Privacy Policy

Who we are

Sherlock Health, Inc. (“Sherlock Health,” “we”) operates JointVoyage at jointvoyage.com and also operates OpenDoc. This policy covers jointvoyage.com and the text messages and emails it sends. OpenDoc has its own policy, which applies when you are on OpenDoc. JointVoyage is operated independently of any surgical practice.

Write to us at privacy@sherlockhealth.ai. That mailbox is monitored, and it is the one place every request about your information goes.

What we collect

Before you sign in. The Fit Score and the Readiness Score run in your browser and on our servers without a record. Nothing you answer is kept unless you sign in, with two exceptions: an X-ray, blood-panel or EKG upload you make anonymously is stored under a case reference for 30 days and then deleted, and a request to share a report with a provider is stored so the request can be fulfilled.

Your record, once you sign in. Your phone number or email address; your name, date of birth, sex and ZIP code when you provide them; your Medicare status; your answers; files you upload (X-rays, imaging reports, laboratory results, EKGs, clearance letters); your medications and medical history; your home support arrangements; your chosen surgeon and surgery date; daily check-ins and outcome questionnaires; consents and authorizations, each with the version of the wording you agreed to; and messages exchanged with a clinician you authorized.

Physician accounts. A physician’s name, email, NPI, practice, and the status of their identity verification, together with the clinical notes, reviews and opinions they write on cases patients have authorized.

Surgeon records. The public surgeon record pages are compiled from public sources about physicians (Medicare claims, the AAHKS member directory, and pages that state a physician’s training). They are described under Surgeon record pages below.

Technical. Our hosting provider records the network address and request details of every visit for security and reliability. We keep a per-address rate limit for a short period, as a hash rather than an address. We count how many people reach each step of the preparation guide, by day, with no identity attached. We run no advertising pixels, session-replay tools or third-party analytics.

How we use it

Optional replacement research (added September 12, 2026). My replacements keeps separate records for joints, sides, and operations, including patient-reported procedure details, health factors, and dated follow-up. Research sharing is off until you opt in for that replacement. With that separate permission, authorized JointVoyage researchers can review the record and the documents and questionnaires you explicitly link to it. Restricted research exports use coded identifiers and omit names, contact details, exact dates, documents, and free text; coded data are not anonymous. Turning sharing off excludes that replacement from future exports while keeping your personal record. Prior exports and completed analyses cannot be recalled automatically. This does not authorize outside records retrieval or publication of individual records. Read the collection methods.

• To provide the service: your scores, your record, your preparation pathway, your recovery check-ins, and the reports you generate.
• To text or email you, as described under Text messages below.
• To give a clinician access to your record when, and only when, you authorize that clinician by name.
• To build the de-identified preoperative registry, only from records whose owner has turned research consent on, and only as counts, never free text or dates.
• To validate our own scores against outcomes, as our operating data, under the plan published at /methodology. That analysis carries no name or contact detail.
• To keep the service secure, to enforce our terms, and to meet legal obligations.

We do not sell personal information, and we do not share it for targeted advertising.

Who we share it with

Clinicians you authorize. Nothing in your record reaches a clinician unless you authorize that clinician by name. Each authorization is recorded with its wording and date, and you can revoke it from your record. A clinician who has already signed a note, review or opinion keeps a copy of what they signed.

OpenDoc. When you ask for a surgeon’s written opinion or a surgery request, we send OpenDoc your phone number, your state, the dates you gave as available, and the surgeon’s name, under a versioned authorization you see and accept first. Nothing about your health goes with it, not even your scores. OpenDoc collects the payment and handles the surgeon’s side under its own terms and policy.

Service providers. Cloudflare hosts the site, its database and its file storage. Telnyx delivers our text messages. Resend delivers our emails. Each acts on our instructions under a written agreement, including a business associate agreement, that binds it to protect the information.

Registries. A surgeon you have authorized may submit your case to the American Joint Replacement Registry from their own registry account, using the identifying details the registry requires. That submission is the surgeon’s, under their own obligations.

Legal. We disclose information when the law requires it, to protect the safety of a person, or to enforce our terms.

A consumer health app, and HIPAA

JointVoyage is a consumer health app. The information in your record is entered by you, belongs to you, and is not a medical record. HIPAA governs health care providers and the companies that work for them; JointVoyage is neither, so your information here is protected instead by this policy, by the Federal Trade Commission’s Health Breach Notification Rule, and by state consumer health data laws where they apply.

When you authorize a clinician to read your record, or buy a written opinion from a surgeon, what that clinician receives and writes is theirs to hold under their own professional and legal obligations, including HIPAA where it applies to them; their own Notice of Privacy Practices governs what they do with it. We hold your information to the same standard either way: encrypted in transit and at rest, reachable only through your sign-in, shared only on your authorization, and every clinician read written to an access log.

Text messages

Signing in with a phone number gives us that number, and we use it for one-time sign-in codes and for the notifications your record generates: preparation reminders before a surgery date, a daily recovery check-in for two weeks after surgery and weekly to ninety days, and outcome questionnaires at their windows. At most one notification a day. No text contains health information; each says something is waiting and links to a page that asks you to sign in.

The one exception is a medication reminder that names the medication, which we send only if you have separately consented to it, having read that text messages are not encrypted. You can withdraw that consent at any time from your record.

Reply STOP to any message to stop all texts from JointVoyage, including sign-in codes; reply START to resume; reply HELP for help. Message and data rates may apply. Your carrier is not responsible for delayed or undelivered messages.

Cookies

We set one cookie, which holds your signed-in session. It is not readable by scripts and is not shared with anyone. We set no advertising or analytics cookies. Education pages embed videos from YouTube’s privacy-enhanced domain, which does not set cookies until you play a video; playing one is subject to Google’s policy.

Security

Connections are encrypted, and stored data is encrypted at rest by our hosting provider. There are no passwords to leak: sign-in is a one-time code sent to your phone or email. A clinician sees your record only by your named authorization, only after we have verified their identity, and every clinician read of a case or a file is written to an access log. Uploaded files are served only through an authenticated request; they have no public address. No security is perfect; if we learn of a breach affecting your information we will notify you and the authorities the law requires, within the time it requires.

How long we keep it

• Your record: for as long as it is active, and until you ask us to delete it.
• Anonymous imaging uploads: 30 days, then deleted automatically, files and all.
• Signed consents, clinical notes, reviews and opinions: for the period the law requires for clinical and business-associate records, even after a record is otherwise deleted.
• The access log and security records: for the period the law requires.
• Rate-limit records: two days.

Your choices and rights

• See and export. Your record shows everything it holds and where each piece came from, and your Joint Report exports it as a PDF or JSON at any time.
• Correct. Every field in your record is yours to change.
• Withdraw. Each authorization and consent can be withdrawn from your record, and the withdrawal is recorded.
• Delete. Write to privacy@sherlockhealth.ai from the email or phone your record uses, or tell us which it is so we can verify you. We will delete your record within 30 days and confirm, keeping only what the law requires us to keep, which we will tell you.
• Ask. You may ask what we hold about you and how it has been shared, and we will answer within 30 days.

Residents of California, Washington, and other states with consumer privacy or consumer health data laws have the rights those laws give, including the right to know, to delete, to withdraw consent, and not to be treated differently for exercising them. If we decline a request we will say why, and you may appeal by replying to our answer. An authorized agent may act for you with your written permission. We will not discriminate against you for exercising any right.

Children

JointVoyage is for adults. It is not directed to anyone under 18, and we do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.

Surgeon record pages

The pages at /surgeons are compiled from public sources about physicians, and each fact names its source and the date it was read. They are documented records, not ratings or recommendations. A physician may correct their own page after we verify their identity, or ask for it to come down. Anyone may report an error from the page itself or by writing to privacy@sherlockhealth.ai; a person reads every report and checks it against a source before the page changes.

Changes

When this policy changes, the effective date at the top moves and the change is recorded in the site’s changelog. A change that affects how your information is used will be shown to you in your record before it applies to you. Consents you have already given keep the wording you agreed to.

Contact

Sherlock Health, Inc., at privacy@sherlockhealth.ai. The terms of service, governed by the law of Delaware, set out the rest of the agreement between us.