Privacy Policy

Who we are

Sherlock Health, Inc. (“Sherlock Health,” “we”) operates JointVoyage at jointvoyage.com and also operates OpenDoc. This policy covers jointvoyage.com and the text messages and emails it sends. OpenDoc has its own policy, which applies when you are on OpenDoc. JointVoyage is operated independently of any surgical practice.

Write to us at privacy@sherlockhealth.ai. That mailbox is monitored, and it is the one place every request about your information goes.

What we collect

Before you sign in. The Fit Score and the Readiness Score run in your browser and on our servers without a record. Nothing you answer is kept unless you sign in, with three exceptions: an X-ray, blood-panel or EKG upload you make anonymously is stored under a case reference for 30 days and then deleted; a request to share a report with a provider is stored so the request can be fulfilled; and a request for a surgeon’s opinion or surgery made from a surgeon’s page before you sign in is stored with the contact details you typed, and sent to OpenDoc as described below.

Your record, once you sign in. Your phone number or email address; your name, date of birth, sex and ZIP code when you provide them; your Medicare status; your answers; files you upload (X-rays, imaging reports, laboratory results, EKGs, clearance letters); your medications and medical history; your home support arrangements; your chosen surgeon and surgery date; daily check-ins and outcome questionnaires; and consents and authorizations, each with the version of the wording you agreed to. Nothing is entered on your behalf: a clinician you authorize reads your record and writes their own notes, reviews and opinions on it, and does not message you through JointVoyage.

Physician accounts. A physician’s name, email, NPI, practice, the cell phone number they verified and the status of their identity verification, the registry account identifier they choose to enter, and the clinical notes, reviews and opinions they write on cases patients have authorized.

Surgeon records. The public surgeon record pages are compiled from public sources about physicians (Medicare claims, the AAHKS member directory, and pages that state a physician’s training). They are described under Surgeon record pages below.

Technical. Our hosting provider records the network address and request details of every visit for security and reliability. We keep a per-address rate limit for a short period, as a hash rather than an address. We count how many people reach each step of the preparation guide, by day, with no identity attached. If you arrive from a partner practice’s website that has turned on visit measurement, that site sends us which sections of its own pages you read and for how long, under a random visit identifier it assigns; the identifier is joined to your record only once you sign in here, so the practice can see that visits like yours led to a record, never which record. Those visits are deleted after 90 days. We run no advertising pixels, session-replay tools or third-party analytics on jointvoyage.com.

How we use it

Optional replacement research (added September 12, 2026). My replacements keeps separate records for joints, sides, and operations, including patient-reported procedure details, health factors, and dated follow-up. Research sharing is off until you opt in for that replacement. With that separate permission, authorized JointVoyage researchers can review the record and the documents and questionnaires you explicitly link to it. Restricted research exports use coded identifiers and omit names, contact details, exact dates, documents, and free text; coded data are not anonymous. Turning sharing off excludes that replacement from future exports while keeping your personal record. Prior exports and completed analyses cannot be recalled automatically. This does not authorize outside records retrieval or publication of individual records. Read the collection methods.

• To provide the service: your scores, your record, your preparation pathway, your recovery check-ins, and the reports you generate.
• To text or email you, as described under Text messages below.
• To give a clinician access to your record when, and only when, you authorize that clinician by name.
• To build the de-identified preoperative registry, only from records whose owner has turned research consent on, and only as counts, never free text or dates. The registry report is shown to every physician whose identity we have verified; any count below eleven patients is withheld.
• To validate our own scores against outcomes, as our operating data, under the plan published at /methodology. That analysis carries no name or contact detail.
• To keep the service secure, to enforce our terms, and to meet legal obligations.

We do not sell personal information, and we do not share it for targeted advertising.

Who we share it with

Clinicians you authorize. Nothing in your record reaches a clinician unless you authorize that clinician by name. Each authorization is recorded with the version of its wording and the date, and you can revoke it from your record. A clinician who has already signed a note, review or opinion keeps a copy of what they signed.

OpenDoc. When you ask for a surgeon’s written opinion or a surgery request, we send OpenDoc your phone number, your state, the dates you gave as available, the surgeon’s name and NPI, and which of the two you asked for, under a versioned authorization you see and accept first. That request is itself a fact about your health, which is why it needs your authorization. Your scores, your answers, your joint, your diagnosis and your date of birth do not go with it. When a page lists what a surgeon offers through OpenDoc, we tell OpenDoc your state and whether you said you are on Medicare, and nothing else. OpenDoc collects the payment and handles the surgeon’s side under its own terms and policy.

Planning programs. Some surgeons’ pages link to a planning technology’s own request form on that vendor’s site. Following the link is your choice, and JointVoyage sends the vendor nothing; what you type there is governed by the vendor’s policy.

Service providers. Cloudflare hosts the site, its database and its file storage. Telnyx delivers our text messages. Resend delivers our emails. Each acts on our instructions under a written agreement, including a business associate agreement, that binds it to protect the information.

Registries. A surgeon you have authorized may submit your case to the American Joint Replacement Registry from their own registry account, using the identifying details the registry requires. That submission is the surgeon’s, under their own obligations.

Legal. We disclose information when the law requires it, to protect the safety of a person, or to enforce our terms.

A consumer health app, and HIPAA

JointVoyage is a consumer health app. The information in your record is entered by you, belongs to you, and is not a medical record. HIPAA governs health care providers and the companies that work for them; JointVoyage is neither, so your information here is protected instead by this policy, by the Federal Trade Commission’s Health Breach Notification Rule, and by state consumer health data laws where they apply.

When you authorize a clinician to read your record, or buy a written opinion from a surgeon, what that clinician receives and writes is theirs to hold under their own professional and legal obligations, including HIPAA where it applies to them; their own Notice of Privacy Practices governs what they do with it. We hold your information to the same standard either way: encrypted in transit and at rest, reachable only through your sign-in, shared only on your authorization, and every clinician read written to an access log.

Text messages

Signing in with a phone number gives us that number, and we use it for one-time sign-in codes and for the notifications your record generates: preparation reminders before a surgery date, a daily recovery check-in for two weeks after surgery and weekly to ninety days, and outcome questionnaires at their windows. At most one scheduled notification a day, plus a text when a surgeon signs a written opinion you asked for. No text contains health information; each says something is waiting and links to a page that asks you to sign in.

The one exception is a medication reminder that names the medication, which we send only if you have separately consented to it, having read that text messages are not encrypted. You can withdraw that consent at any time from your record.

Reply STOP to any message to stop all texts from JointVoyage, including sign-in codes; reply START to resume; reply HELP for help. Message and data rates may apply. Your carrier is not responsible for delayed or undelivered messages.

Cookies and storage on your device

We set one cookie for everyone who signs in, which holds your signed-in session. It is encrypted, is not readable by scripts and is not shared with anyone. You are signed out automatically after 24 hours without activity, and after 30 days in any case; a clinician or administrator reading records other than their own is signed out after 30 minutes without activity. Signing out ends the session on every device it was copied to. If you arrive from a partner practice’s website, two more cookies hold, for 30 days, which practice sent you and the random visit identifier described under Technical above. If you arrive through Your Joint Options, a separate source cookie lasts up to 30 days and contains only the source flag, with no visitor identifier or health answers. After sign-in and acceptance of the record agreement, we associate that source with your account and count assessment starts and saved Fit Scores in a restricted aggregate referral report. We honor Do Not Track and Global Privacy Control for this attribution. We set no advertising cookies.

While you take the Fit Score or the Readiness Score, your answers are kept in your own browser’s storage for 24 hours so that closing the tab does not lose them, and are cleared when you finish or sign out; on a shared device, anyone using that browser within the day could open them. A report you build for a provider is held in the tab only until it is delivered.

Education pages show a video from YouTube only after you press play; until then nothing is requested from YouTube. Playing one is subject to Google’s policy.

Security

Connections are encrypted, and stored data is encrypted at rest by our hosting provider. There are no passwords to leak: sign-in is a one-time code sent to your phone or email. A clinician sees your record only by your named authorization, only after we have verified their identity, and every clinician read of a case or a file is written to an access log; every sign-in, failed code and sign-out is written to a second log, and every message we send is recorded as the kind of message it was, never its text. Pages shown to a signed-in person are marked so the browser does not keep a copy. Uploaded files are served only through an authenticated request; they have no public address. No security is perfect; if we learn of a breach affecting your information we will notify you and the authorities the law requires, within the time it requires.

How long we keep it

• Your record, including everything you uploaded: for as long as it is active, and until you ask us to delete it. Deletion removes the record, its files and every note, review and opinion written on it, in one action; the clinician who signed a note keeps their own copy under their own obligations.
• Anonymous imaging uploads: 30 days, then deleted automatically, files and all.
• A request to share a report with a provider: 90 days, then deleted automatically. A request for a surgeon’s opinion, office visit or surgery made before you sign in: one year, then deleted automatically; made from your record, it stays with the record. A report you send about a surgeon’s page: one year.
• The access log, the sign-in log, the record of your STOP, and security records: kept after deletion, because they hold identifiers rather than your information and exist to answer questions about who read what, who signed in, and who asked not to be texted.
• Sign-in codes: ten minutes. The record of a texted one-tap link: 30 days after the link expires. Rate-limit records: two days. Partner-website visits: 90 days. The registry’s published snapshots, which hold counts and the ids of the records counted: two years.

Your choices and rights

• See and export. Your record shows everything it holds and where each piece came from, and your Joint Report exports it as a PDF or JSON at any time.
• Correct. Every field in your record is yours to change.
• Withdraw. Each authorization and consent can be withdrawn from your record, and the withdrawal is recorded.
• Delete. Write to privacy@sherlockhealth.ai from the email or phone your record uses, or tell us which it is so we can verify you. We will delete your record within 30 days and confirm, keeping only the access log, the record of a STOP you sent, and anything the law requires us to keep, which we will tell you.
• Ask. You may ask what we hold about you and how it has been shared, and we will answer within 30 days.

Residents of California, Washington, and other states with consumer privacy or consumer health data laws have the rights those laws give, including the right to know, to delete, to withdraw consent, and not to be treated differently for exercising them. If we decline a request we will say why, and you may appeal by replying to our answer. An authorized agent may act for you with your written permission. We will not discriminate against you for exercising any right.

Children

JointVoyage is for adults. It is not directed to anyone under 18, and we do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.

Surgeon record pages

The pages at /surgeons are compiled from public sources about physicians, and each fact names its source and the date it was read. They are documented records, not ratings or recommendations. A physician may correct their own page after we verify their identity, or ask for it to come down. Anyone may report an error from the page itself or by writing to privacy@sherlockhealth.ai; a person reads every report and checks it against a source before the page changes.

Changes

When this policy changes, the effective date at the top moves and the change is recorded in the site’s changelog. A change that affects how your information is used will be shown to you in your record before it applies to you. Consents you have already given keep the wording you agreed to.

Contact

Sherlock Health, Inc., at privacy@sherlockhealth.ai. The terms of service, governed by the law of Delaware, set out the rest of the agreement between us.