Consumer Health Data

"Consumer health data" is information that identifies your past, present, or future physical or mental health. For BetterStep this includes: your addiction/substance-use status, recovery information and your self-reported recovery and check-in data, journal and chat entries that reveal health or mental state, your biometric and activity data (heart rate, sleep, etc.), and the personal progress signal we generate.

The categories are the same as in our Privacy Policy — collected from you, from your connected wearables (via Terra), and automatically (technical and diagnostic data). See our Privacy Policy for the full list.

To provide the recovery and wellness features you request, personalise your experience, generate your personal progress signal, secure the Service, and — only if you enrol with a clinician — to make selected data available to that clinician. We do not use your consumer health data for advertising, and we do not sell it. See our Privacy Policy for more on how we use your data and on AI processing.

• Service providers (processors) — AI processing (OpenAI), wearable aggregation (Terra), hosting and database, error monitoring, push notifications, authentication, and email. The full list of service providers is in our Privacy Policy and is available on request. • Clinicians you enrol with — your recovery profile, check-ins, progress signal, and any clinical notes. • We do not share your consumer health data with anyone else except as required by law or to protect safety.

Consistent with Washington and Nevada law, we obtain separate, affirmative opt-in consent: 1. To collect your consumer health data — a clear opt-in at onboarding, separate from accepting the Terms. 2. To share your consumer health data with the processors and any clinician — a second, distinct opt-in, separate from the collection consent. 3. We will not sell your consumer health data. If that ever changed, the law requires a separate written authorization from you, which we would request explicitly. We do not plan to sell. You can withdraw any consent at any time (Section 6); withdrawal stops future processing that relied on it.

You have the right to: • Confirm and access the consumer health data we have about you, and the list of third parties and processors we share it with; • Delete your consumer health data (we will also direct our processors to delete it, as the law requires); • Withdraw consent to our collection and sharing of your consumer health data. To exercise these rights: email info@betterstep.io (subject "Consumer Health Data Request") or use the in-app account controls. We will verify your request and respond within the timeframe each applicable state law requires. We will not discriminate against you for exercising these rights. California residents: your addiction/health data is "sensitive personal information" under the CCPA/CPRA. You may limit the use and disclosure of your sensitive personal information, access, correct, and delete your data, and opt out of any "sharing." We do not sell your data.

As described in our Privacy Policy — encryption in transit and at rest, access controls, a separate clinician-access system, and an access audit log.

See our Privacy Policy. Deletion requests cover all consumer health data we and our processors hold, subject to legally required retention.

If consumer health data is subject to a breach, we will notify affected users and the relevant authorities as required, including under the FTC Health Breach Notification Rule (which applies to this app because it draws health data from multiple sources) — notice within the legally required timeframe (generally within 60 days, sooner for larger breaches).