--- title: "Privacy Policy — Juno" description: "How Juno (Sharedgenes, Inc.) collects, uses, and protects your information. Last updated July 23, 2026." canonical_url: "https://junocompanion.com/privacy" md_url: "https://junocompanion.com/privacy.md" last_updated: "2026-09-04" language: en --- [Back to Juno](https://junocompanion.com/) Juno legal # Privacy Policy Last updated: July 23, 2026 At Juno (operated by Sharedgenes, Inc.), we are committed to protecting your privacy and maintaining the confidentiality of your personal health information. **Data controller:** Sharedgenes, Inc., a Delaware corporation, United States ("Sharedgenes", "we", "us", "our"), is the controller of the personal data described in this policy. Contact: [team@juno-chat.com](mailto:team@juno-chat.com) (general) or [privacy@junocompanion.com](mailto:privacy@junocompanion.com) (privacy requests). Use of Juno is also governed by our [Terms of Service](https://junocompanion.com/terms). Residents of certain states (including Washington and Nevada) should also see our [Consumer Health Data Privacy Policy](https://junocompanion.com/consumer-health-data); cookie and website-data usage is described in our [Cookie Policy](https://junocompanion.com/cookies). Our published crisis protocol is at [AI Safety & Crisis Protocol](https://junocompanion.com/ai-safety). ## 1\. Information We Collect ### Personal Information - Name, email, and age - Authentication credentials ### Health & Wellness Information - Symptom logs and conditions you tell us about - Medication logs - Mood and sleep logs - Text and voice conversations with Juno (including transcripts of voice conversations) and the inferences Juno draws from them - Health-device biometrics you choose to connect via Apple HealthKit or Android Health Connect (for example heart rate, heart-rate variability, sleep, and steps) - Medical documents, records, and appointment notes you upload - Calendar data you choose to connect - Safety signals (used only to show you crisis resources; not a monitoring service) Each connected source (HealthKit, Health Connect, calendar, documents) is optional and is read only with your permission. ### Technical Information - Device data and usage data - Voice audio — processed in real time; raw audio is not retained after processing, but transcripts of voice conversations are saved to your chat history with your account and are deleted when you delete your account (subject to the limited retention exceptions in Section 6) - General location — for crisis support resources only ### Website Data - Server logs (including IP address) generated by our website host, Vercel, when you visit junocompanion.com - Password-reset tokens processed by Supabase on the reset-password page only ## 2\. How We Use Your Information - Personalized health support - Memory and continuity across conversations - Surfacing crisis resources when safety signals appear - Service improvement - Crash reporting and performance monitoring - Aggregated, de-identified research Juno can surface crisis resources but does not monitor your messages for emergencies and cannot guarantee it will detect a crisis or contact anyone on your behalf. If you are in crisis, call or text 988 (Suicide & Crisis Lifeline); in an emergency, call 911. ## 3\. Consent Health information is sensitive data. We process your health information only with your consent, which we ask for when you create your account and before each optional data source (such as HealthKit, Health Connect, calendar, or document upload) is connected. We will ask again before any materially new purpose. You can withdraw your consent at any time in Settings or by contacting us; after withdrawal we stop the related processing within 15 days. **Reproductive and sexual health information.** You may choose to share reproductive or sexual health information with Juno. We collect it only with your consent, we never sell or disclose it for marketing, and you can withdraw consent or delete it at any time. For users we know are 16–17, we process personal data only as strictly necessary to provide Juno, and we exclude their data from research and product-improvement analytics unless they separately consent. Quebec and Brazil residents: we obtain express consent for the collection and use of sensitive personal information as required by Law 25 and the LGPD. ## 4\. Legal Bases for Processing (EEA and UK users) - **Explicit consent** (Art. 9(2)(a) GDPR / UK GDPR) — all health and wellness information. You can withdraw consent at any time in Settings or by email; withdrawal does not affect processing that happened before it. - **Contract** (Art. 6(1)(b)) — account creation, subscriptions, and delivering the service you asked for. - **Legitimate interests** (Art. 6(1)(f)) — security, fraud prevention, crash reporting and diagnostics, and de-identified research. - **Legal obligation** (Art. 6(1)(c)) — where we must retain or disclose data to comply with law. ## 5\. Analytics & Diagnostics Our website sets no analytics or advertising trackers. In the app we use: - **Sentry** — crash and error reporting - **RevenueCat** — subscription and billing analytics - **Apple App Store / Google Play** — store-provided app analytics This data is pseudonymous where possible and excludes the content of your health conversations. Health conversations are **NEVER** tracked for analytics. ## 6\. Data Security & Retention - Encryption in transit (TLS 1.2+) - AES-256 encryption at rest - Strict access controls - Regular security audits **HIPAA status.** Juno is a direct-to-consumer wellness service. We are not a HIPAA covered entity or business associate, and HIPAA does not apply to the data you share with Juno. We instead protect your information under the FTC Act, the FTC Health Breach Notification Rule, and applicable state and international privacy laws. Do not assume HIPAA applies. **Breach notification.** If a breach of security affecting your unsecured health information occurs, we will notify you and the FTC as required by the FTC Health Breach Notification Rule (16 CFR Part 318) — without unreasonable delay and no later than 60 days after discovery. If a security incident affects your personal information, we will notify you and the applicable regulators as required by law, including within the timelines set by New York's breach-notification statute, and wherever an incident creates a real risk of harm to you. ### Retention - Health and conversation data (including voice transcripts): retained while your account is active; deleted or de-identified from live systems without undue delay and within 30 days of account deletion - Encrypted backups: purged on a 35-day rolling cycle - Billing records: retained by our payment processors (Apple, Google, RevenueCat) for up to 7 years where required by tax and accounting law - Crash logs: 90 days - De-identified, aggregated data may be retained When you delete your account we also instruct our processors (Supabase, OpenAI, mem0, Sentry) to delete your data. Limited exceptions apply where we must keep specific records for legal, security, fraud-prevention, or billing reasons. ## 7\. Data Sharing We **never** sell your health data and never share it for advertising. We do not share data with data brokers. Service providers that process data on our behalf to run Juno: - **OpenAI** — AI models that process your chat messages and real-time voice conversations - **Supabase** (hosted on AWS) — database and backend infrastructure - **mem0** — AI memory layer for conversation continuity - **RevenueCat** — subscription billing - **Sentry** — crash reporting - **Expo** — app builds and updates - **Vercel** — website hosting and media storage - **Apple App Store / Google Play** — payments (acting as independent controllers) Our AI providers process your conversations under agreements that prohibit using your data to train their models. Specifically, under OpenAI's API terms, data sent through the API is not used to train or improve OpenAI's models, and we have not opted in to any data-sharing program. OpenAI may retain API data for up to 30 days for abuse monitoring, after which it is deleted unless retention is legally required. We do not use your conversations, symptoms, or health data to train AI models. At your direction, we share the summaries and reports you generate with the clinicians or clinician portals you designate. **Crisis safety.** Automated detection in Juno only surfaces crisis resources to you. Any disclosure to emergency services would happen only after human review, or when required by law. You have the right to human intervention and to contest any decision of this kind. Juno cannot guarantee it will detect a crisis — if you are in danger, call or text 988, or call 911. **California.** Because Juno lets you manage your health information, Sharedgenes is treated as a provider of health care under California's Confidentiality of Medical Information Act (CMIA, Civ. Code §56.06), and we protect your medical information in accordance with the CMIA: we maintain its confidentiality and do not disclose it without your authorization, except as the CMIA permits. **Texas.** We handle Texas residents' health information subject to the Texas Medical Records Privacy Act (HB 300). We do not sell your health information and do not use it for marketing without your consent. See also the electronic-disclosure notice in our [Consumer Health Data Privacy Policy](https://junocompanion.com/consumer-health-data). ## 8\. Your Rights Wherever you live, you can exercise your rights by emailing [privacy@junocompanion.com](mailto:privacy@junocompanion.com) (or [team@juno-chat.com](mailto:team@juno-chat.com)) or using Settings > Privacy in the app. We verify requests using your account credentials, respond free of charge (at least twice per year), and never discriminate against you for exercising a right. If we need to verify your identity or ask you to clarify your request, the response period may pause until you reply. ### EEA & UK (GDPR / UK GDPR) - Access your data (Art. 15) and receive a copy - Rectify inaccurate data (Art. 16) - Erasure ("right to be forgotten", Art. 17) - Restrict processing (Art. 18) - Data portability in a machine-readable format (Art. 20) - Withdraw consent at any time (Art. 7(3)) - Not be subject to solely automated decisions with legal or similarly significant effects (Art. 22) **Right to object (Art. 21).** You may object at any time to processing based on our legitimate interests. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. We respond within one month. You may lodge a complaint with your supervisory authority (see the [EDPB members list](https://www.edpb.europa.eu/about-edpb/about-edpb/members_en)). UK users may complain to the Information Commissioner's Office (ico.org.uk/make-a-complaint, 0303 123 1113). You may also complain directly to us (see "Complaints" below). ### United States state privacy rights Residents of California, Colorado, Connecticut, Delaware, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Texas, Virginia, and other states with comprehensive privacy laws have the right to: - Confirm whether we process your personal data and access it - Correct inaccuracies - Delete your personal data - Obtain a portable copy - Opt out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects — we do none of these, and we do not sell personal data - Obtain a list of the categories of third parties to which personal data has been disclosed (Delaware, Minnesota, Oregon; see Section 7 — we have sold personal data to no one) - Question the result of profiling and learn the reason (Minnesota) — we do not profile you in furtherance of such decisions - Withdraw consent for sensitive-data processing at any time We respond within 45 days (extendable once by 45 days when reasonably necessary; we will tell you if so). Requests are free at least twice in any 12-month period. **Appeal:** if we decline a request, reply with the subject line "Privacy Appeal" and we will issue a written appeal decision within 60 days. If we deny your appeal, you may contact your state Attorney General (for example Connecticut: portal.ct.gov/ag). Washington and Nevada consumer health data rights and appeals are described in our [Consumer Health Data Privacy Policy](https://junocompanion.com/consumer-health-data). We do not sell personal data, do not process it for targeted advertising, and do not use your personal data to train large language models. ### Complaints You can complain about our data handling by emailing [privacy@junocompanion.com](mailto:privacy@junocompanion.com) with the subject "Complaint" — this is our electronic complaints route, maintained in line with the UK Data (Use and Access) Act 2025. We acknowledge complaints within 30 days of receipt, investigate, and tell you the outcome without undue delay, in plain language. UK users: if you are dissatisfied with our response — or at any time — you can escalate your complaint to the Information Commissioner's Office (ico.org.uk/make-a-complaint, 0303 123 1113). ## 9\. International Data Transfers Our servers are located in the United States. If you use Juno from outside the US, your personal data is transferred to, stored, and processed in the United States, where it may be accessible to US courts, law enforcement, and national-security authorities under US law. For EEA users, transfers rely on the EU-U.S. Data Privacy Framework where our subprocessors are certified, and otherwise on Standard Contractual Clauses. For UK users, transfers rely on the UK-US Data Bridge (the UK Extension to the DPF) where available, and otherwise on the UK International Data Transfer Agreement or Addendum. You can request a copy of the relevant safeguards at [privacy@junocompanion.com](mailto:privacy@junocompanion.com). Quebec residents: your personal information may be communicated outside Quebec (to the United States); we have assessed these transfers as required by Quebec law (Law 25). ## 10\. Children's and Teens' Privacy Juno is not intended for anyone under 16, and we do not knowingly collect data from anyone under 16. We ask your age at signup. Because our minimum age is 16, users in the EEA and UK meet every applicable age of digital consent. If we discover we have collected data from a child below the applicable age, we delete it promptly. For users aged 16–17 (where permitted with parental agreement): we apply data minimization, never sell their data or use it for targeted advertising, exclude it from research and product-improvement analytics absent separate consent, and show AI-status and take-a-break reminders. Parents and guardians can contact us to access or delete their teen's data (with identity verification) at [privacy@junocompanion.com](mailto:privacy@junocompanion.com). ## 11\. Australia We handle personal information in accordance with the Australian Privacy Principles. Your data is disclosed to service providers in the United States (Section 9). You can request access to or correction of your personal information through our Privacy Officer (Section 12); we respond within 30 days. If you are unhappy with our handling of a complaint, you may contact the Office of the Australian Information Commissioner (oaic.gov.au). ## 12\. Privacy Officer & Accountability Sharedgenes has designated a Privacy Officer (Responsable de la protection des renseignements personnels for Quebec) accountable for our handling of personal information. Reach the Privacy Officer at [privacy@junocompanion.com](mailto:privacy@junocompanion.com). We verify your identity, respond within 30 days, and if you are dissatisfied you may complain to your regulator: OPC (Canada), CAI (Quebec), OAIC (Australia), or ANPD (Brazil). ## 13\. Medical Disclaimer Juno is an AI companion designed for general wellness support. It is **NOT** a medical device or a medical professional, and it does not provide medical advice, diagnosis, or treatment. Always consult qualified healthcare providers for medical advice. If you are in crisis, call or text 988; in an emergency, call 911. ## 14\. Changes to This Policy We may update this Privacy Policy from time to time and will show the date of the latest revision at the top of this page. We will notify you of any significant changes before they take effect. ## 15\. Contact If you have any questions about this Privacy Policy, please contact us at [team@juno-chat.com](mailto:team@juno-chat.com). Sharedgenes, Inc. We aim to respond within 48 hours. --- Source: [Privacy Policy — Juno](https://junocompanion.com/privacy)