service and account emails. Text messages and calls. Reply STOP to any marketing or coaching text to stop those messages, or HELP for help; account and care messages continue unless you close your account. You can also tell us not to call you for marketing. Push notifications. Manage them in your device settings. Cookies. See §9.

8. Mobile information and text-message consent

If you provide your mobile number or opt in to text messages, we collect your number, your consent record (date, time, source, and the consent language shown), and message delivery and reply data. We use this information to send you the messages you requested, to honor opt-out requests, and to maintain records of consent. We do not share, sell, or provide your mobile phone number or SMS consent data to third parties or affiliates for marketing or promotional purposes. Mobile numbers are shared only with service providers that send messages on our behalf and are contractually prohibited from using them for any other purpose. Message frequency varies. Message and data rates may apply. Reply STOP to cancel or HELP for help at any time.

9. Cookies and similar technologies

We use cookies, local storage, software development kits, and similar technologies for three purposes: strictly necessary — signing you in, keeping your session secure, remembering your preferences, and preventing fraud; performance and analytics — understanding how the Services are used so we can improve them, using first-party tools or service providers that process the data only for us; and functionality — remembering settings such as your consent choices. We do not use third-party advertising or retargeting cookies, pixels, or social-media trackers on the Services, and we do not permit third parties to collect information about your activity on authenticated pages for their own purposes. You can control cookies through your browser settings and through our cookie preferences, where offered; blocking strictly necessary cookies may prevent the Services from working. We honor Global Privacy Control signals as described in §7.

10. Your privacy rights

Depending on where you live, you may have the right to: know and access the personal information we have about you, including the categories and specific pieces, the sources, our purposes, and the categories of third parties we share it with; correct inaccurate information; delete your information; obtain a portable copy of information you provided; opt out of the sale of personal information, of sharing for targeted or cross-context behavioral advertising, and of profiling that produces legal or similarly significant effects (we do not do any of these today); limit the use of sensitive personal information to what is necessary to provide the Services (which is already our practice); withdraw consent; and not be discriminated against for exercising your rights. Where a state law provides a right to a list of the specific third parties to whom we have disclosed your information, we will provide it. In some states you also have the right to appeal a decision on your request.
How to exercise your rights. Use the “Your Privacy Choices” link in the footer of joinbliv.com, the privacy settings in the app (where you can also delete your account), or email [email protected]. We will verify your identity using information associated with your account — and may ask for additional information for sensitive requests — and respond within 45 days, extending once by a further 45 days where permitted, with notice to you. You may use an authorized agent to make a request on your behalf if you give the agent signed permission or a power of attorney; we may still verify your identity directly. If we decline a request, we will explain why and, where the law provides, how to appeal by replying to our decision or emailing [email protected] with “Appeal” in the subject line; we respond to appeals within 45 days (60 in some states) and, if we deny your appeal, will tell you how to contact your state attorney general.
Limits. Some information cannot be deleted while you have an active clinical relationship or where the law requires us to keep it (for example, medical, billing, and consent records). Requests about PHI held by the Medical Groups — including access to and amendment of your medical record — are handled under their Notice of Privacy Practices, and we will route such requests to them.

11. Additional disclosures for California residents

This section supplements the rest of this Policy for California residents under the California Consumer Privacy Act as amended (“CCPA”). In the preceding 12 months we collected the following categories of personal information, for the purposes described in §3, from the sources described in §2: identifiers (name, email, phone, address, account and device identifiers, IP address); personal records (date of birth, payment information handled by our processor); protected classifications (age, sex or gender where you provide it); commercial information (purchases and subscription history); internet or network activity (usage and device data); geolocation (state and ZIP code; device location only with permission); audio or visual information (photos or ID images you upload); professional or employment information (employer, only for employer programs); inferences (program recommendations derived from your data); and sensitive personal information (health information; government identifiers used for identity verification; precise geolocation with permission; account log-in credentials). We disclosed these categories to the categories of recipients described in §6 for business purposes. We have not sold sensitive personal information or shared it for cross-context behavioral advertising in the preceding 12 months, and we have no actual knowledge that we sell or share the personal information of consumers under 16. We use and disclose sensitive personal information only for the purposes permitted by CCPA regulations §7027(m), so we do not offer a separate “Limit the Use of My Sensitive Personal Information” control; our “Your Privacy Choices” page serves as our alternative opt-out link. We do not offer financial incentives in exchange for personal information. California residents may exercise the rights in §10; we do not discriminate against you for doing so. Notice at collection: the categories, purposes, and retention periods above and in §12 constitute our notice at or before the point of collection.

12. Data retention

We keep personal information for as long as your account is active and as needed for the purposes in this Policy. Afterwards we delete or de-identify it, except where we must keep it longer: clinical and prescription records handled for the Medical Groups are kept for the period required by state medical-records law (generally 6 to 10 years, longer for some states); billing, tax, and consent records (including privacy-choice consent logs) are kept for up to 7 years; security and audit logs for up to 2 years; and information subject to a legal hold until the hold ends. When you delete your account in the app or by request, we begin deletion within 45 days, subject to these exceptions, and we tell you which information we must retain and why.

13. Security

We protect personal information with administrative, technical, and physical safeguards appropriate to its sensitivity, including encryption in transit and at rest, role-based access controls, logging and monitoring, vendor security reviews, and workforce training, and we maintain a HIPAA-compliant security program for PHI we handle on behalf of the Medical Groups. No system is completely secure; if we learn of a breach affecting your information we will notify you and regulators as required by law, including HIPAA, state breach-notification laws, and the FTC Health Breach Notification Rule where it applies. Keep your password confidential and tell us at [email protected] if you suspect unauthorized access to your account.

14. Children

The Services are for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact [email protected] and we will delete it.

15. Where information is processed

We store and process personal information in the United States. The Services are not intended for use outside the United States, and we do not knowingly transfer personal information internationally other than to service providers with U.S. data residency commitments.

16. Third-party sites and services

The Services may link to or integrate with third-party websites, apps, devices, and services, including wearables, health apps, payment and financing providers, pharmacies, and laboratories. Their privacy practices are governed by their own policies, which we encourage you to read.

17. Changes to this Policy

We may update this Policy. If we make material changes, we will notify you by email to your account address and by notice in the Services at least 30 days before they take effect, and we will not use previously collected personal information for a materially new purpose without your consent where the law requires it. The current version and its effective date are always posted at joinbliv.com/privacy.

18. Contact us

Privacy questions, requests, and appeals: [email protected] · 888-859-2882 · Metabody Services, LLC, Attn: Privacy, 2943 Parkway Blvd, Unit 374, West Valley City, UT 84119. Legal notices: [email protected]. For questions about PHI held by your clinicians, contact the Medical Groups’ Privacy Officer at the address in their Notice of Privacy Practices.