Jobtiv Consumer Health Data Privacy Policy

Version 1.0

Last updated: [INSERT PUBLICATION DATE]


This policy is required by the consumer health data laws of Washington (the My Health My Data Act) and Nevada (Senate Bill 370), and we also use it to set out how we meet Connecticut's consumer health data rules, which do not require a separate policy but do require your consent and impose limits on what we may do. It is separate from our general Privacy Policy on purpose, because Washington and Nevada require it to be.

It applies to you if you live in Washington, Nevada or Connecticut, and to anyone whose health related information we collect while they are in Washington.

Jobtiv is operated by JOBTIV LTD, company number 17092844, 124-128 City Road, London, EC1V 2NX, United Kingdom. Contact us at support@jobtiv.ai.


We do not ask for health data

Jobtiv is a career platform. There is no field anywhere in the Service for your health, your diagnoses, your treatment, your medication or your disability, and we do not want that information.

We publish this policy because free text is free text. A person may write about a health related career gap in a CV or a cover letter, note a hospital appointment in an application tracker entry, or mention a condition when preparing to negotiate. If you do that, we hold consumer health data about you, and these laws apply.

Please do not enter health information into Jobtiv. If you already have, this policy explains your rights and how to use them.


1. Categories of consumer health data we collect

We collect only what you type. We do not buy health data, we do not obtain it from data brokers, advertising networks or public records, and we do not use any technology designed to estimate or predict your health status.

One qualification. When an artificial intelligence model answers a question about a career gap you have explained by reference to your health, its answer will reflect what you told it. Washington law treats health information that is derived or inferred in this way as consumer health data, and so do we.

CategoryHow it arises
Information about a past, present or future physical health condition, status, symptom, treatment, medication or diagnosisOnly where you write it in a document or a note
Information about a past, present or future mental health condition, status, treatment or diagnosisAs above
Information about a disability or a request for a workplace adjustmentAs above
Information about the use of, or attempt to obtain, health care servicesAs above
Health information derived or inferred from what you wrote, in the two ways described aboveOnly as a by-product of running the tool you asked us to run

We do not collect biometric data, genetic data, reproductive or sexual health data, gender affirming care data, or precise location data of any kind.


2. Categories of sources

You. That is the only source. We do not obtain consumer health data from data brokers, from public records, from affiliates, from advertising networks or from any third party.


3. Why we collect it

Only to provide the part of the Service you have asked us to provide. In practice that means:

  • storing the document, note or conversation you wrote it in, so you can come back to it;
  • passing it to the artificial intelligence provider that answers the request you made, so that the tool can respond to what you actually wrote; and
  • rendering the document into a file when you download it, or reading it out of a file when you upload one.

We do not use consumer health data for any other purpose. We do not use it for advertising, for analytics, for profiling, for training any model, for research, or to make any decision about you.


4. Who it is shared with

Affiliates. JOBTIV LTD has no parent, no subsidiaries and no affiliates. The list of affiliates with whom we share consumer health data is empty.

The categories of consumer health data we share are the same categories we collect, listed in section 1. We share them only where a document, note or conversation that contains them is being stored, rendered, read or answered, and only with the companies below.

CategoryNamed companiesWhy
Database, sign-in and file storageSupabaseTo store what you wrote
Artificial intelligence providersAnthropic, OpenAI, Google, OpenRouterTo answer the request you made in the tool you used
Reading a difficult PDFLlamaIndex (LlamaParse)To extract the text from a PDF you uploaded when our own parser cannot
Rendering a document to PDFBrowserlessTo turn your CV into a PDF file when you download it. Your whole document passes through it
Caching, so a tool can completeUpstashShort lived storage while a request is processed, held against your account, in databases located in the United Kingdom and Ireland
Email deliveryResendTo send you a message you asked for, where you have written health information into something we are sending
Application hostingVercelTo run the Service

Our error reporting and analytics providers, Sentry and PostHog, are configured so that the content of your documents and messages does not reach them. Section 12 of our Privacy Policy explains how.

Our full Sub-processor and Recipient List names every company we work with, where each one is, and what safeguard applies to information we send outside the United Kingdom.

We do not sell consumer health data. We have never sold it and we will not. We will not seek an authorisation to sell it, because we do not intend to sell it.

We will disclose consumer health data if we are legally required to by a court or a regulator with power to compel it, and we will tell you unless we are prevented from doing so.


5. Consent

We collect and share consumer health data only where that is necessary to provide the specific product or service you have asked us for. That is the exemption these laws provide, and we stay inside it.

Separately from that, before the first time you use a feature that sends one of your documents to an artificial intelligence provider, we ask you for a specific, unbundled permission to process sensitive information you have chosen to include, which includes health information. The box is not pre ticked and you can say no and still use the Service. If you say no, or withdraw it later, we stop sending your documents to artificial intelligence providers and we do not delete anything: your documents stay where they are and you can edit or delete them yourself at any time. You can withdraw the permission in Settings, then Privacy, then Sensitive information. Section 5.1 of our Privacy Policy sets this out in full.

We do not collect or share consumer health data for any purpose beyond providing the Service you asked for. If that ever changes, we will ask for your consent first, we will ask separately for collection and for sharing, and we will not bundle it into anything else.


6. Geofencing

We do not use geofencing at all. We do not build or use a virtual boundary around any location, and we do not collect precise location data. We will never establish a geofence around a health care facility.


7. Your rights

If this policy applies to you under the opening paragraph above, you have the right to:

  • Confirm whether we collect, share or sell consumer health data about you.
  • Access the consumer health data we hold about you, including a list of all third parties and affiliates with whom we have shared it, and contact details for each.
  • Withdraw your consent to our collection and sharing of your consumer health data.
  • Delete your consumer health data. When you ask us to, we delete it from our live systems and we instruct every processor that holds it to do the same. Our backups are encrypted and are overwritten on a rolling cycle, and a copy may remain in a backup until that cycle completes. We do not restore a backup in order to bring deleted data back. Some records are outside our reach altogether: short term abuse monitoring records held by the artificial intelligence providers that answered your requests, caches keyed to the contents of a file rather than to your account, and public CV share links, which are stored without any reference to your account and stop working 90 days after you create them. Section 13.4 of our Privacy Policy sets all of this out. If you have created a share link and you want it gone, delete the link before you delete anything else.

How to use these rights. Email support@jobtiv.ai with "Consumer health data request" in the subject line, and tell us which state you live in. You can also delete the specific document, note or conversation yourself in the product, or delete your whole account from Settings, then Danger zone.

Our response. We will respond within 45 days. If we need longer we will tell you within that period and take up to a further 45 days. There is no charge.

Authorised agents. You may use an authorised agent. We will ask for written proof of their authority.

If we refuse. We will tell you why, and you may appeal by replying to our decision or emailing support@jobtiv.ai with "Consumer health data appeal" in the subject line. We will decide the appeal within 60 days and write to you with our reasons. If we refuse your appeal you may complain to the Attorney General of your state, and we will give you the link.

Washington residents may also enforce the My Health My Data Act through the Washington Consumer Protection Act.


8. Changes to this policy

We will update this policy if what we do changes, and we will change the date at the top. If a change materially affects your rights, we will tell you before it takes effect.


JOBTIV LTD, registered in England and Wales, company number 17092844. Registered office: 124-128 City Road, London, EC1V 2NX. Contact: support@jobtiv.ai.


The other documents

These five documents work together, and each is a page on this site.

  • Privacy Policy
  • Terms of Service
  • Cookie Notice
  • Sub-processor and Recipient List

If any of these links does not work, tell us at support@jobtiv.ai and we will fix it. A legal page that does not load is a problem whatever it says.