Privacy Policy

We collect and process the following categories of personal data in accordance with applicable data protection laws, including but not limited to the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other relevant regulations:

• Identification and Contact Information: Name, email address, postal address, phone number, IP address, and device identifiers.
• Account and Usage Data: Username, password (hashed), login history, interaction logs, browsing history, and usage analytics.
• Communication Data: Content of messages, emails, support tickets, and feedback submitted through our services.
• Technical Data: Browser type, operating system, cookies, web beacons, and other tracking technologies.
• Financial Data (if applicable): Payment details processed via third-party providers.
• Sensitive Data (if applicable): Only with explicit consent, such as biometric data or health information.

We collect this data directly from you, automatically through cookies and similar technologies, or from third parties (e.g., analytics providers). We do not collect data from children under 16 without verifiable parental consent.

Purpose of Collecting Data

We process your personal data for the following legitimate purposes, as required by law:

1. Service Provision: To provide, maintain, and improve our AI services, including generating responses, processing queries, and enabling account functionality (legal basis: contract performance; necessity for service delivery).
2. Communication: To respond to inquiries, provide support, and send transactional emails or notifications (legal basis: legitimate interests; consent where required).
3. Analytics and Improvement: To analyze usage patterns, develop new features, and enhance model performance (legal basis: legitimate interests in business operations).
4. Security and Compliance: To detect fraud, ensure platform integrity, and comply with legal obligations (legal basis: legal obligations; legitimate interests).
5. Marketing (optional): To send promotional content, with your consent or under legitimate interests where permitted (legal basis: consent or legitimate interests).
6. Legal and Regulatory: To respond to lawful requests, enforce terms, or protect rights (legal basis: legal obligations).

Data retention is limited to the duration necessary for these purposes (e.g., account data while active + 30 days post-deletion; logs for 12-24 months for security). We rely on legal bases such as consent, contract necessity, legitimate interests, and legal obligations. You have rights to access, rectify, erase, or object to processing—contact us to exercise them. Data may be shared with affiliates, service providers, or in mergers, always under strict confidentiality. International transfers use Standard Contractual Clauses or adequacy decisions.

We are required by law to maintain the privacy of your protected health information ("PHI"), to provide you with notice of our legal duties and privacy practices regarding PHI, and to notify affected individuals following a breach of unsecured PHI.

**1. How We May Use or Disclose Your Health Information**

We may use and disclose your PHI for the following purposes without obtaining your written authorization:

**A. Treatment.** We may use and disclose PHI to provide, coordinate, or manage your health care and related services. This includes consultation with other health care providers, referrals, and coordination of care.

**B. Payment.** We may use and disclose PHI to obtain payment for the health care services we provide, including billing your health plan, determining eligibility, and utilization review activities.

**C. Health Care Operations.** We may use and disclose PHI for our health care operations, including quality assessment and improvement, medical review, business management, training programs, accreditation, and compliance activities.

**D. Other Uses and Disclosures Allowed by Law (without authorization)**

- To avert a serious threat to health or safety

- As required by law (court orders, public health reporting, abuse/neglect reporting, coroner/medical examiner, etc.)

- For public health activities (disease reporting, FDA oversight, etc.)

- For health oversight activities (audits, investigations)

- For judicial and administrative proceedings

- For law enforcement purposes (limited circumstances)

- To coroners, medical examiners, funeral directors

- For cadaveric organ, eye, or tissue donation

- For research (under strict conditions or de-identified)

- To prevent or lessen serious and imminent threats

- To military/veterans affairs, national security, protective services

- For workers' compensation purposes

- To friends/family involved in your care (limited)

**E. Uses and Disclosures Requiring Your Written Authorization**

We will obtain your **written authorization** before using or disclosing your PHI for any purpose **not** described above, including (but not limited to):

- Most uses/disclosures of psychotherapy notes

- Marketing purposes (with limited exceptions)

- Sale of your PHI (with very limited exceptions)

You may revoke an authorization at any time in writing. Revocation will not affect uses/disclosures already made in reliance on the authorization.

**2. Your Rights Regarding Your Protected Health Information**

You have the right to:

1. **Receive a paper copy** of this Notice upon request

2. **Request restrictions** on certain uses and disclosures of your PHI (we are not required to agree to all requested restrictions)

3. **Request confidential communications** (e.g., receive communications at an alternative address/phone number)

4. **Inspect and obtain a copy** of your PHI (with very limited exceptions)

5. **Request amendment** of your PHI if you believe it is inaccurate or incomplete

6. **Receive an accounting** of disclosures of your PHI made by us (for the prior 6 years, with some exceptions)

7. **Receive notice** of any breach of your unsecured PHI

8. **File a complaint** with us and/or with the U.S. Department of Health & Human Services Office for Civil Rights

**3. Our Duties**

We are required by law to:

- Maintain the privacy of your PHI

- Provide you this Notice of our legal duties and privacy practices

- Abide by the terms of the current Notice

- Notify you following a breach of unsecured PHI

We reserve the right to change the terms of this Notice and to make the revised Notice effective for all PHI we maintain. The revised Notice will be posted and available upon request.