In short
Some organizations that give their members Free and Sober run federally assisted substance use disorder programs. Federal rules at 42 CFR Part 2 protect the records of those programs. This notice explains when those rules apply to information in Free and Sober, what we do to follow them, and what they do not cover. Free and Sober is a wellness app. Free and Sober Inc. is not a Part 2 program, is not a treatment program and does not provide treatment.
When these rules apply
42 CFR Part 2 applies to records that identify a person as having, or having had, a substance use disorder, when a federally assisted program creates or receives them for diagnosis, treatment or referral for treatment. They can reach Free and Sober in one way: when a program that is covered by Part 2 gives its members Free and Sober and shares Part 2 information with us under a written agreement.
When you use Free and Sober on your own, without a program, Part 2 does not cover your information. Our Privacy Policy and Consumer Health Data Privacy Policy do.
What we do with Part 2 records
- We sign a qualified service organization agreement with the program, and a business associate agreement where HIPAA also applies, before we receive any Part 2 record. The service providers that may handle these records for a program's members, Amazon Web Services, OpenAI and Google Workspace, are covered by signed agreements that bind them to HIPAA and to 42 CFR Part 2's limits on use and disclosure. A member's own mentor conversations are sent to OpenAI, under that signed agreement, with OpenAI's storage turned off and Modified Retention, and only after the member consents in the app. Sentry receives only crash reports from the app, scrubbed on the device, and never receives Part 2 records. Anam, our live avatar host, never receives Part 2 records: members of an organization's program don't use Anam and never have video.
- We use Part 2 records only to provide the services in that agreement.
- We do not disclose Part 2 records to anyone except as Part 2 and your written consent permit. We resist in court any effort to get them, except as Part 2 allows.
- We do not use Part 2 records against you in any criminal, civil or administrative case, and we do not let them be used for that, unless Part 2 permits it.
- We never sell Part 2 records, use them for advertising, or use them to train AI models. If Part 2 records we hold are breached, we tell your program without unreasonable delay, and no later than 60 days after we discover it, so that it can notify you as the federal breach rules require (42 CFR 2.16 and 45 CFR part 164, subpart D).
What your program can see
Your program sees only what the member authorization you accept in the app allows, such as whether you joined. Your journal, Time Capsules and mentor conversations aren't shared with your program. You can withdraw that authorization in the app at any time. Withdrawing does not undo a disclosure already made in reliance on it.
Notice to anyone who receives these records
42 CFR Part 2 prohibits unauthorized use or disclosure of these records. Information disclosed under a Part 2 consent may not be used or disclosed further, or used to investigate or prosecute the person, except as Part 2 permits.
Your rights and complaints
You can ask your program, or us, for an accounting of disclosures that Part 2 lets you request. You can file a complaint about a violation of Part 2 with the U.S. Department of Health and Human Services, Office for Civil Rights (hhs.gov/ocr/complaints), and with your program. You can also tell us, and we will not retaliate against you for filing a complaint. You will never be asked to give up this right to use Free and Sober. Your program must also give you its own notice of privacy practices under 42 CFR 2.22. This notice does not replace it.
Contact us
Email support@freeandsober.com, or use our contact form. We reply within 24 hours.
Free and Sober Inc., 89 Moody Road, Enfield, CT 06082