Privacy Policy — The Dr. E App
Effective date: October 17, 2026
The Dr. E App (the "App") is a free companion app for patients and referring professionals of Valhalla Health and Spine (Dr. Elan Michael, Chiropractor), 465 Columbus Ave, Suite 250, Valhalla, NY 10595. The App is published by Elan Michael. In this policy, "we," "us," and "our" refer to Elan Michael and Valhalla Health and Spine.
We built the App to collect as little as possible. In short: the App has no accounts, no advertising, no analytics, and no tracking, and it never asks for, collects, sells, or shares your name, contact details, or health records. The only information that leaves your phone because of the App is (1) an ordinary download of the clinic's tips, tip videos, announcements, and rewards list, (2) if you choose to turn on Clinic announcements, an anonymous push-notification token for your device (section 4), (3) if you choose to use Ask Dr. E, the public community Q&A board, the nickname and text you post plus an anonymous device ID (section 6), and (4) once you earn points in Valhalla Rewards, a record of which point-earning activities you did (for example "played Spine Align, 3 stars," "marked chin tucks done," or "daily check-in"), tied only to a separate anonymous Rewards ID (section 7). Ask Dr. E and Valhalla Rewards use two different random IDs, so our records cannot connect your posts to your Rewards activity. The optional Posture Hero game uses your camera only live, on your device; no images or video ever leave your phone (section 3).
1. Information the App does not collect
The App does not:
• require or offer sign-up, login, or user accounts (Ask Dr. E uses a nickname you choose, not an account);
• include advertising, analytics, crash-reporting, or tracking tools (SDKs);
• use advertising identifiers or track you across other companies' apps or websites;
• access your location, contacts, photos, microphone, calendar, or health data (for example, Apple Health or Health Connect);
• record, save, or upload camera images or video (the camera is used only live, on your device, by the optional Posture Hero game; see section 3);
• ask for or keep medical records, diagnoses, or other protected health information (PHI) (Ask Dr. E posts are public and must not contain identifying information; see section 6);
• sell or share personal information with anyone.
2. Information stored only on your device (reminders)
The App lets you set two optional reminders:
• an appointment reminder (the appointment date and time you pick and how far ahead to be reminded), and
• a daily exercise reminder (the time of day you pick).
These settings are saved only in the App's private storage on your phone and are scheduled as local notifications by your phone's operating system. They are never sent to us or to any third party. Reminder text is generic (for example, "Time for your exercises"). The App asks for notification permission only when you set a reminder or turn on Clinic announcements; you can decline, or turn notifications off at any time in your device Settings.
The App also keeps a copy of the latest tips and announcements (section 5) on your device so they are available offline.
You can delete this information at any time by clearing a reminder in the App's Reminders screen, or by deleting the App, which removes all of its data from your device. Depending on your device settings, your phone's own operating-system backup (such as iCloud or Google device backup) may include the App's local data; that backup is controlled by you and your device provider, not by us.
3. Posture Hero camera (on-device only) and mini-game scores
Posture Hero is an optional posture and exercise game. If you choose a challenge in camera mode, the App asks for camera permission and uses your phone's front camera live, entirely on your device:
• Each camera frame is analyzed in your phone's memory by a pose-detection model that is built into the App (no internet connection is used), which finds 17 body points (such as shoulders, ears, and hips) to score your form. The frame is discarded immediately after it is analyzed, a fraction of a second later.
• No photos, video, or audio are ever recorded, saved to your device, or sent to us or anyone else. The body points themselves are used only during the challenge and are not stored or sent either.
• You can decline camera permission, or turn it off at any time in your device Settings, and still play in guided mode, which uses only a timer.
• Spoken coaching cues are generated by your phone's built-in text-to-speech; the App does not use the microphone.
Scores from the in-app mini games (Spine Align, Posture Hero, and the chiropractic adjustment game; score, stars, challenge played, and date) are saved only on your device to show your personal bests, and are removed when you delete the App. Your scores themselves are never sent anywhere; for Valhalla Rewards the App sends only which game you finished and its star rating (0–3) (section 7).
4. Clinic announcements (optional push notifications)
Clinic announcements are off by default. If you turn on "Clinic announcements" (in Reminders or More > Announcements) and allow notifications:
• your phone's operating system issues a device push token, a random identifier that lets notifications be delivered to the App on that device, through Expo's push notification service;
• the App sends that token and your device platform (iOS or Android) over an encrypted (HTTPS) connection to our announcements service, which stores the token, the platform, and the date it was last seen.
The token is not linked to your name, phone number, email, appointments, any account, or the anonymous IDs used by Ask Dr. E and Valhalla Rewards, and we cannot tell whose device a token belongs to. We use it only to send the same general announcements (for example, holiday hours, clinic news, or a new weekly tip) to every opted-in device. Announcements never contain personal or health information.
If you tap "Send me a test notification," the App sends your token to our service, which sends one test message to that token only. Turning the switch off deletes your token from our announcements service. If you delete the App or block notifications, your token stops working and is removed the next time we send an announcement; any token we haven't seen for 13 months is deleted automatically. To check that notifications were delivered, our service keeps a short delivery log (a shortened one-way scrambled version of the token, the message title, and whether delivery succeeded) for 30 days. Messages are also listed inside the App under More > Announcements, so you can read them without turning on notifications.
To deliver notifications, the token and message pass through service providers acting on our behalf: Expo (650 Industries, Inc.; https://expo.dev/privacy), Apple Push Notification service (Apple devices) or Firebase Cloud Messaging (Google, on Android devices; https://policies.google.com/privacy), and Cloudflare, which hosts our announcements service (https://www.cloudflare.com/privacypolicy/). We do not sell or share tokens with anyone else.
5. Tips, tip videos, announcements, and rewards list
Dr. E's weekly tips, the in-app announcements list, and the list of rewards are loaded from the clinic's own web service (hosted on Cloudflare). Tip videos that play inside the App, and their preview images, are streamed from that same clinic service. The App downloads all of these with ordinary web requests that do not carry any identifier, account, or personal information, and nothing about what you watch is sent with them. As with any website visit, Cloudflare receives your device's IP address and basic technical information (such as the app type) to deliver the content; our code does not record or use it for these downloads. (If you tap "I watched this tip" to earn points, that is recorded as described in section 7.)
Some tips may instead link to a video on YouTube. For those, the App shows YouTube's preview image, loaded directly from YouTube's servers, and the video opens on YouTube in a browser window. YouTube is operated by Google and may collect information, such as your IP address, under Google's Privacy Policy (https://policies.google.com/privacy).
6. Ask Dr. E (community questions and answers)
Ask Dr. E is an optional, public question-and-answer board inside the App where patients ask general questions and Dr. E and other community members reply. There is no account and we never ask for your real name, email, or phone number. Before your first post you must accept the community guidelines.
What we collect if you post or report:
• the nickname you choose (please don't use your real name), the text of your questions and replies, and the time you posted;
• an anonymous device ID: a random code the App creates on your phone the first time you open Ask Dr. E. It is used only for Ask Dr. E; Valhalla Rewards uses a different random code (section 7). It is not your phone number, Apple or Google account, advertising identifier, or hardware serial number, and it is not linked to your identity. The App sends it with Ask Dr. E requests, including when you just read the board. Our service stores it only when you post or report, and only as a one-way scrambled (hashed) version, which lets us count reports fairly, limit spam, and enforce bans. Each post also shows the App a short scrambled "author code" derived from it, so that blocking someone hides all of their posts on your phone; it cannot be turned back into the device ID;
• report data: if you report a post, the post, the reason you picked, the time, and your hashed device ID (so each device counts once);
• rate-limit records: to stop spam and automated scraping, our service briefly records a one-way hashed version of your device ID and of your network (IP) address with the time of each post or report, and a one-way hashed version of your network (IP) address only (not your device ID) each time the board or a question is loaded. These records are deleted automatically within 24 hours;
• ban records: if a device or nickname is banned for breaking the community guidelines, we keep the hashed device ID, the nickname, the reason, and the date until the ban is lifted.
Stored only on your phone: your nickname, whether you accepted the guidelines, people you blocked, and posts you reported. Blocking hides someone's posts on your device only.
Public content. Your nickname, questions, and replies are visible to everyone who uses the App. Do not include names, dates of birth, addresses, phone numbers, emails, insurance or claim numbers, or other details that identify you or anyone else. The App automatically rejects posts containing phone numbers, email addresses, links, and profanity. Anything you choose to write about your health becomes public, so share only what you are comfortable with. Posting does not create a doctor-patient relationship, replies are general information and not medical advice, and posts are not part of any medical record.
How we use it: only to operate the board: showing posts, letting Dr. E reply (his replies carry a "Verified" badge), enforcing the community guidelines (removing content, automatically hiding posts reported by three different devices, and banning devices or nicknames that break the rules), and preventing spam. We do not use it for advertising and we do not sell or share it.
Retention and deletion. Posts stay up until they are removed. The clinic may remove any post at any time. Removed posts, and reports about them, are permanently deleted from our database within 90 days; posts hidden by reports are kept until the clinic reviews them. To have a post you wrote removed, email us with your nickname, the question title, and the approximate date (we cannot look posts up by your real name because we don't have it). Deleting the App removes the device ID and your local settings from your phone; posts you already made stay public unless you ask us to remove them.
Service provider. Ask Dr. E runs on Cloudflare (Workers and D1 database; https://www.cloudflare.com/privacypolicy/), which processes this data on our behalf.
7. Valhalla Rewards (points, streaks, and prizes)
Valhalla Rewards lets you earn points for using the App (finishing a game, marking a home exercise done, watching the weekly tip, and a daily check-in), keep a daily streak, and trade points for courtesy gifts at the front desk. There is still no account, name, email, or phone number.
What is sent to our service, and when. Nothing is sent until you earn your first points. After that, each time you earn points the App sends, over an encrypted (HTTPS) connection:
• an anonymous Rewards ID: a random code the App creates on your phone for Valhalla Rewards only. It is different from the Ask Dr. E device ID in section 6, is never sent with Ask Dr. E posts, and our service stores only a one-way hashed version of it (scrambled differently from Ask Dr. E IDs, so the two can never match);
• the type of activity and its time: which game you finished and its star rating (0–3), which home exercise you marked done (for example "chin tucks"), which weekly tip you watched, or a daily check-in. Game scores, camera data, and anything you type are not sent.
Our service applies the same point rules as the App (including daily limits that keep things fair) and keeps, for that hashed Rewards ID only: a list of these activity records, your point balance, points earned and spent, and your streak.
Redeeming a gift. When you tap Redeem, the App asks our service for a short one-time code (shown as text and a QR code) for the gift you picked. Front-desk staff confirm it with a staff PIN that is checked only by our service; points are deducted only then. We store the code, the gift, its point cost, and when it was created and redeemed, linked to the hashed Rewards ID. To protect against abuse, our service briefly records a one-way hashed version of the network (IP) address used for PIN attempts and similar actions; these records are deleted within 24 hours.
How we use it: only to run Rewards: keeping your balance and streak, applying daily limits, preventing cheating, and confirming gifts at the front desk. We may look at overall totals (for example, how many gifts were redeemed), never at individuals. When you redeem a gift, front-desk staff see you in person, but the code and our records do not include your name. We do not write your name down with the code, we do not add Rewards activity to your patient file, and we do not try to connect a redemption to your identity. Because Rewards and Ask Dr. E use different IDs, a redemption cannot be connected to Ask Dr. E posts. It is not used for advertising, analytics, or tracking, and it is not sold or shared.
Retention and your choices. Points are tied to the App on your phone. If you delete the App, your balance can't be recovered, and the record on our service is deleted automatically after 13 months without activity (redemption records are also deleted after 13 months). Because nothing links the record to you, we can't look it up by name. Rewards are courtesy gifts; no purchase or insurance billing is required, and the offer may change.
One-time update for earlier versions. Earlier test versions of the App (before October 18, 2026) used the Ask Dr. E device ID for Rewards too. The first time an updated App uses Rewards on a phone that already has points, it sends both codes to our service once, so the service can move your existing points, streak, and any pending gift code to the new Rewards ID. The service uses the old code only to find your Rewards records, does not store the two codes together, and afterwards keeps no record that connects them. Phones without earlier points skip this step and never send the two codes together.
8. Referral form (for attorneys and physical therapists)
The App includes a referral form for professionals. The App does not transmit the form itself. When you tap "Compose referral email," the App opens a pre-filled draft in your own email app, addressed to vhs@valhallahealthandspine.com, containing the details you typed (your name, firm or practice, phone and/or email, case type, and notes). Nothing is sent unless you choose to press Send in your email app.
If you send it, we receive it as an ordinary email and use it only to respond to you and coordinate the referral. We keep such emails as part of our normal business correspondence for as long as needed for that purpose and any legal or professional record-keeping obligations. The form asks you not to include protected health information; patient information is collected separately by phone. To ask us to delete a referral email, contact us at the address below.
9. Links that open other apps and websites
Some buttons hand you off to other apps or websites, which handle your information under their own privacy policies, not this one:
• Online booking opens our booking page on Jane App (valhallahealthandspine.janeapp.com) in a browser window. Any information you enter there (such as your name, contact details, and appointment details) is collected by Jane and the clinic through Jane's platform, under Jane's privacy notice (https://jane.app/legal/privacy-notice) and the clinic's patient privacy practices.
• Exercise videos open on YouTube in a browser window (see Google's Privacy Policy above).
• Leave a Review opens the clinic's page on Google in a browser window. If you write a review, you do so with your own Google account, under Google's Privacy Policy, and the review is public on Google.
• Call, Directions, and Email buttons open your phone dialer, your maps app (Apple Maps or Google Maps), or your email app.
10. Health information disclaimer
Exercise and tip content in the App is general wellness information, not personal medical advice. The App does not ask for symptoms, diagnoses, treatment records, or other health information. Answers in Ask Dr. E, including Dr. E's, are general information and not a substitute for an examination; in an emergency call 911.
11. Children's privacy
The App is intended for a general audience and is not directed to children under 13. It does not knowingly collect personal information from children, and children under 13 should not post in Ask Dr. E. If you believe a child has posted, contact us and we will remove it.
12. Security and retention
Reminder settings and game scores stay in the App's sandboxed storage on your device, protected by your device's own security features. Push tokens are sent only over encrypted connections and are kept only while you remain opted in, and never more than 13 months after we last see them (see section 4). Ask Dr. E posts, hashed device IDs, and reports, and Valhalla Rewards hashed Rewards IDs, activity records, balances, and redemption codes, are stored on Cloudflare over encrypted connections and kept as described in sections 6 and 7. Camera frames used by Posture Hero are never stored anywhere (section 3). We do not keep any other data from the App.
13. Your choices and rights
You control the App's data directly: clear reminders in the App, turn Clinic announcements off to delete your push token from our service, delete the App, or block people and report posts in Ask Dr. E. You can use the App without earning points; nothing is sent to Rewards until you do. Because tokens are not linked to your identity, we cannot look up a token by your name; turning the switch off is the way to remove it. If you want an Ask Dr. E post you wrote removed (section 6), or have emailed us (for example through the referral form) and want a copy deleted, or have any privacy question, contact us below. Depending on where you live, you may have additional rights under applicable law; we will honor valid requests.
14. Changes to this policy
If the App's features change in a way that affects your privacy, we will update this policy and its effective date, and, where required, provide notice in the App or on the store listing.
15. Contact us
Valhalla Health and Spine — Dr. Elan Michael
465 Columbus Ave, Suite 250, Valhalla, NY 10595
Email: vhs@valhallahealthandspine.com
Phone: (914) 292-5510