Privacy Policy

Last Updated: August 25, 2026

Endo Mind, Inc. ("Thyra," "we") builds and operates the Thyra platform, websites, applications, and related services (the "Services"). This Privacy Policy explains what information we collect, how we use and share it, and the choices you have.

Health information. When we provide the Services to healthcare organizations, we may receive or create Protected Health Information (PHI) on their behalf. Our handling of PHI is governed by HIPAA and by our agreements with customers, including any Business Associate Agreement (BAA). If you are a patient, this policy does not replace your provider's Notice of Privacy Practices | direct medical-record requests to your provider.

What we collect

• Contact and account information (name, email, phone, title, specialty, organization, credentials).
• Professional and practice information, and communications history.
• Device and usage information (IP address, device identifiers, browser, approximate location, log and usage data).
• Support communications and marketing/event preferences.
• Mobile number and SMS consent — if you opt in to text messages from a medical practice that uses Thyra, we collect your number, your consent status, the date, time and source of that consent, the disclosure text you were shown, and the delivery status of messages we send you.

We do not intentionally collect sensitive personal information or patient records through the public marketing website.

How we use information

To provide the Services and fulfill requests, support customers, secure the platform, improve the product (using aggregated or de-identified data where feasible), communicate with you, and meet legal obligations. When we process PHI as a business associate, we use it only as permitted by HIPAA and our customer agreements. We do not use PHI for advertising.

Cookies and analytics

We and our providers use cookies and similar technologies for strictly necessary functions, analytics (e.g., Google Analytics or similar), and preferences. You can control cookies through your browser. We run only limited B2B advertising and do not build patient advertising profiles.

How we share information

We do not sell personal information. We share with service providers under contract, with your organization and authorized users, with third-party integrations you enable, for legal reasons, in a business transaction, and as de-identified/aggregated data.

Mobile and SMS messaging

Medical practices use Thyra to send text messages to their own patients. The practice is the sender; Endo Mind, Inc. ("Thyra") transmits those messages on the practice's behalf as its service provider.

When you opt in, we collect your mobile number and consent status in order to deliver appointment reminders and confirmations, cancellation and reschedule handling, patient-portal invitations, and account and security notifications. These are transactional messages. We do not send marketing or promotional text messages, and we do not use purchased lists.

Mobile opt-in information and consent are never sold, rented, or shared with third parties or affiliates for their own marketing purposes, and are not shared with any third party for any purpose other than delivering the messaging service you requested — for example, our messaging carrier and aggregator, acting solely to transmit messages on our behalf under contract.

Message frequency varies. Message and data rates may apply. Reply STOP to any message to cancel, or HELP for help. Text messaging is never required to create an account or to receive care; you can choose email or the secure patient portal instead. See our SMS/Text messaging terms for the full messaging terms.

Your choices and state privacy rights

You may opt out of marketing emails at any time. Depending on your state (e.g., California/CCPA and similar laws), you may have rights to know, access, delete, correct, and opt out of certain processing, plus non-discrimination. Email support@thyrahealth.com with the subject "Privacy Rights Request." State privacy laws generally do not apply to PHI regulated by HIPAA | direct PHI requests to your provider.

Security, retention, and contact

We use administrative, technical, and physical safeguards including access controls, encryption in transit, monitoring, and audit logging; no method is completely secure. We retain personal information as long as reasonably necessary; PHI retention is controlled by customers and applicable law. The Services are intended for use in the United States. Questions: support@thyrahealth.com (subject "Privacy"). Endo Mind, Inc., Delaware, United States. See also our Terms of Service.

Book 15 minutes with JJ

A board-certified endocrinologist walks you through your own inbox scenario. No slides. Book 15 minutes with JJ, or apply for a 30-day pilot. Not ready? Ask JJ a question.