Luv Health
Sign in Join Luv Health
How it works Membership For doctors FAQ Contact Sign in Join Luv Health

Legal

Privacy

This page explains, in plain language, what Luv Health collects, why, and who can see it. The controlling document is the Notice of Privacy Practices your practice gives you and the agreement you accept during sign-up.

What we collect

  • Account details — name, email, phone, date of birth, address.
  • What you tell your care team — messages, intake answers, uploaded documents.
  • Insurance details — plan, member identifier, subscriber information, card images.
  • Membership and payment records — plan, status, amounts, receipts. Card numbers are handled by our payment processor and never stored on our servers.
  • Technical logs — sign-in events, IP address, device type, and access to protected records.

Who can see it

Your care team at the practice you're connected to. Access is limited by role and to the minimum necessary for someone to do their job. Every time a clinician or staff member opens your record or downloads a document, that access is recorded in an audit log your practice can review. One practice cannot see another practice's records.

What we never do

  • We do not sell your information.
  • We do not use your health information for advertising.
  • We do not put clinical detail in notifications, emails or text messages.
  • We do not send your information to an AI vendor unless that vendor is contractually approved to handle protected health information and an administrator has explicitly enabled it.

Notifications

A push notification, SMS or email from Luv tells you that something is waiting — never what it concerns. "You have a new secure message in Luv Health" is the level of detail we use. The content lives behind your sign-in.

Google Calendar connections

A clinician may choose to connect their own Google Calendar. Luv creates private appointment placeholders without patient names, visit reasons, attendees or clinical details. To prevent scheduling conflicts, Luv requests only busy start and end times; it does not import Google event titles, descriptions, locations or guest lists. The clinician can disconnect at any time, which revokes saved access and removes imported busy times. Google API data is used only to provide these visible calendar features and is not sold, used for advertising or transferred for unrelated purposes.

How your information is protected

  • Encrypted in transit, with strict transport security enforced in production.
  • Documents are stored privately and served only through an authenticated, logged download.
  • Passwords are hashed with Argon2. Sign-in attempts are throttled and locked after repeated failures.
  • Sessions expire, and authenticated pages are never cached by your browser or the app.

Your choices

  • Update or correct your information from Settings at any time.
  • Choose which channels we use for each kind of notification.
  • Request account deletion from Settings. Some records must be retained where law or your practice's medical-records obligations require it; we'll tell you which.

Questions

Email [email protected], or ask your practice's privacy officer about records held by the practice itself.