Israel Privacy Notice

Grovvve handles personal information, including medical and health-related information, in accordance with the Privacy Protection Law, 5741-1981, and the Privacy Protection Regulations (Data Security), 5777-2017. Health information is treated as sensitive data requiring a heightened level of security.

As with our other regional obligations, practitioners act as the owner of the database for their client data, and Grovvve acts as a holder of that data, processing it only on the practitioner's instructions.

In line with the security level required for databases containing sensitive medical information under the Data Security Regulations, Grovvve maintains AES-256 encryption at rest, TLS 1.2+ encryption in transit, role-based access controls, and periodic security reviews.

Some data processing occurs via infrastructure providers located outside Israel, including the EU and US. Where personal information is transferred outside Israel, we take reasonable steps to ensure it remains subject to protections consistent with Israeli privacy law, including through contractual data processing terms with our providers.

Where a practitioner using Grovvve is subject to the Patients’ Rights Law, 5756-1996, that law distinguishes the medical record a practitioner must keep and may be required to disclose from the practitioner’s own internal working notes. Grovvve does not make that determination for you: the practitioner decides what forms part of the medical record, and remains the party responsible for keeping, disclosing and retaining it.

What Grovvve does is keep the material separable. Signed session notes, intake submissions and appointment history are stored as distinct records and can be exported on their own, so a practitioner responding to a patient request can produce the medical record without also disclosing unrelated internal content.

AI-generated notes are drafts. Nothing is treated as part of a clinical record until the practitioner has reviewed, edited and signed it, and Grovvve provides no diagnosis, treatment recommendation or clinical judgement at any point.

Session audio is not stored on Grovvve’s servers. A recording is transcribed in memory and discarded; only the transcript and the resulting note are stored. So that a dropped connection does not lose a session, the recording is held in the practitioner’s own browser until its transcript has been saved to the note, then deleted. Anything never recovered is deleted automatically after 7 days, and the practitioner can delete it at any time. Practitioners remain responsible for obtaining whatever consent their profession, licensing body or the Patients’ Rights Law requires before recording or transcribing a session.