Consumer Health Data Privacy Policy

Who this policy covers

This policy is for people who use the Free and Sober app and website, and for people someone added to their corner. It applies alongside our Privacy Policy. HIPAA, the federal law for health information held by doctors, hospitals and health plans, doesn't cover what you give Free and Sober yourself, because we are not your health care provider or your health plan.

This policy is from Free and Sober Inc., a Delaware corporation, which runs the Free and Sober app and the freeandsober.com website. In this policy, "Free and Sober," "we," "us" and "our" mean Free and Sober Inc. "Free and Sober" is also the name of our app and service.

It follows:

• Washington's My Health My Data Act
• Nevada's consumer health data law (Senate Bill 370)
• Connecticut's consumer health data rules in the Connecticut Data Privacy Act

"Consumer health data" means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health. In a sobriety app, that is nearly everything, so we treat it all with the same care.

The consumer health data we collect, and why

That you use Free and Sober

• What: your email address, first name and account, which together show that you use a sobriety app.
• Why: to sign you in with a one-time code and to run your account.

Your sobriety details

• What: your start date, your counts and any restarts, your total days, milestones, the path you are on, your reasons in your own words, your check-ins, daily notes, and progress through the 30-day program, and the meetings and calls you log.
• Why: to show your count and progress, speak your path's language, mark milestones, and give the mentor what it needs to answer you.
• At launch: your reasons, your check-in answers and notes, any note you add to a count, and the names of meetings you log are encrypted on your phone with your key, so we can't read what we store. When the mentor uses your reasons, your phone sends them with your request, and our server and the AI provider read them. Your start dates, counts, milestones, path and the days you logged a meeting stay readable to us.

Time Capsule recordings

• What: the video, voice or written message you make for your future self, your answer to it, and details about each capsule: that it exists, which count it belongs to and what kind it is (such as that count's first capsule or your answer to it), the size of its file, which version of your key locks it, when it was sealed, the time zone, the day it opens, and when you first played it.
• Why: to keep your message sealed until its day, then play it for you. The first capsule of each count opens 30 days after you seal it, and each later one on a day you pick, up to ten years out. If you turn on emails before a capsule opens, we also use its opening day to email you. The recordings are never analyzed and never go to an AI provider.
• At launch: each capsule is encrypted on your phone with your key before it is uploaded, so we store it only in a form we can't see or hear. The details listed above stay readable to us, because we need them to keep the seal and open each capsule on its day. A recording's file size shows roughly whether it is video or voice and how long it is. Every written capsule is the same size.

Mentor conversations and safety information

• What: what you type or say to the mentor and its replies, your voice while you talk by voice, the mentor's memory notes, and the risk level our crisis detection sets during a conversation.
• Why: to let the mentor answer you, to remember what matters to you, and to recognize a crisis and put help in front of you fast.
• Kept: conversations are kept only for the session, unless you agree to a short, stated retention window. The risk level is kept only for the session. We do not record voice audio.
• Counts: we count how often crisis help was shown and how often a mentor declined to give medical advice, for safety review and the reports the law requires. These counts hold no name, no account ID and no words.
• Who reads it: to answer you, our server handles what you send in readable form and passes it to the AI provider you agreed to. Mentor conversations are not end-to-end encrypted. At launch, the mentor's memory, and any conversation history you choose to keep, are stored encrypted with your key. Your phone sends them with your requests, and our server and the AI provider read them then.
• Program members: if an organization's program gives you your seat, you can have the mentor by message and by voice while your seat lasts, never on video, once you consent. What you type in messages, and the words of a voice conversation, go to OpenAI, which writes the mentor's replies, with its storage turned off; in a voice conversation, Amazon Web Services also hears you and speaks the replies; we have a HIPAA business associate agreement with each, and nothing of yours goes to any other AI provider. Your conversations are not shared with your program. The crisis help in the app stays on for you.

Your safety plan and trusted contact

• What: the safety plan you build, and your trusted contact's name and phone number.
• Why: to read your plan back to you in a hard moment, and to let you reach your trusted contact from your own phone when you tap the button.
• At launch: both are encrypted on your phone with your key, so we can't read them. We can see only that a plan exists and when it changed. Your trusted contact's name and number are also kept on your phone, so the crisis panel works without a connection.

Your calendar

• What: appointments you add, such as a counselor, a doctor, a medication pickup, clinic dosing, court or probation, and whether you went.
• Why: to show your calendar, and to set private reminders on your phone, or by email if you turn that on. No organization, corner member or mentor sees it, unless you let the mentor see what is coming up.
• At launch: each appointment's name, kind, place and notes are encrypted on your phone with your key, so we can't read them. Its day, times, time zone, repeats, reminder settings and the days you marked "I went" stay readable to us. An email reminder holds only its time, never the appointment's name or kind.

Your journal (at launch)

• What: entries you write: daily thoughts, gratitude and moments that mattered.
• Why: to keep your journal for you and remind you of an entry on a day you pick. Only for entries you let the mentor read: to let the mentor answer you or help you write. At launch, entries will be encrypted on your phone with your key, so we can't read what we store. We can see only that an entry exists, when it was saved, roughly how long it is and, for up to 90 days, when it was deleted. For an entry you let the mentor read, your phone unlocks it and sends it with your request, and our server and the AI provider read it.

Meeting searches

• What: the ZIP code or city you type to find meetings (if you type a street address, only its ZIP code or city is used). Never your phone's location.
• Why: to list meetings near the place you typed. It is used for that search only and not kept, and no outside service receives it.

Your Corner

• What: the first name and email address of people you add, what you share with each of them and what each may send you, notes they send you, corner capsules they record for you, and on Plus and Premium, the voice and video messages and video capsules you allow; your mutes and blocks, and any report you make (the sender's first name and email address, the time, and the message only if you choose to share it).
• Why: to share the progress you choose with the people you choose, and to deliver their notes and messages to you.
• At launch: notes, corner capsules and voice and video messages they send you are encrypted in their browser, by our corner web page, so only your key can open them, and we can't read, hear or watch what we store. We can see who sent each one and when, the milestone a corner capsule opens on, which version of your key it is locked for, when you opened it, and its size. The names and email addresses of the people in your corner, and what you share with them, stay readable to us, because we send their emails.

A referral code

• What: if you add one, the referral code someone shared with you, which you type in the app (the You tab, then Referral code) within 7 days of joining; the version of the line you agreed to; and the date you added it. In your first 7 days, and after that only if you've added a referral code, your app store's subscription events: which store and plan, trial or paid, when it started, renewed, was cancelled, expired, was refunded or had a refund reversed, whether it can count for a referral (it can't if it came through Family Sharing or was a test purchase), and the store's transaction number. No link or QR code carries a referral code, nothing counts how often one is shared, and the app never reads a referral code from a link or from the app store.
• Why: to count how many people used the code and to pay the person who shared it, in totals only. They never see who you are.
• Kept: without a referral code, each subscription event from your first 7 days for about 8 days after it reaches us, so that a code added in those days can count, then deleted; after your first 7 days, none at all. With a referral code, until you delete your account.

Organization membership

• What: which organization you joined through a code. If you sign the organization's separate privacy disclosure: its own reference for you, and any appointments and program dates it sends you, which go on your calendar only if you accept them. At launch, our server checks each appointment or program date as it arrives and then locks it so only your key can open it. Its times stay readable to us. If your program holds video meetings in the app and you join one: that you asked to join, whether you were let in and how long you were connected, kept until a day after the meeting; and, in our access log of everything staff do about your seat, each time a host saw you in the waiting room or in the meeting, let you in, muted you or removed you, kept at least 400 days, then in a locked archive for six years. We never record or transcribe a meeting, and no AI provider receives it.
• Why: to show your organization's resources, provide the plan it pays for, and include you in the organization-wide engagement counts you agreed to. If you sign an organization's separate privacy disclosure, also to receive what it sends you and send it the view you agreed to on it.

Your vault's keys (at launch)

• What: your public key, which lets others lock things for you but can't open anything; which version of your key is current, when it was made, and when an older one was replaced; if you make a recovery key, the date you made it and a copy of your key locked with it, which we can't open; and, when you move your key to a new phone by scanning a code, the key on its way, locked so we can't open it, which we delete when your new phone confirms it, or after 10 minutes. If your phone can back up your key, the app also saves it in your iCloud Keychain or your Google account's backup, which Apple and Google hold under their own terms.
• Why: so your phones can check your key, others can lock things for you, your recovery key can open your vault on any phone, and you can move your key to a new phone. Our Privacy Policy explains what happens if your key is lost.

Security logs and device details

• What: your device model, operating system and app version; when you signed in; and when your app or browser connected to our servers and what it asked for. Our servers use your IP address to answer and to limit abuse; our own logs don't record it, except that our meetings server's logs can record the address your phone connected from to a video meeting with your program, for 30 days. When your phone uploads or downloads a recording, our storage provider's security log records the IP address it came from; we keep that log up to six years, locked for the first year. Logs never hold what you wrote or said, and crash reports are set up to leave out your name, your email and what you wrote.
• Why: to keep your account secure, prevent abuse and fix problems.

Your account settings and plan

• What: your time zone, your state, that you passed the age check, a record of each consent you gave, your plan and whether it is active, the voice minutes and messages you used, and a notification token if you allow notifications. If Free and Sober isn't available where you live yet (at launch, Utah), your email address and state, on our waitlist.
• Why: to keep your count and reminders on your own calendar, check that you are 18 or older, follow the laws of the state where you live and check that the app is available there, keep a record of what you agreed to, know which plan you have, and deliver the notifications you turned on.

Our launch waitlist

• What: your email address, if you ask on our website to hear when the app launches, and a record of your consent (which version of the form you agreed to, and when, for each box you ticked). Signing up shows that you asked about a sobriety app, so we treat it as consumer health data, even if you asked for someone else.
• Why: to send you a short email confirming that you joined, which links to our Instagram and Facebook pages with no tracking, and one email when the app launches, which includes the waitlist code FIRST30 for 30 days of the Essentials plan free, for people on the waitlist. If you also tick the separate, optional box for news, we use it after that to send you occasional news about Free and Sober, such as new features and tips, until you unsubscribe. Every email has an unsubscribe link. We don't track whether you open these emails or click their links. If you didn't tick the box for news, we delete your address within 30 days after we send the launch email. If you did, we delete it within 30 days after you unsubscribe. We delete it sooner if you ask. Whenever you unsubscribe or ask to leave, we keep only a scrambled (hashed) form of your address, so we don't send it waitlist or news email again unless you sign up again. If an email to your address bounced or was marked as spam, Amazon SES keeps the address itself on our account's do-not-send list. It isn't scrambled, and while it's there no email is sent to it, even if you sign up again, until we take it off at your request (write to support@freeandsober.com). If the app hasn't launched within six months of when you signed up, we delete it without writing to you.

Messages you send us

• What: what you write to support, and what you type into a form on our website, such as an account deletion request. Even a deletion request shows that you use Free and Sober.
• Why: to answer you and do what you asked.

Where it comes from

• You, when you type, record or talk in the app, or fill in a form on our website
• Your phone, such as your time zone, your device details and your public key
• People in your corner, when they accept, send a note, or record a corner capsule or a voice or video message
• Organizations you join, such as program dates they send you after you sign their privacy disclosure
• Apple and Google, such as your plan's status, through RevenueCat, and the age range your app store shares
• Stripe, if we offer plans on our website (we don't yet): that a purchase there went through, under the random ID RevenueCat knows you by
• Our own systems, such as your day count, milestones, the risk level our crisis detection sets, and our logs

How we use it

We use consumer health data only to:

• Provide the features you ask for
• Keep you safe, by recognizing a crisis and showing crisis help
• Send the messages and reminders you chose
• Keep your account secure and fix problems
• Meet our legal duties, such as the yearly counts of crisis referrals that California and other states require, which hold no user identifiers

We do not sell it. We do not use it to target ads, and we send marketing email only to people who ask for it. We do not collect, use or sell it to train large language models or any other AI model, and our AI providers may not use it to train theirs. We do not use geofencing around health care locations or anywhere else. We do not allow any other company to collect consumer health data about you over time and across different websites or online services when you use our app or website.

Your consent

We collect consumer health data only as needed to provide the features you ask for, or with your consent. When you sign up, a separate screen, apart from our terms, asks your consent to collect it for the features you use. We ask for your separate, clear consent before we share it, beyond what the feature you asked for needs. Each consent screen says what data, why, who receives it, and how to withdraw, and we keep a record of each consent (the screen's version and the time). For example:

• AI providers. Before your information goes to OpenAI, Amazon Web Services or Anam, the app names the provider, says what it receives, and asks you. You can change your answer any time in You, then Privacy, then AI providers.
• Your Corner. You choose each person and what each one sees. They see nothing until they accept.
• Organizations. Before you join, one screen lists what the organization will see and what is not shared with your program. Nothing is shared unless you agree. It is billed for each member, so its monthly invoice shows the exact number of members on each plan. If an organization connects its own systems to Free and Sober, nothing about you goes to it, and nothing addressed to you alone comes from it to your app, until you sign a separate privacy disclosure in the app that lists what it could send you and what it could see. You choose, and can withdraw at any time; it stops that day, both ways, and the organization learns only that sharing ended, not why. Your Time Capsules, corner capsules and journal are never shared, signed or not: at launch, they will be encrypted so only you, with your key, can open them.
• Your trusted contact. We never contact them ourselves. When you tap the button, the app opens your own phone's dialer or messages, and you see any message before you send it.
• Our launch waitlist. Before we keep your email address, the form on our website asks you to tick a box, which is never ticked for you. It says what we keep, why, who handles it for us, and how to take it back. A second box, for occasional news after the launch, is optional and also never ticked for you. You can join the waitlist without it.

If we ever want to use your health data for a new purpose, we will ask you first.

Who we share it with

Service providers who process it for us

These companies process consumer health data only on our instructions and only to provide their service to us:

• Our servers, database, sign-in and file storage (Amazon Web Services, in the United States, Northern Virginia): all categories above. At launch, it holds what's in your vault only in locked form, which it can't read. Our servers, which run on Amazon Web Services, also handle in readable form what your phone sends with a mentor request, and appointments an organization sends as they arrive. If your program uses video meetings, our own video server for them also runs on Amazon Web Services, and carries the meetings' sound and video only in a form it can't decrypt.
• AI providers (OpenAI, Amazon Web Services and Anam), only after you consent; for members of an organization's program, OpenAI and Amazon Web Services alone, never Anam. OpenAI writes the mentor's replies and runs part of our crisis detection, including for members of an organization's program once they consent. When you talk with the mentor out loud, Amazon Web Services hears and speaks: Amazon Transcribe turns speech into text, Amazon Bedrock Guardrails checks each message and reply, and Amazon Polly speaks the replies. Anam, in video calls with the mentor, shows the mentor's face, moved by the finished sound of the mentor's replies alone. Each provider's consent screen in the app uses the same words as below.
  • OpenAI
    • What OpenAI receives. What you write to the mentor and its replies, and what it needs to answer you well: your first name, the path you're on, your reasons, the mentor's memory notes, any conversation history you choose to keep, and any journal entry you choose to let the mentor read.
    • What it never receives. Your Time Capsules, corner capsules, or anything an organization sent you. Your calendar only if you turn that on.
    • What OpenAI may do with it. Only answer you, and run a safety check that helps our code spot danger. It may not use it to train its models. We send it with storage turned off (store: false), and OpenAI keeps it only as Modified Retention in our signed agreement allows. We don't claim zero data retention.
  • Amazon Web Services
    • What AWS receives. What you write or say to the mentor and its replies, and what it needs to answer you well: your first name, the path you're on, your reasons, the mentor's memory notes, any conversation history you choose to keep, and any journal entry you choose to let the mentor read.
    • What it never receives. Your Time Capsules, corner capsules, or anything an organization sent you. Your calendar only if you turn that on.
    • What AWS may do with it. Only answer you, and run the safety checks that help our code spot danger. It may not use it to train its models, and we've turned off its logging of what is sent.
    • Not recorded. We don't record the audio.
  • Anam
    • What Anam receives. Only the finished sound of your mentor's replies during a video call, so it can move the mentor's face and lips with them. The mentor's replies can include what you said. Like any service the app connects to, it also sees your phone's network address and how well the video connection is working, and its software in the app tells it which version it is.
    • What it never receives. Your voice, your name, your account, your words or anything you type. Your camera stays off, and your microphone never sends anything to Anam.
    • Not recorded. We turn off Anam's session recording for every call.
    • Crisis help never waits. Crisis lines come from the app itself, never through Anam, and the video closes so the crisis lines can show.
• Email delivery (Amazon Web Services, Amazon SES, in the United States, Northern Virginia): your email address, and what each email needs: sign-in codes; corner invitations and milestone emails, with corner members' first names and email addresses; the time of an email calendar reminder and the day a Time Capsule opens, if you turn those emails on; notices that a security setting changed; notes about your plan; the email saying your account is deleted; and, if you joined our launch waitlist, the email confirming that you joined, the one email when the app launches, and our news emails if you ticked the box for them. Never anything from your vault. Our emails are delivered only over an encrypted connection (TLS), and we don't track whether you open them or click their links. An address that bounced or was marked as spam stays on our account's do-not-send list, so nothing more is sent to it.
• Waitlist sign-ups (Cloudflare): your email address, if you joined our launch waitlist. Cloudflare passes it on from our website host so that Amazon Web Services can send the email confirming that you joined. Never anything else.
• Subscription management (RevenueCat): a random ID made for it alone, your plan status and the purchases you make in the stores, and the technical details each connection carries, such as your IP address, the app's version, your phone's platform, and the identifiers and settings the store gives the app for your device. The app first connects when you open the plans, plan or minutes screen, buy, restore or manage your plan. After that, until the app is closed, it checks again each time you come back to the app, even after you sign out or start a program, and for anyone who signs in on the phone before the app is restarted. It never receives your name or email, and nothing else about what you do in the app. While an organization's program pays for your plan, the app doesn't set it up for you and we don't ask it about you, though those checks go on until the app is closed if one of those screens was opened since it started.
• Payments on our website (Stripe), if we offer them (we don't yet): the random ID RevenueCat knows you by, from us; your email, card and billing address, which you give Stripe on its own page. Never anything you do in the app.
• Push notification delivery (Amazon SNS, through Apple's and Google's push services): the notifications you turned on, which never contain health details. What a notification carries besides its words says nothing of what it is about
• Crash reporting (Sentry): technical error details, with personal and health details removed on your phone
• Our support email provider: whatever you choose to write to us
• Our website host (Webflow): whatever you type into a form on our site

Our servers, database and file storage are in the United States. OpenAI doesn't promise a United States location for what it receives, and may process some of it outside the United States. Amazon Web Services handles the mentor's requests, and your voice, in the United States (Northern Virginia) only. Anam, our live avatar host, says it runs live calls in the United States (US East), though it doesn't promise that all of its storage stays there. Anam keeps no recordings or transcripts of calls; any text it receives may sit in its operational logs for up to 30 days.

The full list, with each company's name, what it receives and where, is on our subprocessors page.

Third parties you direct us to share with

• People in your corner: only the progress you chose for each, such as milestones or your day count. Never recordings, conversations, check-ins, notes, cravings or slips.
• Your trusted contact: nothing from us. You reach them from your own phone, as described above.
• An organization you join: engagement counts for all its members together, with activity counts from 1 to 10 held back so no one can be picked out, plus, only if you signed its separate privacy disclosure, the view you agreed to. Never your Time Capsules, corner capsules or journal, which, at launch, only you, with your key, will be able to open. Never your words, recordings, mentor conversations, notes, calendar or any crisis or safety event, except what you say and show in a video meeting with its staff that you choose to join, which everyone in the meeting sees and hears, with your first name only.

When the law or an emergency requires it

• Emergency services or someone able to help, only if someone tells us directly that a person's life or safety is in serious and immediate danger, and only the minimum needed, from the details we can read, never what's in your vault. We don't watch conversations for emergencies.
• Courts or government agencies, only when the law requires it, after our lawyer reviews the request. Records from a federally assisted addiction treatment program need a qualifying court order. At launch, for what's in your vault, all we can give is the locked files and records and the details that stay readable to us. We can't unlock them, and we have no key to give. The rest of what we hold is readable to us, and the law may require us to hand it over.

Affiliates

We do not share consumer health data with any affiliate.

Sale

We do not sell consumer health data.

Your rights

You have the right to:

• Confirm and access. Ask whether we collect, share or sell your consumer health data, and get a copy of it. At launch, we hold what's in your vault only in locked form, so your copy of it comes from the app on your phone, where your key is. We send you the rest.
• Get a list of who we shared it with. This is a list of all third parties and affiliates we have shared your consumer health data with, and a way to contact each of them. Our subprocessors page lists them now; ask us for the list that applies to you.
• Delete it. We delete it from our systems and tell our service providers and the third parties we shared it with to delete it too. When you delete your account in the app with Delete my account, we delete it 30 days later: until then we don't use it or send you anything, no organization sees anything of yours, and signing in lets you keep your account. Delete everything now, and our account deletion request, delete it at once. What an AI provider already received may stay with it for up to 30 days, as described above, before it deletes it. We can't make it delete that copy sooner. Copies in our backups age out: our database backups, and the deleted-file recovery of our file storage, keep them for 30 days, and never longer than six months. We never bring back anything you deleted, or anything removed when your account was deleted. At launch, what's in your vault stays locked in them, and once your account is deleted, the app on the phone you deleted it on also deletes your key from that phone and from your iCloud Keychain or Google backup. We keep only the few records our Privacy Policy lists under "How long we keep your information": records of your consents, in a form that no longer identifies you, and security records that hold nothing you wrote or said. We keep a signed organization privacy disclosure for six years, as our agreements with organizations provide and, for an organization covered by HIPAA, as HIPAA requires. An organization you signed a privacy disclosure for keeps what it already received under the health privacy laws that apply to it.
• Withdraw your consent. Take back any consent you gave us to collect or share your consumer health data.
• Be treated fairly. We will never charge you more or give you a worse service because you used these rights.

If you live in Connecticut, the Connecticut Data Privacy Act gives you further rights, which our Privacy Policy lists.

How to use your rights

• See and download your data: in the app, go to You, then Export your data. At launch, the app makes your copy on your phone, where your key is. The copy isn't locked, so keep it somewhere private.
• Review and correct your data: in the app, change your name, start date and path from You, then Your start date and path, change appointments in your calendar, and read and edit the mentor's memory. For anything else, write to us.
• Delete your data: in the app, go to You, then Delete your account: 30 days later, with the chance to keep it until then, or at once. Or use our account deletion request, which deletes it at once.
• Withdraw consent: remove a person from your corner, leave an organization from the You tab, or turn off an AI provider in You, then Privacy, then AI providers. For anything else, write to us.
• Leave our launch waitlist: use the unsubscribe link in any of our emails, or email support@freeandsober.com, and we delete your address, except that scrambled (hashed) form. If an email to your address bounced or was marked as spam, Amazon SES keeps the address itself on our account's do-not-send list. It isn't scrambled, and while it's there no email is sent to it, even if you sign up again, until we take it off at your request (write to support@freeandsober.com). This also stops our news emails.
• Anything else, including the list of third parties: email support@freeandsober.com or use our contact form.

We confirm that a request comes from you, usually by replying to the email address on your account. Someone you authorize can ask for you, with proof that you authorized them.

We answer within 45 days. If we need more time, we tell you why within those 45 days, and we take at most 45 more days.

How to appeal

If we turn down your request, in whole or in part, you can appeal.

• Reply to our answer, or email support@freeandsober.com with "Appeal" in the subject line.
• We answer your appeal in writing within 45 days, and we explain our decision.
• If we deny your appeal, you can file a complaint with your state's attorney general.

Attorneys general:

• Washington: Office of the Attorney General, atg.wa.gov/file-complaint
• Nevada: Office of the Attorney General, ag.nv.gov/Complaints (complaint form)
• Connecticut: Office of the Attorney General, dir.ct.gov/ag/complaint (choose "Consumer Data Privacy")

Changes to this policy

When we change this policy, we post the new version here with a new date. If a change is important, we tell you in the app or by email before it takes effect.

Contact us

Email support@freeandsober.com, or use our contact form. We reply within 24 hours.

Free and Sober Inc., 89 Moody Road, Enfield, CT 06082